0.6 Following Along

Module 1 stands up a server properly, with the decisions that matter explained. This section is the short version, so you can have something working while you read it.

The fastest route to something running

The tool ships a development mode that runs a server and a client on the machine you are sitting at, generates its own certificates, and opens a console in your browser. No configuration files, no planning, no second machine.

# One command. Server, client and console on the local machine.
velociraptor gui

That gives you a working deployment in under a minute, with one client that happens to be the machine you are on. It is enough for the whole of Module 3, most of Module 2, and the parts of Module 4 that are about choosing and scoping rather than about reaching somewhere.

It has one property worth knowing before it confuses you. Because the client is the machine you are sitting at, a query that lists processes lists your own, and a collection that walks a file system walks yours. That is convenient for learning the language and it removes the distinction Section 3.1 makes between a query that runs on the server and one that reaches an endpoint, which is the distinction that produces the most common beginner error.

It is not what you would run in production, and Module 1 explains why in terms of the decisions it makes for you. For learning, it removes every obstacle between reading about a query and running one.

What to build for the rest

When you want the lab the course assumes, three additions in this order.

A separate server. A small Linux virtual machine is the common production shape and the one worth practicing on. Module 1 covers the build, the certificate decision, and the choices that are hard to change later.

A second client on a different machine. This is the step that makes the console real rather than an abstraction: a host record that describes somewhere else, and a collection that genuinely travels. It is also where enrollment stops being a concept, since the client has to find the server and be accepted by it.

A third and fourth client. Ideally a mix: a Windows machine, something Linux, and one you can afford to break. This is what Modules 5 and 6 need, and the difference between reading about a hunt and watching one settle at four of five and then move when you power on the fifth.

The mixed platforms matter more than the count. A uniform lab hides preconditions, hides the artifacts that exist on one side and not the other, and hides the reason most production deployments run a Linux server while most of what they investigate is Windows.

None of that needs to exist before Module 1. It needs to exist before Module 5, and building it incrementally as the course requires it works better than building everything first and forgetting why each piece is there.

There is one exception worth planning for. The machine you intend to break in Module 7 should be one you can restore quickly, which usually means a snapshot taken before you start rather than a rebuild afterwards. Taking that snapshot when you build the machine costs a minute; taking it after you have configured everything and then broken it is not an option.

The exercises

Every teaching section ends with something to run on your own deployment, with what to expect and what it means if you see something else.

They are short, most take a few minutes, and they are the difference between the course being familiar and being usable. Several of them are deliberately about causing a failure rather than achieving a result: cancel a collection halfway and see what the state says, run a query with a deliberately misspelled column and watch it succeed and return nothing, set a machine's clock two minutes fast and find it in an offset comparison.

They are also written so that an unexpected result is informative rather than a dead end. Each says what to expect and then what a different outcome usually means, because in a lab the interesting case is frequently the one that does not behave as described, and knowing why is worth more than the exercise succeeding.

Those are the ones worth doing most, because the failure modes in this tool are silent and the only way to recognize one quickly is to have seen it once when nothing was at stake. A person who has watched a misspelled column return zero rows without complaint recognizes it in seconds the next time; a person who has only read about it spends twenty minutes rewriting a query that was never the problem.

Habits worth having from the first collection

Four things cost nothing to start doing now and are painful to adopt later.

Read the collection state before the rows. It takes two seconds and it distinguishes a complete result from a prefix. Doing it from the first collection means you never build the habit of trusting a row count. The habit is hard to add later because by then you have read hundreds of results without it and nothing went visibly wrong, which is exactly the evidence that makes people skip it.

Write down why you ran something. One line, at the time. The platform records what you did and when; it cannot record why, and that is the line a reviewer asks for and the one you cannot reconstruct. A notebook attached to the collection is the natural place, and Module 2 covers it properly.

Form an expectation before you launch. Roughly how many rows should this return? Comparing the answer against the guess is the single cheapest check in this course, and it catches both a parameter that did not apply and one that excluded too much. It gets more accurate quickly, because the numbers for your own estate are learnable and the published figures are not.

Name the clock. Whenever you write a time, say whether it is endpoint time, collection time, or the time you were looking. Two words, and it is the difference between a finding somebody can use in six weeks and one they have to come back and ask about.

That one sounds fussy in a lab, where every clock agrees and every timestamp is from this afternoon. It stops sounding fussy the first time an investigation spans four hosts and two weeks, and by then the habit either exists or it does not, because the times you failed to label were written before you knew you would need them.

None of those are advanced practice. They are the four things that separate results you can rely on from results that happen to be right.

A note on running this against a real estate

If you have a production deployment available, the temptation is to work the course there rather than building a lab. Two cautions.

The exercises include deliberately breaking things: canceling collections, setting clocks wrong, isolating a host and reversing it. None of that belongs on machines somebody is working on.

And the fleet sections involve running collections across a population. A hunt rehearsed in a lab costs nothing; the same hunt run untested against a real estate is exactly the scenario Section 5.3 exists to prevent, and reading about it a week before doing it is not the same as having done it somewhere safe.

The middle position works well for most people: read and rehearse in a lab, then apply the safe parts to the real estate deliberately. That way the first thing you run in production is something you have already watched behave, which is the whole argument of Section 5.3 applied to your own learning rather than to a hunt.

Where you do have a real deployment, the most valuable thing to bring to it from this course is the coverage comparison from Module 1 and the operational checks from Module 7. Both are safe, both take under an hour, and both routinely surface something the team did not know.

The third safe thing to bring is a baseline. Section 6.2 argues that the reference nobody takes is the one everybody wishes they had, and taking one costs a scheduled hunt and a dated export. Doing it early in the course means that by the time you reach Module 6 you have a real comparison to run rather than a described one, which is the difference between understanding a differential and having seen your own estate's noise.

Then begin

Work Module 0's summary next, then start Module 1.

If you have not built anything yet, run the single command above before you do. The first section of Module 1 is about what this tool reaches and what it does not, and it reads differently when there is a console open in another window with a real host in it. That is true of the whole course, and it is the only recommendation in this section worth insisting on.