The Velociraptor DFIR connector enables automated forensic data collection and incident response actions within the Swimlane Turbine platform.

Velociraptor DFIR is a powerful digital forensics and incident response (DFIR) tool that provides detailed endpoint visibility and facilitates in-depth investigations. This connector allows Swimlane Turbine users to integrate Velociraptor's capabilities directly into their security workflows, enabling automated labeling, quarantining, and retrieval of client data. By leveraging this integration, security teams can execute custom queries, manage client statuses, and analyze forensic artifacts, thereby enhancing their incident response efficiency and reducing time to resolution.

Before integrating Velociraptor DFIR with Swimlane Turbine, ensure you have the following:

This Connector provides the following capabilities:

Include information about known limitations here, including supported or minimum versions, especially known unsupported versions.

Authenticates using API Config File.

Assigns a specified label to a client in Velociraptor DFIR using the provided Client ID.

{"client_id":"C.b279741549ca223d","label":"First_Label_1"}

{"response":[{"client_id":"C.b279741549ca223d","agent_information":{},"os_info":{},"first_seen_at":1724747862,"last_seen_at":1724774682386090,"last_ip":"127.0.0.1:41040","last_interrogate_flow_id":"F.CR6P0LGJFCVJC","last_interrogate_artifact_name":"Generic.Client.Info/BasicInformation","labels":[],"last_hunt_timestamp":0,"last_event_table_version":0,"last_label_timestamp":0,"label(client_id='C.b279741549ca223d', labels='First_Label_1', op='set')":{}}]}

Initiates quarantine for a specified client in Velociraptor DFIR using the provided Client ID.

{"client_id":"C.b279741549ca223d"}

{"response":[{"collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(Windows.Remediation.Quarantine=dict()))":{}}]}

Retrieve results for a specific flow from Velociraptor DFIR using the provided Client ID, Flow ID, and Artifact.

{"client_id":"C.b279741549ca223d","flow_id":"F.efsd245323453dfds","artifact":"Generic.Client.DiskSpace"}

{"response":[{"Filesystem":"udev","Size":"16G","Used":0,"Avail":"16G","Use%":"0%","Mounted":"/dev"},{"Filesystem":"tmpfs","Size":"3.2G","Used":"1.6M","Avail":"3.2G","Use%":"1%","Mounted":"/run"},{"Filesystem":"/dev/sda5","Size":"688G","Used":"28G","Avail":"625G","Use%":"5%","Mounted":"/"}]}

Retrieve all active and completed flows for a specified client in Velociraptor DFIR using the client's unique identifier.

{"client_id":"C.b279741549ca223d"}

{"response":[]}

Obtain the unique Client ID for a given host within Velociraptor DFIR, requiring the host's specific identifier.

{"host":"127.0.0.1"}

{"response":"C.b279741549ca223d"}

Retrieves a specific label for a client in Velociraptor DFIR using the given client ID.

{"client_id":"C.b279741549ca223d","label":"First_Label_1"}

{"response":[{"client_id":"C.b279741549ca223d","agent_information":{},"os_info":{},"first_seen_at":1724747862,"last_seen_at":1724774918462058,"last_ip":"127.0.0.1:41040","last_interrogate_flow_id":"F.CR6P0LGJFCVJC","last_interrogate_artifact_name":"Generic.Client.Info/BasicInformation","labels":[],"last_hunt_timestamp":0,"last_event_table_version":0,"last_label_timestamp":0,"label_check":{}}]}

Retrieves all flows initiated by a specific hunt in Velociraptor DFIR using the unique Hunt ID.

{"hunt_id":"H.CR6P61P95H6CG"}

{"response":[]}

Retrieve results for a specific Velociraptor DFIR hunt using the Hunt ID and artifact parameters.

{"hunt_id":"H.CR6P61P95H6CG","artifact":"Generic.Client.DiskSpace"}

{"response":[]}

Removes a specified label from a Velociraptor DFIR client using the provided Client ID and label.

{"client_id":"C.b279741549ca223d","label":"First_Label_1"}

{"response":[{"client_id":"C.b279741549ca223d","agent_information":{},"os_info":{},"first_seen_at":1724747862,"last_seen_at":1724779073002068,"last_ip":"127.0.0.1:41040","last_interrogate_flow_id":"F.CR7022D3L4CHO","last_interrogate_artifact_name":"Generic.Client.Info/BasicInformation","labels":[],"last_hunt_timestamp":0,"last_event_table_version":0,"last_label_timestamp":0,"label(client_id='C.b279741549ca223d', labels=['First_Label_2'], op='remove')":{}}]}

Removes a client from quarantine in Velociraptor DFIR by utilizing the specified Client ID.

{"client_id":"C.b279741549ca223d"}

{"response":[{"collect_client(client_id=\"C.b279741549ca223d\", artifacts=[\"Windows.Remediation.Quarantine\"], spec=dict(Windows.Remediation.Quarantine=dict(RemovePolicy=\"Y\")))":{}}]}

Initiates a search for a specific file by name and path across endpoints using Velociraptor DFIR.

{"file_name":"file.txt","file_path":"/users/downloads/text.txt"}

{"response":[]}

Initiate a hunt for a specific file hash with Velociraptor DFIR to detect potential security incidents. Requires a file hash as input.

{"file_hash":"advgwertreretewewrtth234werqwae2345qw"}

{"response":[]}

Executes a user-defined VQL query in Velociraptor DFIR to search across collected data, with 'query' as a required input.

{"query":"SELECT * info()"}