Velociraptor DFIR review: open-source hunts and VQL

Velociraptor is an open-source endpoint visibility and DFIR platform. Rapid7 bought the project in 2021, kept it free under the AGPL, and still ships it for anyone who can run a server. We read the docs, the licence and the release notes. Checked on 27 October 2026.

Documentation review: not tested. We have not used the product in this review. It is a structured reading of published evidence, linked throughout. How we review products explains what that covers.

Status: correct as at 27 October 2026. Prices are public list prices as displayed on the dates given; real deals are negotiated.

Disclosure: no vendor sponsored, reviewed or saw this review before publication, and there are no affiliate links. Our independence policy explains how we work.

What it is

Velociraptor collects forensic evidence, runs hunts and monitors endpoints with a language instead of a pile of one-off scripts. The docs homepage banner, read on 27 October 2026, says Velociraptor 0.77.3 (opens in a new tab) became available on 5 October 2026.

On 21 April 2021 (opens in a new tab) Rapid7 announced it had acquired Velociraptor. Founder Mike Cohen joined Rapid7. The company said it would keep supporting the open-source community while using the technology to enhance its own incident-response capabilities. The project still publishes from github.com/Velocidex/velociraptor (opens in a new tab) and from docs.velociraptor.app.

Rapid7’s product page still describes Velociraptor as an advanced open-source endpoint monitoring, digital forensic and cyber response platform: collect, hunt and monitor. That is accurate as far as the documentation goes. It is also a reminder that “free” here means free as in licence, not free as in no operators.

Architecture

The deployment overview (opens in a new tab) names four pieces: Client (the endpoint agent), Frontend (talks to clients), GUI (admin web app) and API (gRPC). A typical production deployment puts the server on a cloud VM. Clients usually install as a service and keep a persistent connection so tasks run near real time rather than on a poll interval.

There is no external database. State lives in regular files on the server filesystem, which the docs say makes backups and lifecycle management simpler and works with distributed filesystems such as Amazon EFS, Google Filestore or NFS. One binary covers server, client and utilities; the operating mode depends on command-line flags. Production servers are only fully supported on Linux. Windows and macOS servers are fine for evaluation.

For a quick look, the same docs describe Instant Velociraptor via the gui command: server plus one local client in a single process, useful for labs and artifact development, not for production estates.

VQL and artifacts

VQL (opens in a new tab) is the Velociraptor Query Language. The docs are blunt about why it exists: DFIR tools have to change as fast as indicators do, and shipping a new compiled agent for every idea is too slow. Investigators write queries, package them as artifacts, and push those artifacts across the estate in minutes.

Artifacts are versioned, shareable units. The project ships a built-in artifact reference with every release and hosts a community Artifact Exchange (opens in a new tab). That exchange is the practical moat. A good VQL library turns a generic agent into your team’s playbook.

The trade-off is obvious. Teams that will not learn VQL will treat Velociraptor as an awkward GUI over collections they barely trust. Teams that will learn it get something closer to a programmable DFIR runtime.

Hunts

A hunt, in Velociraptor’s terms, is the same artifact collected from many endpoints under one manager. The hunting documentation (opens in a new tab) stresses that hunts expire rather than “complete”, because real networks keep gaining and losing hosts. Default expiry is one week unless you change it. Label groups include or exclude machines. New hunts start paused in the GUI so you can test on a few clients before you open the floodgates.

Each hunt gets a notebook for post-processing with more VQL. The docs warn hard about data volume: a 100 MB file from 10,000 machines is over a terabyte. Prefer targeted artifacts that return a few rows per host. That warning alone tells you this is a power tool, not a safe default “collect everything” button.

Deployment and day-two work

Deployment milestones in the docs are familiar: stand up a server, authorise GUI users, then deploy clients with MSI or your usual software-distribution path. Offline collectors exist for sneakernet and air-gapped work; they are full clients that write results to files instead of calling home.

InsightIDR customers are told to follow Rapid7’s Insight Platform docs rather than the open-source deployment guide. That split matters. Open-source Velociraptor is something you operate. The Rapid7-integrated path is something you buy into a broader detection stack.

Day-two costs are people and disk. Someone has to write artifacts, review hunt notebooks, rotate keys in the deployment config, and watch storage. None of that appears on a licence invoice, which is why “free DFIR at scale” is both true and slightly mischievous.

Licensing

The GitHub LICENSE (opens in a new tab) file is GNU Affero General Public License version 3. AGPL is copyleft for network software: if you modify Velociraptor and let users interact with it over a network, you must make the corresponding source available to those users. You may still charge for copies or for support. You may not quietly turn a modified server into a closed SaaS without meeting the licence.

For most security teams running an internal server, AGPL is workable. For vendors who want to embed a modified Velociraptor into a proprietary cloud product, it is a deliberate speed bump. Rapid7’s 2021 statements emphasised community support rather than a proprietary relicensing of the core project; we found no primary source announcing an AGPL exception for third parties.

