Velociraptor
Rapid7 · Velociraptor 0.77 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
An open-source endpoint visibility and DFIR platform built around VQL, a query language for collecting artefacts, monitoring events, and hunting across a fleet of agents. Development is sponsored by Rapid7, with the code still published under the Velocidex organisation.
Who it is for, and when
Velociraptor is what you deploy when the question spans hundreds or thousands of endpoints: write one VQL artefact and hunt it everywhere, pull back specific files or parsed output rather than whole images, and keep a continuous event feed for later reconstruction. It is the main open-source alternative to a commercial enterprise forensics agent, and it handles remote collection in situations where physically attending a machine is impossible. The artefact library is community-maintained and readable, which matters when you have to justify what you collected.
What it does not cover
It is a collection and hunting platform, not an analysis suite — VQL gets you the data, and you still need Volatility, Plaso, or the EZ Tools set to work it properly. Deploying agents on endpoints is an intrusive act with consent, authority, and chain-of-custody consequences that the tool does not manage for you, and VQL has a real learning curve that a GUI suite does not impose.
Go to the source
Open at docs.velociraptor.app (opens in a new tab)https://docs.velociraptor.app/
Details
- Type
- Tool
- Written for
- AdvancedWorking examinerAdvanced, Working examiner
- Publisher
- Rapid7
- Version verified
- Velociraptor 0.77
- Year
- 2026
- Topics
- incident-response, live-response, threat-hunting, triage, open-source, scripting
- Checked at source
Related entries
Forensics placed inside the incident response lifecycle: building a response capability, response frameworks, evidence acquisition, volatile memory, disk and network evidence, threat intelligence, malware analysis, threat hunting, and reporting — with this edition reframed around ransomware.
Live response and postmortem analysis on macOS using bash and Python tooling the reader writes: startup and persistence mechanisms, scheduling, browser history, memory analysis, credential extraction, exfiltration detection and timelining.
CyberChef
FreeA browser-based tool published by GCHQ that chains together hundreds of data operations — encodings, ciphers, compression, hashing, timestamp conversion, parsing, and extraction — into a visible recipe. It runs entirely client-side and is actively released.
Two open-source Rust tools that apply Sigma and their own rules directly to Windows event log (EVTX) files and produce a prioritised, timeline-ordered set of hits. Hayabusa comes from Yamato Security; Chainsaw is published by WithSecure (the repository now lives under WithSecureOpenSource). Both are actively released.
KAPE (Kroll Artifact Parser and Extractor)
Partly freeA Kroll-owned Windows triage tool that collects forensically relevant files from a live or mounted system using configurable Targets, then runs parsers over what it collected using Modules. It bypasses file locks with raw disk reads and preserves original timestamps on the copies.