Sign In

Velociraptor for Endpoint Investigation

Reach it. Ask it. Prove it.

The machine is three floors away, or three time zones. An agent on the endpoint answers your question from the live system, and nothing had to be shipped in advance. This course teaches you to deploy that, write the queries that ask well, collect in an order that survives a reboot, hunt an entire estate, and turn what comes back into an account somebody else can check. Every section shows you a capability and then the specific way it produces a confident wrong answer.

Included with Premium, from $19.99/month, or $179/year and save 25%. Preview the first module free, no account needed.
Your subscription also includes the Practice Hub: graded scenarios, forensic cases, query drills and the response playbooks.
Preview Course See Pricing
View Pricing Take End of Course Exam → 10 CPE Credits

What you'll be able to do

✓Stand up a deployment and state precisely what it reaches, including the machines it never will and why that population matters most
✓Write, compose and debug VQL, and recognize the one behavior in the language capable of doing real damage across an estate
✓Collect from one endpoint in an order that reflects how long each class of evidence survives, scoped to a question rather than a checklist
✓Reach a machine with no agent at all using an offline collector, and know why its encryption choice decides who can read the result
✓Hunt an entire fleet: scope it, rehearse it, read progress honestly, and grow the scope as the investigation grows
✓Turn separate results into one account, with evidence horizons, clock skew, cross-host links and findings whose strength is visible on the page
✓Extend the platform with your own artifacts, monitor continuously rather than asking, contain a host, and keep the deployment working
FOR202 | Premium tier | 7 modules across 4 phases | 10–12 hours at your own pace | 10 CPE credits | Updated August 2026
Course Agenda View Course ModulesHide Course Modules

Course overview

Velociraptor is free, widely deployed, and taught almost entirely as a tour of its interface. That produces analysts who can run a collection and cannot say what its result covers. This course teaches the tool and the reasoning together, because on this platform they are the same skill: a collection returns rows and does not tell you it was canceled at a limit, a hunt reaches 731 machines and does not tell you the estate has 812, and a connection list is a snapshot in which a beacon talking every five minutes is invisible. Learn how to:

✓ Stand up a deployment and state precisely what it reaches, including the machines it never will
✓ Write, compose and debug VQL, including the one behavior in the language capable of doing real damage
✓ Collect from one endpoint in an order that reflects how long each class of evidence survives
✓ Ask the same question of eight hundred machines and read the answer without overstating it
✓ Turn separate results into one account, with timelines, clock skew and findings whose strength is visible

By the end you will run this tool the way somebody responsible for an estate does, with an honest account of what an agent can and cannot see.

Who this course is for

You are an incident responder, SOC analyst, threat hunter, or the security engineer who owns the deployment. No prior Velociraptor experience is assumed and no query language experience is assumed. This course is for you if you want to:

✓ Reach a machine you cannot walk to, in seconds rather than after a day of travel or shipping
✓ Ask a question of an entire estate and defend what the answer covers when somebody challenges it
✓ Stop guessing whether an empty result means nothing happened or the query never asked
✓ Run the platform properly, including the checks that fail silently between incidents

If endpoints appear in your investigations and reaching them is the slow part, this course is for you.

What you'll learn

Seven modules, working from what the tool can reach to one case taken end to end.

✓ Deploy a server, enroll clients, and establish your real coverage against a source of truth outside the platform
✓ Drive the console without mistaking a cached view for a live one, and read a collection's state before its rows
✓ Write VQL from sources through composition and debugging, and recognize the acting expression that retrieves everything it matched
✓ Collect from one endpoint in the order of volatility, scoped to a question, with a record that still means something in a month
✓ Reach a machine with no agent using an offline collector, and choose the encryption that decides who can read the result
✓ Scope, rehearse, launch and read a fleet-wide hunt, including why a hunt expires rather than completes
✓ Apply prevalence analysis and recognize the case where it ranks the malicious entry as ordinary
✓ Correlate across hosts with evidence horizons, clock skew and cross-host links, and write findings whose registers are visible
✓ Write your own artifacts, judge somebody else's before running it, monitor continuously, and contain a host without losing the evidence

Key course takeaways

✓ Run a full investigation end to end, from an alert naming one machine to a written account somebody else can check
✓ Know the four ways this platform produces a confident wrong answer, and the check that catches each one
✓ Hunt an estate and report the finding with its population attached, which is the difference between a claim that survives review and one that does not
✓ Carry six runbooks and six worked cases for the procedures this work repeats, including the ones that end in a weaker finding than the evidence first suggested
✓ Operate the deployment through the checks that fail silently, because a year without problems is equally consistent with a year without looking

Things you need to know

What are the prerequisites for this course?

None. No prior Velociraptor experience and no query language experience are assumed, and every concept is explained where it is first used. If you have run investigations on endpoints by any means you will recognize the problems this course solves.

Do I need a lab to follow along?

You should have one, and it costs nothing. Velociraptor is a single free binary with no license and no expiring trial, so a server and a client on the machine you are reading this on takes a minute. Two or three clients make the fleet modules considerably better, and a virtual machine you can afford to isolate and restore completes the final module.

What licensing does this assume?

None. Every capability in this course, including the parts most products reserve for an enterprise edition, is available to somebody working on their own machines.

Is this course current?

Every artifact name, parameter and invocation is drawn from the published artifact reference rather than written for teaching, and each was checked at the time of writing. Command syntax changes across major versions and published artifact definitions are revised, so the references module tells you which two sources resolve a disagreement and in what order.

Usage rights and disclaimer

Course materials are licensed for your individual use. You may apply everything you build here in your own environment and in client work. You may not redistribute the course content itself or resell it as training.

Queries, artifacts and scenarios are illustrative and use the fictional Northgate Engineering environment. Verify against your own deployment and against the current artifact reference before relying on any specific behavior, and treat what your server actually returns as authoritative over any document, including this one.

Ridgeline Cyber is not affiliated with Velocidex or Rapid7. Product names are used descriptively.

Version and changelog

Version 1.0 · August 2026

Initial release as a full course, replacing the earlier short course. Seven modules covering deployment and access control, the console, VQL, single-endpoint collection, fleet hunting, correlation, and extending and operating the platform, with a course orientation and a reference layer of cheatsheets, runbooks, worked cases, a playground, an operational reference and further reading.

Research-gated against the Velociraptor documentation, the artifact reference and the project's release notes.

COURSE ASSESSMENT

End of Course Exam

Complete the course, then prove your skills under time pressure. Pass mark: 70. Earn your certificate with CPE credits.

40minutes
3phases
100points
1scenario
Take End of Course Exam

Requires 80% course completion. One random scenario per attempt. Certificate issued on pass.