Velociraptor DFIR Integration

Background

Velociraptor is an open source endpoint visibility tool for digital forensics, incident response, and triage. LimaCharlie integrates with Velociraptor via the ext-velociraptor extension.

How Velociraptor Data Flows in LimaCharlie

When a Velociraptor collection runs:

1. Raw Artifacts: The collected data is stored as a ZIP file in LimaCharlie's Artifact system

   • Filter by: artifact_type: velociraptor
   • The source field contains the Sensor ID (SID) where it was collected

2. Processed Events: For small collections, data is also processed to JSON and ingested as sensor events

   • Events appear on a sensor with hostname: velociraptor
   • Tagged with: ext:ext-velociraptor
   • Event types: velociraptor_collection, artifact_event

3. D&R Automation: You can trigger on these events for automated workflows

When to Use

Use this skill when the user wants to:

• List available Velociraptor artifacts for collection
• View the YAML definition of a specific artifact
• Launch Velociraptor collections on endpoints
• Find and download raw Velociraptor collection data
• Query processed Velociraptor events
• Build D&R rules for Velociraptor automation

Prerequisites

The organization must have the ext-velociraptor extension subscribed.

The limacharlie CLI must be available.

How to Use

Step 1: Get the Organization ID

If not already known, get the OID:

limacharlie org list --output yaml

Step 2: List Available Velociraptor Artifacts

List all VQL artifacts available for collection (built-in and external from triage.velocidex.com):

limacharlie extension request --name ext-velociraptor --action list_artifacts --oid <oid> --output yaml

Step 3: View Artifact Definition

Before collecting, view an artifact's YAML to understand its parameters:

limacharlie extension request --name ext-velociraptor --action show_artifact \
  --data '{"artifact_name": "Windows.System.Drivers"}' --oid <oid> --output yaml

Step 4: Launch a Collection

Collect from a single sensor:

limacharlie extension request --name ext-velociraptor --action collect \
  --data '{"artifact_list": ["Windows.System.Drivers"], "sid": "<sensor-id>"}' \
  --oid <oid> --output yaml

Collect from multiple sensors using a selector:

limacharlie extension request --name ext-velociraptor --action collect \
  --data '{"artifact_list": ["Windows.KapeFiles.Targets"], "sensor_selector": "plat == windows", "args": "KapeTriage=Y", "collection_ttl": 3600, "retention_ttl": 7}' \
  --oid <oid> --output yaml

Step 5: Find Collection Results (Raw Artifacts)

List raw Velociraptor artifacts stored in the Artifact system:

limacharlie artifact list --type velociraptor --sid <sensor-id> --oid <oid> --output yaml

Download an artifact:

limacharlie artifact download --id <artifact-id> --oid <oid> --output yaml

Step 6: Query Processed Events

For small collections, data is also available as events. Use LCQL to query them.

CRITICAL: Always use limacharlie ai generate-query first - never write LCQL manually.

limacharlie ai generate-query --prompt "velociraptor_collection events from the last 7 days" --oid <oid> --output yaml

Then execute:

limacharlie search run --query "<generated-query>" --start <ts> --end <ts> --oid <oid> --output yaml

Step 7: Find the Velociraptor Sensor

To find the virtual sensor that receives processed Velociraptor data:

limacharlie sensor list --selector "\`ext:ext-velociraptor\` in tags" --oid <oid> --output yaml

Collection Parameters

Common Velociraptor Artifacts

Example D&R Rules

Trigger on Artifact Upload

Detect when a Velociraptor collection completes:

# Detection