For DFIR Practitioners, SOC Analysts, and Threat Hunters
Velociraptor for Endpoint Investigation
Focused skills. One thing, learned properly.
Learn to deploy Velociraptor and use it for endpoint investigation at scale. From installation through VQL fluency, single-endpoint collection, fleet-wide hunting, and result analysis — 8 hours to operational capability.
Why take this course
For IR practitioners and threat hunters working at enterprise scale. You finish able to hunt, collect, and triage across thousands of endpoints with Velociraptor — the free-tool capability that lets small teams do what FOR508 teaches with F-Response Enterprise.
What this skill teaches
Velociraptor is the tool that turns every connected endpoint into an evidence source you can reach in seconds. No imaging, no physical access, no waiting for someone to ship you a drive. Deploy the agent, and any machine on the network is one click from a targeted artifact collection or a fleet-wide hunt.
Most practitioners know Velociraptor exists. Few have deployed it themselves, written VQL queries, or built custom artifacts. This skill teaches the deployment, the query language, the collection workflow, the hunting workflow, and — critically — how to read and interpret what comes back.
What you will be able to do
1. Deploy a Velociraptor server on Windows or Linux, connect endpoints, and verify the deployment is working end-to-end.
2. Write VQL queries that extract the evidence you need — processes, event logs, registry keys, network connections, filesystem metadata — without relying on pre-built artifacts alone.
3. Run targeted collections against a single endpoint and interpret the results across artifact types — prefetch, event logs, registry, amcache, network connections.
4. Hunt across your entire fleet, triage results using stacking and outlier detection, and pivot from fleet-wide anomalies to targeted single-endpoint investigation.
5. Write custom VQL artifacts for detection needs specific to your environment, test them against a single client, and deploy them as fleet-wide hunts.
Skill at a glance
Format: Ridgeline Skill — focused, practical, one topic
Sections: 9 content sections + guided lab + summary
Estimated time: 8 hours (self-paced)
Tier: Premium subscription
Prerequisites: Investigation experience. The Practical IR course gives you the methodology this skill assumes. The KAPE and EZ Tools skill gives you the artifact collection context that makes Velociraptor's value immediately clear. Neither is required.
Typical pace: 1-2 weeks at a few hours per week
What you leave with
Working deployment: A Velociraptor server with connected endpoints, ready for use in your lab or during an engagement.
VQL query library: Tested investigation queries for processes, event logs, registry, network connections, and filesystem artifacts — all annotated and reusable.
Custom artifact: A VQL artifact you wrote, tested, and deployed as a hunt — the template for every future detection you build in Velociraptor.
Analysis method: The notebook-based workflow for turning raw collection output into investigation findings, including stacking, outlier detection, and multi-host timeline correlation.
What this course does NOT cover
Deliberate scope boundaries. If any of these is your primary need, the sibling course is the better fit.
- KAPE-based artifact collection — see KAPE and EZ Tools Mastery
- Memory forensics with Volatility — see Applied Memory Forensics
Sections
Nine focused sections plus a guided investigation lab. Every section runs against the Northgate Engineering environment — realistic data, realistic scale, realistic investigation scenarios.
VR0.1ntfs, registry, file). Collections and notebooks orientation. Every panel shown with annotated expected output.SELECT ... FROM plugin() WHERE ..., key plugins (info(), glob(), parse_mft(), parse_evtx(), pslist(), connections()), LET expressions, foreach, output formatting. Six worked query examples against Northgate Engineering endpoints, each annotated line-by-line with expected output.Windows.KapeFiles.Targets, Windows.EventLogs.Evtx, Windows.Registry.NTUser, Windows.Forensics.Prefetch, Windows.Forensics.Amcache, and more. Parameter configuration, time-bounded collection, result review, file download. NE scenario: five targeted collections on DESKTOP-NGE001 during incident response — alert to evidence in under 15 minutes.Related courses
Practical Incident Response — The investigation methodology that Velociraptor accelerates. IR uses Velociraptor for remote collection; this skill goes deep on the tool itself.
KAPE and EZ Tools Mastery — The offline collection and parsing counterpart. KAPE collects from imaged or local systems; Velociraptor collects from live remote endpoints. Together they cover every collection scenario.
Advanced Windows Forensic Analysis — The artifact-level forensics that Velociraptor collections enable. WF11 covers Velociraptor for fleet collection; this skill covers the full tool from deployment through custom artifacts.
About Ridgeline Skills
Skills are focused training on a single capability — 4–8 hours of practitioner-written content with the same depth standard as full Ridgeline courses. Some skills don't need 15 modules. These are the skills that do need proper treatment but don't warrant a full course.
Included with every Premium and Specialist subscription.