velociraptor

Launch Velociraptor forensic collections by listing available artifacts, selecting one, and triggering collection on target endpoints through LimaCharlie. Collections return results in Artifact or JSON event form for immediate analysis.

Yes. Velociraptor collections support incident response, threat hunting, and forensic triage. Build D&R automation rules from velociraptor_collection events to respond automatically to detected threats.

List built-in and external Velociraptor artifacts available in your environment, then view their YAML definitions to understand what data each artifact collects before launching.

Retrieve raw artifacts as ZIP files or query processed velociraptor events using LCQL queries on the velociraptor sensor to extract specific data from completed collections.

The ext-velociraptor extension must be installed. You need sensor event ingestion enabled, access to standard LimaCharlie API calls, and target endpoints running Velociraptor.

Yes. Trigger collections across endpoints, apply D&R rules to automate response based on velociraptor_collection events, and scale forensic triage and artifact handling across your infrastructure.