What is Velociraptor?

Velociraptor is an open-source endpoint visibility and response (EVP) platform. It's designed for advanced incident response, digital forensics, and threat hunting. Velociraptor allows analysts to collect artifacts (data) from endpoints quickly and efficiently using a powerful query language (VQL). Common use cases include identifying compromised systems, investigating security incidents, and gathering forensic evidence across a large number of machines.