Velociraptor Incident Response

Overview

Velociraptor is an endpoint visibility and forensics platform for collecting host-based state information using Velociraptor Query Language (VQL). It operates in three core modes: Collect (targeted evidence gathering), Monitor (continuous event capture), and Hunt (proactive threat hunting).

When to use this skill:

• Active incident response requiring endpoint evidence collection
• Threat hunting across enterprise infrastructure
• Digital forensics investigations and timeline analysis
• Endpoint monitoring and anomaly detection
• Custom forensic artifact development for specific threats

Quick Start

Local Forensic Triage (Standalone Mode)