Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts.
The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting.
The platform covers a wide range of capabilities including real-time kernel event streaming, remote filesystem browsing, and raw NTFS parsing for forensic evidence preservation. It includes an extensibility framework for importing community-defined artifacts and supports multi-tenant data isolation to separate evidence by organization.
The project provides a command-line interface for artifact validation and execution, and it supports deploying persistent agents or standalone offline collectors.