Velociraptor

What it is

Velociraptor is a free open-source endpoint visibility, hunting and DFIR platform from Velocidex (docs.velociraptor.app, GitHub Velocidex/velociraptor). Security teams deploy agents to collect host artefacts, run VQL hunts and investigate incidents across Windows, Linux and macOS estates they are authorised to monitor.

What it helps with

- Collecting endpoint artefacts at scale for incident response and threat hunting.
- Writing and scheduling VQL queries to hunt for suspicious behaviour across a fleet.
- Supporting DFIR triage workflows that complement SIEM and EDR stacks.
- Covering major desktop and server operating systems from one control plane.
- Enabling lab and training deployments for detection-engineering practice.
- Running under AGPL without a commercial licence for the core open-source project.

Who it's for

DFIR analysts, detection engineers and blue teams who need free, flexible endpoint collection and hunting as a peer to commercial EDR and forensic agents.

Worth knowing

Velociraptor is free and open source (AGPL). Official documentation and dark-mode brand mark: docs.velociraptor.app. Repository: github.com/Velocidex/velociraptor. Deploy only on systems you own or are explicitly authorised to instrument.