Endpoint visibility and digital forensics at scale
DFIR tool that collects forensic artefacts and hunts across fleets of endpoints with its query language VQL, from a single server binary.
Velociraptor deploys a lightweight client to endpoints and lets responders run collections written in the Velociraptor Query Language (VQL). A large artifact exchange covers common forensic sources such as event logs, the registry, the file system and memory, and hunts can run across thousands of machines at once.
It can also run offline collectors on isolated machines. The project is maintained by Rapid7 and the community and is popular with incident response teams.
AGPL-3.0-only · GNU AGPL v3 · Open source
GitHub does not detect the licence; the LICENSE file contains the AGPL v3 text.
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION.
1 published advisory for Velociraptor in GitHub repository advisories. Keep the tool updated: security tools often run with broad access.
GHSA-9qq5-422f-33c2CVE-2026-85737medium2026-08-25
Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin
Sources: GitHub repository advisories · checked 2026-10-20.
Query your endpoints with SQL
Exposes the operating system as a relational database so processes, users, packages and configuration can be queried with SQL on Linux, macOS and Windows.
Open-source XDR and SIEM platform
Security platform combining an endpoint agent, a manager and an indexer for log analysis, intrusion detection, file integrity monitoring and compliance.
Runtime threat detection for containers and hosts
CNCF graduated project that watches Linux system calls (via eBPF or a kernel module) and raises alerts when rules detect suspicious behaviour.
Memory forensics framework
Framework for extracting digital artefacts from memory images (RAM dumps) of Windows, Linux and macOS systems, rewritten in Python 3.
Digital forensics platform built on The Sleuth Kit
Graphical digital forensics platform that analyses disk images and devices with The Sleuth Kit, with modules for timelines, keyword search and artefacts.
Super timeline creation for forensic analysis
Python engine that extracts timestamps from hundreds of file and log formats on a disk image and merges them into one forensic super timeline.
