Velociraptor for Endpoint Investigation

What Velociraptor for Endpoint Investigation teaches: reaching a machine you cannot walk to, asking it a specific question, and turning the answer into evidence. The deployment you will run, the query language you will write, hunts across a fleet, and the honest limits of what an agent can see. Start here.

What Velociraptor reaches that your other tools do not, the architecture that makes a collection arrive in seconds, choosing a deployment model before you generate a config, standing the server up on a current release, the roles and organizations that decide who can run a query against whose endpoints, and enrolling clients so the fleet actually appears.

Finding a host among hundreds and reading what its record actually claims, why the file browser is a cache rather than a live view and what that means for every conclusion drawn from it, retrieving and inspecting a file without touching the machine, running and reading collections, notebooks as the place investigation work accumulates, and the labels that turn a client list into groups you can act on.

The query language underneath every artifact you have collected so far: how a query is shaped, the difference between the things that produce rows and the things that transform them, stored queries and when they materialize, the evaluation order that decides whether a filter protects you, and how to debug a query that fails on a real endpoint.

Turning the console and the language into a collection you can defend: the order volatile evidence has to be taken in, choosing artifacts for a question rather than from a checklist, scoping with parameters, building an offline collector for machines with no agent, handling a collection that fails partway, and the record that makes the result worth something in a month.

The collection you already know how to build, addressed to every machine at once: why a hunt expires rather than completes, scoping by label and condition, launching from the paused state with an expiry and limits that mean something, watching one run against a fleet that is never all online, and recruiting hosts into a running hunt by labeling them.

Turning separate results into one account: correlating findings across machines, baselining an estate so abnormal becomes visible, building a timeline that spans hosts, handling clocks that disagree, pivoting from a finding to the next question, and writing the sequence in a form somebody else can check.

Writing your own artifact when nothing published answers the question, reading and trusting community definitions, monitoring instead of asking, containing a host, keeping the deployment healthy, and taking one case from alert to written account using everything in the six modules behind it.

Queries and commands by the question you arrived with, each with the fields that carry the decision and what the result does not establish.

Six runbooks for the procedures this work repeats: triaging an alerted host, hunting an indicator across the estate, collecting from a machine with no agent, containing one, promoting a query to an artifact, and handing evidence to somebody else.

Endpoint investigations reasoned end to end, including the cases where the tool was the wrong answer and the ones that finish with a weaker finding than the evidence first suggested.

Every practice surface available for this course, what each one gives you, where the gaps are, and the exercises worth building yourself.

Every command, query, artifact invocation, state and check from the Velociraptor for Endpoint Investigation course in one place, organized by task and linked back to the section that explains when not to use it.

Vendor documentation, the artifact reference and community exchange, endpoint forensics sources, incident response standards and frameworks, and the operational research used throughout the Velociraptor for Endpoint Investigation course.

Velociraptor for Endpoint Investigation end-of-course exam: fleet scoping inside the hour during a live intrusion, testing whether you can match a hunt design to the question, cost it before launching, and know what complete means when a fifth of the fleet is offline.