Velociraptor

Open source

Open source endpoint visibility and digital forensics tool for hunting across device fleets.

Pricing: free
Free tier: true
License: open-source
Open source: Yes

Editorial review

Velociraptor has not yet been editorially reviewed. User reviews and published field data below are unaffected — we say so rather than implying an editorial verdict.

Facts & attributes

Every value carries its evidence state. “—” means unknown — never a silent default (P-02).

Identity · Taxonomy

Documentation(HTTPS URL): https://docs.velociraptor.app/Verified
Tags(open-source;cloud-native): dfir, incident-response, threat-hunting, forensics, endpoint-visibility, open-sourceVerification pending

Platform · Deployment

Delivery model(SaaS;self-hosted;desktop;mobile;embedded;managed-cloud;appliance): self-hosted, desktopVerification pending
Desktop apps(Windows;macOS;Linux): Windows, Linux, macOSVerified

Pricing · Licensing

Free plan(true/false): trueVerification pending
License model(proprietary;open-source;source-available;dual-license): open-sourceVerification pending
Pricing model(free;subscription;usage;seat;asset;transaction;revenue-share;perpetual;custom): freeVerification pending
Source repository(HTTPS URL): https://github.com/Velocidex/velociraptorVerified
SPDX license IDs(Apache-2.0;MIT): AGPL-3.0Verification pending

Features · Product · Fit

Core capabilities(authoring;automation;analytics): endpoint visibility and host state collection, VQL (Velociraptor Query Language) queries, artifact-based collections, fleet-wide hunting, forensic analysis, offline collectionsVerification pending

Api · Integrations · Ecosystem

API available(true/false): trueVerification pending
CLI(true/false): trueVerification pending

Audience · Use · Case

Best for(Neutral editorial summary): IR teams running targeted VQL collections and hunts across endpoints from a self-hosted serverVerification pending
Company-size fit(individual;SMB;mid-market;enterprise): individual, SMB, mid-market, enterpriseVerification pending
Primary use cases(build;monitor;automate): incident response, threat hunting, forensic analysis, endpoint monitoringVerification pending
Skill level(beginner;intermediate;advanced;specialist): specialistVerification pending

Lifecycle · Versioning

Changelog/release notes(HTTPS URL): https://docs.velociraptor.app/blog/Verified
Current version(1.12.3): 0.77.3Verified
Maintenance status(active;maintenance;deprecated;EOL;archived): activeVerified

Vendor · Maintainer

Vendor type(commercial;foundation;community;government;consortium;individual): commercialVerification pending

User reviews

Review policy

No published reviews yet.