Velociraptor — Endpoint Visibility and Digital Forensics Tool

Introduction

Velociraptor is an open-source endpoint visibility and digital forensics tool developed by Rapid7. It deploys lightweight agents to endpoints that respond to queries written in VQL (Velociraptor Query Language), enabling security teams to hunt for threats, collect forensic artifacts, and monitor endpoint activity at scale.

What Velociraptor Does

• Deploys lightweight agents to Windows, macOS, and Linux endpoints for real-time monitoring
• Collects forensic artifacts (process lists, event logs, file hashes, registry keys) via VQL queries
• Supports threat hunting across thousands of endpoints simultaneously
• Provides a web-based GUI for investigation workflows, artifact management, and dashboards
• Enables real-time event monitoring with client-side VQL event queries

Architecture Overview

Velociraptor uses a client-server model. The server component stores collected data, manages clients, and serves the web GUI. Agents (clients) run on endpoints and execute VQL queries sent by the server. Communication uses mutually authenticated TLS over HTTP. VQL is a SQL-like language that accesses OS-level data sources (files, processes, registry, event logs) as virtual tables. Results stream back to the server for analysis and storage.

Self-Hosting & Configuration

• Download a single static binary for the server and generate configs with the built-in wizard
• Deploy agents to endpoints using the generated client config and the same binary
• Store collected data on the server filesystem or S3-compatible storage
• Configure artifact definitions in YAML to customize collection logic
• Secure the deployment with TLS certificates and role-based access control

Key Features

• VQL query language for flexible artifact collection and real-time event queries
• Single binary deployment for both server and client with no external dependencies
• Built-in artifact exchange with hundreds of community-contributed collection templates
• Scales to tens of thousands of endpoints with minimal server resources
• Offline collector mode for triage without deploying a full server

Comparison with Similar Tools

• osquery — SQL-based endpoint query tool but lacks a built-in server, GUI, and artifact framework
• GRR — Google's remote forensics tool; heavier infrastructure and slower query execution
• Wazuh — SIEM and endpoint security platform; broader scope but less focused on forensic collection
• TheHive — incident response case management; Velociraptor focuses on endpoint data collection
• CrowdStrike Falcon — commercial EDR; Velociraptor provides open-source endpoint visibility

FAQ

Q: What operating systems does Velociraptor support? A: Windows, macOS, and Linux are fully supported for both server and client deployment.

Q: How does VQL differ from SQL? A: VQL uses SQL-like syntax but queries virtual tables backed by OS data sources like files, processes, and event logs rather than database tables.

Q: Can Velociraptor run without a persistent server? A: Yes. The offline collector mode packages VQL queries into a standalone executable for field triage.

Q: What are the server hardware requirements? A: A single server with 4 cores and 8GB RAM can manage several thousand endpoints.

Sources

• https://github.com/Velocidex/velociraptor
• https://docs.velociraptor.app