Launch Velociraptor forensic collections on endpoints via LimaCharlie API.
npx skills add https://github.com/refractionPOINT/lc-ai --skill velociraptor
Please help me install this Agent Skill. Skill: velociraptor Source: https://github.com/refractionPOINT/lc-ai/tree/main/marketplace/plugins/lc-essentials/skills/velociraptor Command: npx skills add https://github.com/refractionPOINT/lc-ai --skill velociraptor
Velociraptor integration for LimaCharlie enables DFIR teams to list available VQL artifacts, view artifact definitions, and launch forensic collections on endpoints from a single workflow. It also provides access to raw collection data and processed events for rapid triage and investigation.
Example: List artifacts, then launch a collection on sensor SID 'SID-123' for artifact 'Windows.System.Drivers'.
High-intent search queries and answers about installing and using this skill.
Launch Velociraptor forensic collections by listing available artifacts, selecting one, and triggering collection on target endpoints through LimaCharlie. Collections return results in Artifact or JSON event form for immediate analysis.
Yes. Velociraptor collections support incident response, threat hunting, and forensic triage. Build D&R automation rules from velociraptor_collection events to respond automatically to detected threats.
List built-in and external Velociraptor artifacts available in your environment, then view their YAML definitions to understand what data each artifact collects before launching.
Retrieve raw artifacts as ZIP files or query processed velociraptor events using LCQL queries on the velociraptor sensor to extract specific data from completed collections.
The ext-velociraptor extension must be installed. You need sensor event ingestion enabled, access to standard LimaCharlie API calls, and target endpoints running Velociraptor.
Yes. Trigger collections across endpoints, apply D&R rules to automate response based on velociraptor_collection events, and scale forensic triage and artifact handling across your infrastructure.
tekgruntDeploy and manage LimaCharlie endpoint sensors across Windows, macOS, Linux, Chrome, and Edge.
chenchunrunIdentify Linux security incidents by querying host telemetry with Velociraptor VQL.
zenobi-usCoordinate incident response for security breaches and operational incidents.
AgentSecOpsAnalyze endpoint telemetry and artifacts for incident response with Velociraptor VQL workflows.
