ir-velociraptor

Endpoint forensics and threat hunting are performed by collecting evidence, running targeted VQL-based hunts, and analyzing filesystem timelines across enterprise endpoints. This supports offline collectors and custom artifact creation for incident response.

VQL workflows support artifact development and threat hunting by enabling custom artifact creation and targeted hunts across enterprise endpoints. This allows investigators to collect specific digital-forensics artifacts and apply MITRE ATT&CK mappings during incident response.

Endpoint telemetry and artifacts can be mapped to MITRE ATT&CK techniques to identify suspicious activity. This mapping correlates process lists, network connections, and registry activity with known adversary tactics during forensic investigations.

Offline collectors are supported to gather digital-forensics artifacts and endpoint telemetry across enterprise hosts. This enables incident-response workflows and timeline reconstruction even when continuous live-response connectivity is unavailable.

Timeline reconstruction is performed by collecting filesystem timelines, process lists, and registry activity across enterprise endpoints. This evidence collection accelerates containment and supports forensic investigations and threat hunting campaigns.