Velociraptor
Featured馃敩 Digital Forensics 路 Go
Velociraptor is an endpoint visibility and collection tool designed for digital forensic investigations and incident response (DFIR). It allows security teams to hunt for artifacts across thousands of endpoints simultaneously, providing deep insights into system activities. Written in Go, Velociraptor is notable for its scalability and speed, enabling rapid response and comprehensive analysis in enterprise environments.
Tags
Details
- Category
- 馃敩 Digital Forensics
- Language
- Go
- Repository
- Velocidex/velociraptor
- Platforms
- 馃惂linux馃崕macos馃獰windows
Links
Used in 1 Workflow
Community Reviews
Alternatives & Comparisons
YARA
CPattern matching swiss knife for malware researchers. Create rules to identify and classify malware samples.
Compare Velociraptor vs YARAGRR Rapid Response
PythonRemote live forensics framework by Google. Deploy agents across thousands of endpoints for artifact collection and analysis.
Compare Velociraptor vs GRR Rapid ResponseKAPE
C#Kroll Artifact Parser and Extractor. Fast triage collection and parsing of forensic artifacts from Windows, macOS, and Linux.
Compare Velociraptor vs KAPEosquery
C++SQL-powered endpoint visibility. Query operating system state as a relational database for security monitoring and compliance.
Compare Velociraptor vs osqueryMore in Digital Forensics
Volatility 3
PythonAdvanced memory forensics framework. Extracts artifacts from RAM dumps - processes, network connections, registry.
Autopsy
JavaDigital forensics platform with GUI. Disk image analysis, timeline analysis, keyword search, hash filtering.
Ghidra
JavaNSA's reverse engineering framework. Disassembly, decompilation, graphing, and scripting for binary analysis.
Binwalk
PythonFirmware analysis tool. Searches binary images for embedded files, executables, and file systems.
YARA
CPattern matching swiss knife for malware researchers. Create rules to identify and classify malware samples.
Plaso (log2timeline)
PythonSuper timeline creation engine. Extracts timestamps from multiple forensic artifact sources into a single timeline.