| name | implementing-velociraptor-for-ir-collection |
| description | Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments. |
| domain | cybersecurity |
| subdomain | incident-response |
| tags | ["velociraptor","dfir","endpoint-collection","vql","forensic-artifacts","rapid7","threat-hunting","incident-response"] |
| mitre_attack | ["T1486","T1490","T1070","T1078","T1005"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"] |
| nist_csf | ["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"] |
Implementing Velociraptor for IR Collection
Overview
Velociraptor is an advanced open-source endpoint monitoring, digital forensics, and incident response platform developed by Rapid7. It uses the Velociraptor Query Language (VQL) to create custom artifacts that collect, query, and monitor almost any aspect of an endpoint. Velociraptor enables incident response teams to rapidly collect and examine forensic artifacts from across a network, supporting large-scale deployments with minimal performance impact. The client-server architecture with Fleetspeak communication enables real-time data collection from thousands of endpoints simultaneously, with offline endpoints picking up hunts when they reconnect.
When to Use
- When deploying or configuring implementing velociraptor for ir collection capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Familiarity with incident response concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Architecture
Components
- Velociraptor Server: Central management console with web UI and API
- Velociraptor Client (Agent): Lightweight agent deployed to endpoints
- Fleetspeak: Communication framework between client and server
- VQL Engine: Query language engine for artifact collection
- Filestore: Server-side storage for collected artifacts
- Datastore: Metadata storage for hunts, flows, and client information
Supported Platforms
- Windows (7+, Server 2008R2+)
- Linux (Debian, Ubuntu, CentOS, RHEL)
- macOS (10.13+)
Deployment
Server Installation
wget https://github.com/Velocidex/velociraptor/releases/latest/download/velociraptor-linux-amd64
./velociraptor-linux-amd64 config generate -i
./velociraptor-linux-amd64 --config server.config.yaml frontend
sudo velociraptor-linux-amd64 /usr/local/bin/velociraptor
velociraptor --config /etc/velociraptor/server.config.yaml service install
