Deploy a Velociraptor server and agents, then author VQL (Velociraptor Query Language) artifacts and run them as fleet-wide hunts, on-demand forensic collections, or standalone offline collectors. Use when hunting a TTP across hundreds or thousands of endpoints, collecting forensic artifacts during incident response without re-imaging, or generating collectors for unmanaged/air-gapped hosts.
Deploy a Velociraptor server and agents, then author VQL (Velociraptor Query Language) artifacts and run them as fleet-wide hunts, on-demand forensic collections, or standalone offline collectors. Use when hunting a TTP across hundreds or thousands of endpoints, collecting forensic artifacts during incident response without re-imaging, or generating collectors for unmanaged/air-gapped hosts.
Authorized Use Only: Velociraptor agents provide deep endpoint visibility and remote collection. Deploy only on assets you own or are authorized to monitor, in accordance with your monitoring policy and applicable law.
Overview
Velociraptor is an open-source endpoint visibility and digital-forensics platform from Rapid7/Velocidex. A single Go binary acts as server, client (agent), and CLI depending on how it is invoked and configured. Its power comes from VQL (Velociraptor Query Language) — an SQL-like language whose plugins query the live state of an endpoint (processes, files, registry, event logs, WMI, network connections, prefetch, etc.). VQL queries are packaged into reusable Artifacts, and Artifacts are run at scale as Hunts that fan out across every connected client and stream results back to the server as structured rows.
This makes Velociraptor ideal for fleet-wide threat hunting: a hypothesis ("are any hosts running suspicious PowerShell?") becomes a VQL artifact, deployed as a hunt, with results aggregated centrally in minutes. It also supports offline collectors (standalone executables that collect and bundle artifacts on air-gapped or unmanaged hosts) and live forensic notebooks.
When to Use
Hunting for a TTP across hundreds or thousands of endpoints from a single console.
Collecting forensic artifacts on demand during incident response without re-imaging.
Continuously monitoring for an indicator using client-side event artifacts.
Generating standalone offline collectors for hosts you cannot enroll.
Prerequisites
A Linux or Windows host for the server (Linux recommended for production).
A primary hunt target — VQL artifacts surface anomalous interpreter execution (PowerShell, cmd, wscript) across the fleet for detection and triage.
Velociraptor is a defensive hunting platform; the mapping reflects the adversary behavior the hunts are designed to detect.
Workflow
1. Generate the server configuration
The interactive generator writes a server config (TLS, datastore paths, GUI users, frontend URL). Use config generate for a self-signed lab build or the interactive -i wizard for production.
# Non-interactive: dump a default server config
velociraptor config generate > server.config.yaml
# Interactive wizard (recommended for production deployments)
velociraptor config generate -i
2. Add a GUI admin user
Create at least one administrator to log into the console.
velociraptor --config server.config.yaml user add admin --role administrator
3. Start the server frontend and GUI
The frontend accepts client connections; the GUI is served per the config (default https://127.0.0.1:8889).
For a quick all-in-one local lab (server + frontend + a local client in one process):
velociraptor gui
4. Generate the client configuration and deploy agents
Derive the client config from the server config and run it as the client on each endpoint.
# Produce the client config (embeds server URL + CA)
velociraptor --config server.config.yaml config client > client.config.yaml
# On a Linux endpoint, run as a client (or install as a service)
velociraptor --config client.config.yaml client -v
On Windows, build an MSI/service installer from the GUI ("Server Artifacts" > deployment) or run:
velociraptor.exe --config client.config.yaml service install
5. Test VQL interactively before hunting
Validate a query locally with query (-q) before deploying it fleet-wide. VQL is SQL-like: SELECT ... FROM plugin(...) WHERE ....
# List running processes with their command lines
velociraptor query "SELECT Pid, Name, CommandLine FROM pslist()"# Hunt for suspicious PowerShell command lines
velociraptor query "
SELECT Pid, Name, CommandLine
FROM pslist()
WHERE Name =~ 'powershell'
AND CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|-w hidden|iex)'
"
6. List and run a built-in artifact
Artifacts wrap VQL into reusable, parameterized collections.
# Show available artifacts
velociraptor artifacts list
# Collect a built-in artifact and write results to a directory
velociraptor artifacts collect Windows.System.Pslist --output results.zip
7. Launch a fleet-wide hunt (GUI workflow)
In the GUI: Hunt Manager > New Hunt > select the artifact (e.g. Windows.Detection.Powershell or a custom one) and parameters > Launch. The hunt fans out to every matching client; results stream into the hunt's results table and can be exported as CSV/JSON. Equivalent server-side VQL:
-- Create a hunt programmatically via a server VQL notebookSELECT hunt(
description="Suspicious PowerShell fleet sweep",
artifacts="Windows.Detection.Powershell"
) FROMscope()
8. Build a custom artifact
Custom artifacts are YAML documents containing parameters and VQL sources. Save in the GUI's Artifact editor or import via artifacts:
name:Custom.Hunt.SuspiciousPowershelldescription:Findencoded/download-cradlePowerShellacrossthefleet.parameters:-name:regexdefault:"(?i)(-enc|frombase64string|downloadstring|-w hidden|iex)"sources:-query:|
SELECT Pid, Name, CommandLine, timestamp(epoch=now()) AS Collected
FROM pslist()
WHERE Name =~ "powershell" AND CommandLine =~ regex
9. Generate an offline collector
For unmanaged/air-gapped hosts, build a standalone collector from the GUI ("Server Artifacts" > Server.Utils.CreateCollector) or via VQL; it produces a single executable that collects chosen artifacts into a ZIP for later import.
