Velociraptor¶
Velociraptor collects endpoint state using Velociraptor Query Language (VQL) queries. In SUSA, use Instant Velociraptor to practise collection on one Windows workstation.
Follow the local setup below, then practise process triage. For server deployment, additional clients and hunts, use the Cyber Defence Kit guides.
Use Instant Velociraptor¶
Instant Velociraptor runs a server and a local client in one process. This local route does not require a separate Linux server or Windows client installation.
Download and place the executable¶
Download the Velociraptor executable for Windows,
rename it to velociraptor.exe, and move it to C:\Tools\Velociraptor.
Add Velociraptor to PATH¶
Open Edit the system environment variables, select Environment
Variables, then edit Path under User variables.
Add this directory as a new entry:
Select OK in each open dialogue to save the change.
Start Instant Velociraptor¶
Open a new Command Prompt and run:
If Microsoft Defender SmartScreen blocks the executable, select More info and then Run anyway. Approve the User Account Control prompt only when you have obtained Velociraptor from its official source and verified the download.
Keep the Command Prompt running while you use the local interface.
Verify the local client¶
Open https://127.0.0.1:8889/. Because the local lab uses a self signed
certificate, the browser may display a certificate warning. Confirm that the
address is exactly 127.0.0.1:8889 before proceeding.
The Velociraptor home page should open. Select the client search icon and confirm that the local client is connected before starting a collection.
Review Understanding Live Response & Triage for the evidence handling context behind this local workflow.
Practise local triage¶
Use the SUSA hands on labs to identify the workstation, collect its process list, review the log and preserve a supported observation about a running process.
- Browser simulation: practise the collection and review decisions without installing anything.
- Local Full Lab: use Instant Velociraptor on your SUSA workstation and save real process evidence.
Continue with Cyber Defence Kit¶
Choose the guide that matches your next task. All links below take you to Cyber Defence Kit.
| Topic | What you will learn | CDK guide |
|---|---|---|
| Overview | Understand how the server, clients and collections work together. | Open overview |
| Server deployment | Configure a Linux server, verify its services and import artifact projects. | Deploy a server |
| Windows clients | Package and enrol endpoints, then verify their connection to your server. | Connect clients |
| Hunts and results | Scope process, filename and hash hunts, then review the returned evidence. | Create and review hunts |
| Hands on labs | Practise the server and client investigation workflow in a guided lab. | Explore CDK labs |