skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-velociraptor-for-ir-collection

Deploy Velociraptor to collect forensic artifacts from endpoints using VQL queries and hunts.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#threat hunting#vql#DFIR#Velociraptor#artifact collection#endpoint forensics
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-velociraptor-for-ir-collection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-velociraptor-for-ir-collection
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/incident-response/implementing-velociraptor-for-ir-collection
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-velociraptor-for-ir-collection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Incident responders need to gather forensic evidence from hundreds or thousands of endpoints quickly, but manual collection does not scale and ad-hoc scripts produce inconsistent results. This Skill guides the deployment and configuration of Velociraptor so teams can run structured, large-scale artifact collection across Windows, Linux, and macOS fleets.

Core Features & Use Cases

  • Server and Client Deployment: Install the Velociraptor server, repack client installers, and roll out agents via Group Policy, SCCM, Intune, or Docker.
  • VQL Artifact Collection: Run pre-built and custom VQL queries for event logs, prefetch, Shimcache, Amcache, MFT, browser history, persistence mechanisms, and Linux artifacts like auth logs and bash history.
  • Hunt Operations at Scale: Create hunts with label-based targeting and resource limits, monitor flow completion states, and reconcile participation against asset inventory.
  • Use Case: During a suspected breach, launch a triage hunt using Windows.KapeFiles.Targets across all endpoints to collect event logs, registry hives, and browser artifacts, then forward results to Elastic for analysis.

Quick Start

Ask the AI to help you deploy a Velociraptor server and create a triage hunt that collects event logs and prefetch data from all Windows endpoints.

Frequently Asked Questions about implementing-velociraptor-for-ir-collection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deploy Velociraptor for incident response collection?▼

Download the Velociraptor binary, generate a server configuration with config generate, and start the frontend service. Repack the client installer with your client config and deploy it via Group Policy, SCCM, or Intune to endpoints.

How do I collect forensic artifacts from Windows endpoints with Velociraptor?▼

Use VQL queries against built-in artifacts like Windows.Forensics.Prefetch, Windows.Registry.AppCompatCache, and Windows.EventLogs.EvtxHunter. For full triage, run Windows.KapeFiles.Targets with target groups such as _EventLogs, _Prefetch, and _RegistryHives enabled.

Does Velociraptor support Linux and macOS endpoints?▼

Yes, Velociraptor clients run on Windows 7+, Linux distributions like Debian, Ubuntu, CentOS, and RHEL, and macOS 10.13+. Linux-specific artifacts include auth logs, bash history, crontab entries, and SSH authorized keys.

Why does my Velociraptor hunt return incomplete results?▼

Hunts return partial data when per-client CPU, IOPS, timeout, or max_rows limits are hit on busy hosts. Verify flows finished with flow_state FINISHED, raise resource limits for affected endpoints, and reconcile participation against your asset inventory.

Can Velociraptor forward collected data to Splunk or Elastic?▼

Yes, Velociraptor supports Elastic output configured in the server config with addresses, credentials, and an index name. Data can also reach Splunk through Elastic, syslog forwarding, or custom scripts using the Velociraptor API.

Related Skills

Explore More Software Engineering Skills→
zjunlpzjunlp
1.1k

scienceworld-tool-validator

Validate acquired tool readiness in ScienceWorld using the focus on [TOOL] action.

Official
Basic
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
coreymaypraycoreymaypray
1

forensics-investigator

Automate evidence collection, timeline reconstruction, and artifact analysis from memory, disk, log, and network data.

Community
Advanced
refractionPOINTrefractionPOINT
29

velociraptor

Launch Velociraptor forensic collections on endpoints via LimaCharlie API.

Official
Advanced