graype28/velociraptor repository overview

⁠Velociraptor Digital Forensics & Incident Response

🦖 DFIR Platform in Docker

Velociraptor is an open-source endpoint monitoring and digital forensics tool. This image provides a containerized deployment with security hardening and multi-platform client support.

⁠Quick Start

docker run -d \
  -p 8889:8889 -p 8000:8000 -p 8001:8001 \
  -v $(pwd)/data:/velociraptor \
  graype28/velociraptor:latest

Create admin user (required on first run):

docker exec -it <container_name> ./velociraptor/velociraptor \
  --config /velociraptor/server.config.yaml \
  user add admin admin --role administrator

Access the GUI at https://localhost:8889

⁠Common Use Cases

• Security operations and monitoring
• Incident response and forensic investigations
• Threat hunting across endpoints
• Security testing and validation
• Compliance and audit logging

⁠Features

Capabilities

• Real-time endpoint monitoring
• VQL query language for forensic investigations
• 421+ pre-built forensic artifacts
• Scheduled hunts and automation
• Offline evidence collection

Security

• Non-root container execution
• Version-pinned dependencies
• Automatic SSL/TLS certificate generation
• Role-based access control
• Comprehensive audit logging

Included

• Pre-packaged clients for Windows, macOS, and Linux
• Automatic client configuration and repacking
• Compatible with ECS, Kubernetes, Docker Swarm

⁠Available Tags

⁠Configuration

Environment Variables:

VELOX_USER=admin                    # Admin username
VELOX_PASSWORD=SecurePassword123    # Admin password (required!)
VELOX_FRONTEND_HOSTNAME=your.domain # Public hostname
VELOX_SERVER_URL=https://your.domain:8000/  # Client connection URL

Docker Compose Example:

version: '3.8'
services:
  velociraptor:
    image: graype28/velociraptor:latest
    ports:
      - "8889:8889"  # Web GUI
      - "8000:8000"  # Frontend (clients)
      - "8001:8001"  # API/gRPC
    environment:
      - VELOX_PASSWORD=${VELOX_PASSWORD}
      - VELOX_FRONTEND_HOSTNAME=${HOSTNAME}
    volumes:
      - ./velociraptor:/velociraptor
    restart: unless-stopped

⁠📋 Recent Updates (v0.77.1)

✅ Latest stable release with new features and improvements
✅ Built as linux/amd64 for ECS Fargate compatibility
✅ See full 0.77 release notes⁠ for details

⁠🔗 Resources

• Velociraptor Documentation⁠
• Release Notes⁠

Built for production DFIR workflows 🛡️