Velociraptor: Dig Deeper into Enterprise Endpoint Telemetry
Velociraptor creator Mike Cohen demonstrates advanced enterprise endpoint forensics and live incident triage using Velociraptor Query Language (VQL).
Summary
The Need for Rapid Enterprise Forensic Collection
During large-scale cyber intrusions, incident response teams need the ability to query thousands of enterprise endpoints in seconds to detect and remediate threats.
Inside the Velociraptor DFIR Architecture
Mike Cohen presents Velociraptor, an open-source endpoint visibility and digital forensics framework powered by the Velociraptor Query Language (VQL).
Executing Live Triage and Surgical Forensic Hunts
Cohen demonstrates writing custom VQL queries to collect memory artifacts, enumerate active process hollows, inspect raw MFT filesystems, and hunt across thousands of hosts.
Automated Remediation and Threat Hunting Playbooks
The author showcases how enterprise DFIR teams can automate response workflows, quarantine infected endpoints, and extract forensic timelines across global fleets.
Related talks
Blue Team Village·18 min
Project Obsidian
Project Obsidian demonstrates writing custom Velociraptor Query Language (VQL) artifacts to hunt for IOCs and collect forensic evidence across thousands of endpoints.
Blue Team Village·43 min
Mike Cohen
Demonstrates endpoint hunting, artifact collection, and forensic querying using Velociraptor VQL in OpenSOC.
S4 Events·37 min
Industry experts analyze emerging threats surrounding Digital Forensics and Incident Response (DFIR) for ICS Embedded Devices.