Velocity Raptor: Accelerating Velociraptor Hunting With Tenzir

The talk starts from a common DFIR problem: even with Velociraptor, getting endpoint visibility takes time, and once the data arrives, analysts still need to analyze, transform and move it. The speaker presents an open-source, Apache-style pipeline processing engine as a way to handle that stage. A pipeline is built from zero or more sources, transformations and a sink, and it runs from the command line with JSON output by default. Examples included reading a local file and writing top results to a destination, and fetching a remote compressed file, filtering alerts and sending them to a Kafka topic.

The middle of the talk covers the Velociraptor integration. Velociraptor exposes a gRPC API, so the pipeline tool can connect to the server from a source, run a VQL query and stream the responses into the pipeline. The demo used this to list enrolled hosts and to select and process collected data. From there the results can be imported, written to Parquet, or handed to other tools.

The takeaway for practitioners is that responders can reshape Velociraptor output during an incident without writing one-off scripts, and make it available to other systems quickly. The speaker noted that a blog post describing the integration was due the following day.