Back to catalog
Velociraptor
AGPL-3.0Velociraptor is an open-source endpoint visibility and incident response platform that uses VQL queries to hunt threats and collect forensic artifacts.
Open-source alternative to — compare it against:
Overview
A DevOps team managing cloud infrastructure spots unusual outbound traffic on internal Kubernetes nodes and build bastions. Instead of waiting for commercial agents to install and upload full disk images to a vendor cloud, the team deploys Velociraptor to query process trees, inspect raw filesystems, and isolate hosts directly.
Why Velociraptor instead of FireEye Endpoint Security
FireEye Endpoint Security manages host monitoring through a centralized commercial architecture with proprietary agents, cloud management consoles, and per-seat licensing. In contrast, Velociraptor operates as a digital forensics and incident response platform built into a single Go binary. Instead of shipping large disk images or memory dumps across networks to a central appliance, Velociraptor pushes computation directly to endpoints via the Velociraptor Query Language (VQL). Responders execute targeted queries that parse low-level artifacts on the host, returning only matching records to the server.
From an operations standpoint, Velociraptor removes external database requirements and dedicated broker infrastructure. A single server binary coordinates client communication, web administration, and local file storage. While FireEye provides turnkey threat intelligence and automated signature-based blocking, Velociraptor delivers an open investigation engine. DevOps engineers deploy agents across Linux, Windows, and macOS fleets using standard automation tools, schedule hunting sweeps via a gRPC API, and generate standalone offline collectors for air-gapped hosts.
What it does well
- Local query evaluation via VQL, parsing artifacts on endpoints to return structured data without transferring raw disk or memory dumps over networks.
- Single-binary architecture with no database dependencies, allowing deployment via standard configuration tools like Ansible or Terraform.
- Live event monitoring using Windows Event Tracing and Linux eBPF, evaluating Sigma rules locally and streaming alerts to central pipelines.
- Standalone offline collectors, generating self-contained binaries that gather specified artifacts into encrypted archives on air-gapped systems.
- Programmatic gRPC API, letting platform teams trigger automated triage sweeps from continuous integration workflows and SOAR playbooks.
- Raw filesystem inspection, bypassing file locks to read NTFS structures and extract forensic evidence without interrupting running workloads.