One practical implication: security consultancies that want to ship a modified Velociraptor service to clients must plan for AGPL source obligations, or use the software unmodified and keep custom logic in artifacts and external tooling. Many teams do exactly that. Artifacts and notebooks are where most of the proprietary tradecraft lives anyway.

How it compares

Area	Velociraptor	GRR Rapid Response	osquery / Fleet	KAPE
What it is	DFIR agent, hunts, VQL artifacts	Remote live forensics / IR framework	SQL endpoint inventory; Fleet orchestrates osquery	Windows triage collector and parsers
Query model	VQL artifacts	Flows / hunters	osquery SQL	Target / module collections, not a live query language
Scale pattern	Persistent clients + hunts	Client/server fleets	Scheduled queries and evented tables	Per-host or USB / network triage
Licence	AGPL-3.0	Apache-2.0 (project licence)	osquery Apache-2.0; Fleet has open and commercial editions	Free for internal, government and education use per Kroll; enterprise licence for paid third-party work; not an always-on agent
Best fit	Custom DFIR hunts at estate scale	Remote forensic acquisition traditions	Continuous inventory and detection engineering	Fast Windows evidence pull when you already have access

GRR is the older Google-born remote forensics cousin: strong at live acquisition patterns, less centred on a shareable artifact exchange like Velociraptor’s. osquery plus Fleet is the better fit when the daily job is inventory, compliance diffs and SQL-shaped detection rather than deep forensic parsing. KAPE, from Eric Zimmerman’s toolkit tradition, is the right hammer for rapid Windows triage on machines you can already reach; it is not trying to be your always-on fleet agent.

Velociraptor’s edge is the combination of persistent agents, hunt management and a DFIR-native query language with a public artifact culture. Its gap against commercial EDR is equally clear: you bring the detections, the tuning, the on-call and the storage budget.

Monitoring, not only incident response

Rapid7’s product page lists continuous collection of endpoint events such as event logs, file modifications and process execution, with central storage for historical review. The open-source docs back the same idea through client event monitoring and scheduled collections. That puts Velociraptor closer to a light detection fabric than to a pure “break glass” collector, provided you write the detections.

It still is not endpoint detection and response in the commercial sense. There is no marketed behavioural engine that replaces CrowdStrike, Defender for Endpoint or SentinelOne out of the box. You can approximate pieces of that stack with VQL, event feeds and your own alerting pipeline. You should budget engineering time accordingly, or buy Rapid7’s managed and platform offerings if you want someone else on the hook.

Clients and platforms

Pre-built binaries cover Windows, Linux and macOS on the project’s downloads page. Clients typically run as a service. The server binary can technically start on those platforms too, but the deployment docs reserve full production support for Linux and cite performance on other operating systems as the reason. Evaluation, development and Instant mode are the documented exceptions.

Agentless and offline patterns matter for hostile or fragile hosts. Offline collectors package selected artifacts into a one-shot binary that writes jsonl or CSV locally. Instant mode with remapping can inspect disk images. Those modes keep Velociraptor useful when you cannot or should not leave a persistent agent behind.

Strengths

• No per-endpoint licence for the open-source core.
• VQL plus the Artifact Exchange lets skilled teams ship new hunts quickly.
• Persistent client connections cut the waiting that poll-based tools impose.
• Filesystem-backed server datastore avoids a mandatory external database.
• Offline collectors cover air-gapped and sneakernet cases.

Gaps

• You operate the server. Linux production support is a hard requirement in the docs.
• VQL has a learning curve; weak query discipline becomes weak evidence.
• Hunt data volumes can explode if artifacts upload raw files at scale.
• AGPL complicates proprietary SaaS embedding.
• It is not a managed detection product on its own; Rapid7’s commercial stack is a separate buying decision.

Who should run it

• Internal DFIR / detection engineering with Linux ops skill: yes. Start with Instant mode in a lab, then a small client pilot, then hunts.
• Already on Rapid7 MDR or InsightIDR: ask Rapid7 how Velociraptor fits the platform you already pay for before standing up a parallel open-source server.
• Need Windows triage tomorrow on ten laptops: KAPE or a similar offline collector may be faster than deploying agents.
• Need continuous inventory SQL across tens of thousands of hosts: evaluate osquery with Fleet beside or instead of Velociraptor.

What we could not verify

We have not measured performance, memory use or hunt latency on any estate. Rapid7 commercial pricing for products that incorporate Velociraptor is not on a public rate card we could cite. Community Artifact Exchange quality varies by author; we have not audited the exchange. GRR, Fleet and KAPE comparison cells are documentation-level, not a lab bake-off.

Sources: every figure above links to its source, with the date we checked it. Spotted an error? Tell us.

Follow Cyber-Threat.net RSS · Feedly (opens in a new tab) · X (opens in a new tab) · Bluesky (opens in a new tab) · LinkedIn (opens in a new tab)