Velocidex/velociraptor

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

4208 stars · 653 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Velociraptor is an open-source endpoint visibility, digital forensics, and incident response platform that collects host-based state information using the Velociraptor Query Language (VQL). It provides a client-server architecture with a web GUI for collecting forensic artifacts, monitoring endpoint events, and hunting for suspicious activity across fleets of machines.

Use cases

• collect digital forensic evidence from endpoints during incident response
• hunt for compromised hosts across an entire environment
• continuously monitor endpoint events like process execution and file modifications
• build a self-contained offline triage collector
• triage a suspicious machine locally
• remediate and secure systems at scale after a breach

When to choose

• you need enterprise-grade DFIR and endpoint monitoring across Windows, Linux, and macOS fleets
• you want to run targeted forensic collections or threat hunts at scale
• you need an offline collector for triaging machines without network connectivity
• you want a self-hosted, open-source alternative to commercial EDR/forensics tools

When to avoid

• you need lightweight antivirus or real-time malware blocking rather than forensic collection
• you cannot operate a server component or manage agent deployments
• you need a simple log aggregation tool rather than deep endpoint forensics

Facets

application · maturity stable

monitoring search-engine developer-tools security developer-tools self-hosted windows go self-hosted cross-platform incident-response digital-forensics endpoint-visibility threat-hunting vql forensics dfir endpoint-monitoring linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Velocidex/velociraptor")