Velociraptor artifact

velociraptor artifacts collect -a <artifact>

Collect forensic artifacts from endpoints with Velociraptor, launching collections from the console across the entire fleet.

Run it when you need distributed artifact collection: Velociraptor launches collections (VQL artifacts: processes, EVTX, Run keys, prefetch, autoruns) on endpoints with the agent, and results return to the console. It's the default modern IR platform: IR questions (which hosts have the Run key? where does the process run?) are answered with a collection across the fleet. In IR, Velociraptor is the scale collection tool: artifacts are launched from the console (or API), results are analyzed, and affected endpoints are identified. The same agent serves for continuous hunting and response.

Don't use it without deployment: Velociraptor needs agents on endpoints and the server — infrastructure is the requirement. Heavy artifacts (full EVTX, broad collections) generate load and traffic: scope by host and artifact. And watch out: collection is a snapshot — volatile data (processes, connections) reflects the moment; for continuity, scheduled queries (hunting) complement. Artifact selection with criteria (IR questions, not everything) is part of the flow: massive collection without plan generates noise and saturation. Velociraptor covers Windows/Linux/macOS with a single agent.