Velociraptor

Velociraptor by Velocidex is an open-source endpoint visibility and digital forensics platform for Windows, Linux, and macOS.

Velociraptor can be used for a wide range of use cases, including incident response, threat hunting, system administration, and security monitoring.

Velociraptor operates by deploying agents on target systems, which collect and stream forensic data to a centralized server. Users can then query and analyze the collected data using the Velociraptor user interface.

Yes, Velociraptor has the ability to acquire live memory from target systems. This allows for in-depth memory analysis and investigation.

Yes, Velociraptor supports remote acquisition of disk images by creating encrypted and compressed disk images over the network. This enables forensic examination of disks without physical access to the system.

Yes, Velociraptor provides a wide range of built-in detectors to identify IOCs within collected data. Users can also create custom detectors using the powerful query language provided by Velociraptor.

Absolutely! Velociraptor is designed to scale horizontally and handle high volumes of endpoint data. It uses a distributed architecture that allows for efficient data collection and analysis in large environments.

Velociraptor is actively developed and maintained by experienced forensics practitioners. It has been widely adopted by the community and is considered a mature and reliable platform for endpoint visibility and digital forensics.

Yes, Velociraptor provides RESTful APIs that can be used to integrate with other security tools and workflows. It also supports exporting data in various formats, allowing seamless integration with third-party applications.

Yes, Velociraptor is released under an open-source license (Apache License 2.0) and is freely available for use, modification, and distribution.