What it does
Velociraptor is an open-source endpoint monitoring, digital-forensics and response platform with client-server and offline-collection workflows.
Velociraptor provides an online agent workflow and a separate offline-collector route. Its overview describes preconfigured collectors that gather selected artifacts into an encrypted archive when installing a persistent agent is inappropriate. Choose the collection question and authorized endpoint set before building a collector or hunt. Volatile evidence, disk artifacts and ongoing monitoring have different timing requirements. Retain collection settings with the case so another analyst can understand what was gathered and what was outside the scope.
Strengths
- Online and offline endpoint-artifact collection
- Fleet-wide hunting and analysis workflows
Best for
- Incident responders collecting scoped endpoint evidence
Sources
- What is Velociraptor? – Velociraptor - Digging deeper! (Oct 26, 2026)
- Velociraptor LICENSE (Oct 26, 2026)