Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language (VQL) queries.

To learn more about Velociraptor, read the documentation on:

https://docs.velociraptor.app/

If you want to see what Velociraptor is all about simply:

1. Download the binary from the release page for your favorite platform (Windows/Linux/MacOS).

2. Start the GUI

  $ velociraptor gui

This will bring up the GUI, Frontend and a local client. You can collect artifacts from the client (which is just running on your own machine) as normal.

Once you are ready for a full deployment, check out the various deployment options at https://docs.velociraptor.app/docs/deployment/

We have our complete training course (7 sessions x 2 hours each) https://docs.velociraptor.app/training/

The course covers many aspects of Velociraptor in detail.

To run a Velociraptor server via Docker, follow the instructions here: https://github.com/Velocidex/velociraptor/tree/master/Docker

Velociraptor is also useful as a local triage tool. You can create a self contained local collector using the GUI:

1. Start the GUI as above (velociraptor gui).

2. Select the Server Artifacts sidebar menu, then Build Collector.

3. Select and configure the artifacts you want to collect, then select the Uploaded Files tab and download your customized collector.

To build from source, make sure you have:

• a recent Golang installed from https://golang.org/dl/ (Currently at least Go 1.23.2)
  • the go binary is in your path.
  • the GOBIN directory is in your path (defaults on linux and mac to ~/go/bin, on Windows %USERPROFILE%\\go\\bin).
• gcc in your path for CGO usage (on Windows, TDM-GCC has been verified to work)
• make
• Node.js LTS (the GUI is build using Node v18.14.2)

    $ git clone https://github.com/Velocidex/velociraptor.git
    $ cd velociraptor