Velociraptor is an advanced digital forensic and incident response tool that enhances your visibility into your endpoints.
Velociraptor’s power and flexibility comes from the Velociraptor Query Language (VQL). VQL is a framework for creating highly customized artifacts, which allow you to collect, query, and monitor almost any aspect of an endpoint, groups of endpoints, or an entire network. It can also be used to create continuous monitoring rules on the endpoint, as well as automate tasks on the server.
This is free and open source software.
Key Features
- Reconstruct attacker activities through digital forensic analysis.
- Hunt for evidence of sophisticated adversaries.
- Investigate malware outbreaks and other suspicious network activities.
- Monitory continuously for suspicious user activities, such as files copied to USB devices.
- Discover whether disclosure of confidential information occurred outside the network.
- Gather endpoint data over time for use in threat hunting and future investigations.
Website: docs.velociraptor.app
Support: GitHub Code Repository
Developer: Velocidex
License: GNU Affero General Public License v3.0
Velociraptor is written in Go. Learn Go with our recommended free books and free tutorials.
Related Software
| Incident Response | |
|---|---|
| GRR | Remote live forensics for incident response |
| GoAlert | On-call scheduling, automated escalations and notifications |
| OneUptime | Unified observability, on-call scheduling, and incident response |
| Keep | AI-powered alert correlation and workflow automation for operations teams |
| Alertmanager | Handles alerts sent by client applications such as the Prometheus server |
| Shuffle | Connects security tools to automate workflows and accelerate response |
| Velociraptor | Endpoint visibility and collection tool |
| DFIR-IRIS | Collaborative case management for forensics and incident response. |
| FIR | Cybersecurity incident management platform |
| Iris | Automated incident paging system at LinkedIn |
| Dispatch | Manage security incidents by deeply integrating with existing tools |
Read our verdict in the software roundup.
| Digital Forensics Tools | |
|---|---|
| GRR Rapid Response | Remote live forensics for incident response |
| Radare2 | Portable reversing framework |
| The Sleuth Kit | Collection of tools for forensic analysis |
| MemProcFS | View physical memory as files in a virtual file system |
| Autopsy Forensic Browser | Graphical interface to SleuthKit |
| iaito | Official graphical interface for radare2 |
| Chainsaw | Fast forensic triage and threat hunting tool for Windows artefacts |
| Velociraptor | Endpoint visibility and collection tool |
| Timesketch | Collaborative forensic timeline analysis |
| Plaso | Python-based digital forensics framework |
| Volatility | Advanced memory forensics framework |
| UAC | Collect forensic artefacts from Linux and other Unix-like systems |
| IPED | Process, index and analyse large collections of digital evidence |
| guymager | Forensic imaging tool based on Qt |
| Dissect | Access and query evidence across disk images and file systems |
| dcfldd | Enhanced version of dd for forensics and security |
| rdd | Forensic copy program |
| Jomon | Network forensics and passive sniffer |
| Mozilla InvestiGator | Real-time digital forensics and investigation platform |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.