Agent skill · security · aiskillstore
ir-velociraptor
Endpoint visibility, digital forensics, and incident response using Velociraptor Query Language (VQL) for evidence collection and threat hunting at scale. Use when: (1) Conducting forensic investigations across multiple endpoints, (2) Hunting for indicators of compromise or suspicious activities, (3) Collecting endpoint telemetry and artifacts for incident analysis, (4) Performing live response and evidence preservation, (5) Monitoring endpoints for security events, (6) Creating custom forensic artifacts for specific threat scenarios.
Why this skill is useful
Provides specific VQL commands and workflows for endpoint forensics and threat hunting that the AI wouldn't reliably generate on its own.
What it needs
Requires velociraptor installed locally. About 6k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Velociraptor Incident Response Overview Velociraptor is an endpoint visibility and forensics platform for collecting host-based state information using Velociraptor Query Language (VQL). It operates in three core modes: Collect (targeted evidence gathering), Monitor (continuous event capture), and Hunt (proactive threat hunting). When to use this skill: Active incident response requiring endpoint evidence collection Threat hunting across enterprise infrastructure Digital forensics investigations and timeline analysis Endpoint monitoring and anomaly detection Custom forensic artifact development for specific threats Quick Start Local Forensic Triage (Standalone Mode) Enterprise Server Deployment Core Incident Response Workflows Workflow 1: Initial Compromise Investigation Progress: [ ] 1. Identify affected endpoints and timeframe [ ] 2. Collect authentication logs and suspicious logins [ ] 3. Gather process execution history and command lines [ ] 4. Extract network connection artifacts [ ] 5. Collect persistence mechanisms (scheduled tasks, autoruns, services) [ ] 6. Analyze file system modifications and suspicious files [ ] 7. Extract memory artifacts if needed [ ] 8. Build timeline and document IOCs Work through each step systematically. Check off completed items. Key VQL Artifacts: Windows.EventLogs.RDP - Remote desktop authentication events Windows.System.Pslist - Running processes with details Windows.Network.NetstatEnriched - Network connections with process context Windows.Persistence.PermanentWMIEvents - WMI-based persistence Windows.Timeline.Prefetch - Program execution timeline Windows.Forensics.Timeline - Comprehensive filesystem timeline Workflow 2: Threat Hunting Campaign Progress: [ ] 1. Define threat hypothesis and IOCs [ ] 2. Select or create custom VQL artifacts for detection [ ] 3. Create hunt targeting relevant endpoint groups [ ] 4. Execute hunt across infrastructure [ ] 5. Monitor collection progress and errors [ ] 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/ir-velociraptor