Velociraptor — Installation & DFIR Guide

→

What it is

A single static binary that is both server and client. The server has a web GUI; clients (agents) roll out to endpoints and call home over TLS. Everything is driven by VQL, so you can ask endpoints arbitrary questions in real time instead of waiting for a fixed feature set.

For your test environment: Velociraptor can also run entirely without a server — as a standalone "offline collector" that packages a single executable you run on a suspect machine. See Offline collector.

→

Server installation

Linux

Download the latest binary from GitHub releases. The interactive config generator creates server and client configuration plus the first admin login.

Download binary

# check github.com/Velocidex/velociraptor/releases for the latest version
wget https://github.com/Velocidex/velociraptor/releases/latest/download/velociraptor-linux-amd64
chmod +x velociraptor-linux-amd64
sudo mv velociraptor-linux-amd64 /usr/local/bin/velociraptor

Generate configuration (interactive)

velociraptor config generate -i

Asks about SSL mode (self-signed / Let's Encrypt / autocert), ports and data path. Produces server.config.yaml + client.config.yaml.

Create admin user

velociraptor --config server.config.yaml user add admin --role administrator

Install as systemd service

velociraptor --config server.config.yaml service install
sudo systemctl enable --now velociraptor_server

The GUI now runs at https://your-server:8889 (default).

Behind Nginx: Since you already run Nginx + Certbot on Hetzner, you can set Velociraptor to listen on localhost and reverse-proxy the GUI at velo.defencia.dk with your existing cert. Remember the websocket upgrade headers in the proxy block.

→

Deploy clients

The client uses the same binary with client.config.yaml. Package an MSI/DEB or run directly.

Linux client (direct)

sudo velociraptor --config client.config.yaml client -v

Build Debian package

velociraptor --config client.config.yaml debian client

Build Windows MSI

velociraptor.exe --config client.config.yaml msi

Verify client connection

# in GUI: Search → show active clients
# or via API/notebook with VQL: clients()

→

VQL — fundamentals

query language

VQL resembles SQL but plugs into live system data. Run queries in the GUI's Notebook or via the CLI velociraptor query.

Run VQL from CLI

velociraptor --config server.config.yaml query \
  "SELECT Name, Pid, Ppid FROM pslist()"

Find listening network connections

SELECT * FROM netstat()
WHERE Status = 'LISTEN'

Search files with the glob plugin

SELECT FullPath, Mtime FROM glob(
  globs="/home/**/*.sh")
WHERE Mtime > now() - 86400

VQL plugin	Function
`pslist()`	Running processes with metadata
`netstat()`	Network connections
`glob()`	File search with wildcard patterns
`hash()`	Compute MD5/SHA1/SHA256 of files
`yara()`	Run YARA rules against files or process memory
`pe_dump() / authenticode()`	Inspection of PE files and signatures
`parse_evtx()`	Parse Windows event logs
`parse_mft()`	Parse NTFS Master File Table
`execve()`	Run external command and capture output
`artifact_set() / Artifact.*`	Call reusable artifact definitions

→

Hunts & artifacts

A "hunt" runs an artifact collection across all (or a subset of) clients simultaneously. Artifacts are reusable VQL packages — 300+ ship with it.

Typical DFIR flow: Pick an artifact (e.g. Windows.Detection.Yara.Process or Linux.Sys.BashShell) → start a hunt against a label group → results are collected centrally → export to CSV/JSON for further analysis. You can upload your own YARA rules (signature-base) as a parameter to yara artifacts.

List all artifacts

velociraptor artifacts list

Show an artifact's definition

velociraptor artifacts show Windows.Detection.Yara.Process

→

Offline collector

standalone

Package a standalone executable that collects artifacts without a server — perfect for a single suspect machine or where you can't deploy agents.

Build offline collector (interactive)

velociraptor --config server.config.yaml collector
# pick artifacts → produces Collector_*.exe / .bin
# run on target → output is a zip with all artifacts

→

Hardening

Important: The Velociraptor server is effectively a C2-like capability — full command execution on all clients. Restrict GUI access behind VPN/Nginx with an IP whitelist, use strong roles (reader vs investigator vs administrator), and rotate client certificates if an endpoint is compromised. Log all hunts.

For your stack: Run the server on a dedicated VLAN/segment, put the GUI behind velo.defencia.dk with a Fail2ban jail on the login endpoint (see Fail2ban (coming as its own guide)), and use UFW to allow the client port only from your endpoint subnet.