MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.Rapid7
Velociraptor
Velociraptor puts a small agent on endpoints and lets an examiner ask them questions in a query language. A hunt sends the same question to every machine and the answers come back as tables.
PlatformOpen sourceCurrentWindows · Linux · macOS
Profile
- Manufacturer
- Rapid7
- Category
- Network and enterprise
- Product type
- Platform
- Platforms
- Windows, Linux, macOS
- Licensing
- Open source
- Product status
- Current
- Educational level
- Advanced
- Last verified
- 2 November 2026
Open source under the GNU Affero General Public License version 3, checked in the repository's LICENSE file. The documentation site carries a Rapid7 footer. Release 0.77.3 of 5 October 2026 was current when checked, with a notice to update from 0.77.2.
What Velociraptor is
Velociraptor is written in Go and published under the GNU Affero General Public License version 3, with Rapid7 as its steward. Server and client are the same binary, built for Windows, Linux and macOS. The client runs as a service on each endpoint and keeps a connection open to the server, which has a web interface and an API. The unit of work is an artefact, a YAML file that wraps a query in the Velociraptor Query Language with named parameters. Built-in artefacts cover Windows event logs, NTFS metadata, evidence of program execution, Linux logs and macOS persistence locations among many others, and a laboratory can write its own. An examiner collects an artefact from one host or hunts it across the fleet, and the results are stored on the server for review in notebooks.
Three features matter for forensic work beyond the live fleet. The offline collector is a preconfigured binary that gathers chosen artefacts into an encrypted zip with no server at all, for an isolated machine or for a field officer to run, and the zip can be imported into a server later. Dead disk analysis runs artefacts over a mounted image instead of a live system. Event artefacts use sources such as Windows ETW and Linux eBPF for continuous monitoring. At the time of checking the current release was 0.77.3 of 5 October 2026 and the documentation carried a notice to update from 0.77.2 because of several published vulnerabilities, a reminder that the server holds evidence and must be patched like any other exposed system.
Primary applications
Where it is used
- Fleet-wide triage after a compromise is suspected
- Hunting one indicator, such as a file hash or a scheduled task name, across every endpoint
- Collecting the same artefact set a KAPE target would gather, from many hosts at once
- Offline collection from a machine on an isolated network
- Running artefacts over a mounted disk image
- Continuous event collection on monitored hosts during an incident
Who uses it
- Incident response teams
- Enterprise security teams
- Forensic consultants collecting from client networks
- Researchers writing artefacts
Capabilities and limits
Major capabilities
- Single binary for server and client on Windows, Linux and macOS
- Velociraptor Query Language for collection, monitoring and server automation
- Library of artefacts, each editable and parameterised
- Hunts that run one collection across the whole fleet
- Offline collector producing an encrypted zip without a server
- Dead disk analysis over mounted images
- Event monitoring through Windows ETW and Linux eBPF sources
- Notebooks for collaborative review and a server API for automation
- Bulk file acquisition with hashing and metadata
Technical limitations
- Installing an agent changes the host. The installation time and account must be recorded
- Collection is logical. It does not produce a disk image or read unallocated space
- The query language has a learning curve and most real work needs it
- The server is an attractive target and needs hardening and prompt updates, as the release notices show
- Results depend on artefact definitions keeping pace with operating system versions
- A hunt that reads file contents across thousands of hosts can overload the network and the server
Learning with DFRTI
Independent professional education covering the principles and workflows of Velociraptor. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- Windows, Linux and macOS artefact knowledge
- Comfort with SQL-style queries
- Server administration and TLS basics
Disciplines
Related tools
- KAPE (Kroll Artifact Parser and Extractor)KAPE copies the files an examiner needs from a Windows system or image in minutes and then runs other programs over them. It is the quickest route from a live machine to parsed artefacts.Kroll
- Eric Zimmerman's ToolsA set of free, signed Windows forensic utilities, one per artefact, that turn registry hives, the master file table, event logs, prefetch, shellbags and jump lists into CSV an examiner can read in Timeline Explorer.Eric Zimmerman
- PlasoPlaso pulls every timestamp it can recognise out of a disk image or folder and writes them to one storage file. Sorted, that file is the super timeline investigators use to see what happened in what order.log2timeline project
- TimesketchTimesketch is a web application where several analysts work on the same timeline. Events from Plaso or CSV go into a sketch and the team searches, tags, comments and builds its account of events from them.Google (open source project)
- Volatility 3Volatility 3 reads a memory image and rebuilds what the operating system knew at the moment of capture: processes, connections, loaded modules, handles and code that never touched the disk. It replaced Volatility 2, which is now archived.The Volatility Foundation
- Magnet Axiom CyberAxiom Cyber is the Axiom variant for organisations rather than police. It adds remote collection from Windows, Mac and Linux endpoints, including machines that are off the corporate network. It can be hosted in AWS or Azure.Magnet Forensics
Courses that cover this tool
MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.
MalwareIncident Response & Malware AnalysisMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.
NetworkNetwork & Cloud ForensicsVirtual Machine / Hypervisor ForensicsExamine VMDK, VHDX and QCOW2 disks, snapshots, ESXi logs and VM memory files.Official source
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.