Velociraptor

Velociraptor is an open-source endpoint visibility and collection tool using VQL queries for advanced incident response and digital forensics.

Security Operations Endpoint Visibility VQL Incident Response

Overview

Velociraptor is a powerful open-source endpoint visibility and collection tool, purpose-built for incident response and digital forensics. It leverages the Velociraptor Query Language (VQL) to enable precise, high-performance data collection across thousands of endpoints. Velociraptor's flexible deployment can be used as a local triage tool or a full-scale distributed endpoint monitoring platform. It includes a comprehensive GUI, a rich library of built-in VQL artifacts, and access to a community-driven Artifact Exchange, making it indispensable for SOCs, DFIR teams, and threat hunters.

Primary Use Cases

✔ Conducting rapid incident response and endpoint investigations.

✔ Performing digital forensics and data collection across endpoints.

✔ Threat hunting with VQL queries and custom artifact creation.

Frequently Asked Questions

Velociraptor is an open-source endpoint visibility and collection tool used for advanced incident response, digital forensics, and threat hunting. It uses VQL to perform high-performance data collection across thousands of endpoints.

Yes, Velociraptor is completely free and open-source. It is licensed under the AGPLv3 and can be used by individuals and organizations without cost.

Velociraptor supports Windows, Linux, and macOS, with binaries available for x64 and 32-bit Windows. It can also be built for other platforms from source.

Velociraptor is ideal for incident responders, DFIR professionals, SOC analysts, threat hunters, and security teams needing powerful endpoint visibility and data collection capabilities.

Velociraptor is unique for its powerful VQL language, flexible deployment (local to enterprise), rich built-in artifact library, and community-driven Artifact Exchange, enabling precise, high-speed data collection and analysis at scale.