domains / families / security / fleet-hunting-with-velociraptor

fleet-hunting-with-velociraptor

separate

Deploy a Velociraptor server and agents, then author VQL (Velociraptor Query Language) artifacts and run them as fleet-wide hunts, on-demand forensic collections, or standalone offline collectors. Use when hunting a TTP across hundreds or thousands of endpoints, collecting forensic artifacts during incident response without re-imaging, or generating collectors for unmanaged/air-gapped hosts.

When to use

• Hunting for a TTP across hundreds or thousands of endpoints from a single console.
• Collecting forensic artifacts on demand during incident response without re-imaging.
• Continuously monitoring for an indicator using client-side event artifacts.
• Generating standalone offline collectors for hosts you cannot enroll.

Skill page

Source