--- title: Velociraptor Dfir slug: connectors/velociraptor-dfir docTags: createdAt: 2026-06-09T16:29:52.892Z --- The Velociraptor DFIR connector enables automated forensic data collection and incident response actions within the Swimlane Turbine platform. Velociraptor DFIR is a powerful digital forensics and incident response (DFIR) tool that provides detailed endpoint visibility and facilitates in-depth investigations. This connector allows Swimlane Turbine users to integrate Velociraptor's capabilities directly into their security workflows, enabling automated labeling, quarantining, and retrieval of client data. By leveraging this integration, security teams can execute custom queries, manage client statuses, and analyze forensic artifacts, thereby enhancing their incident response efficiency and reducing time to resolution. ## Prerequisites Before integrating Velociraptor DFIR with Swimlane Turbine, ensure you have the following: - API Config File authentication with these parameters: - URL: The endpoint URL for the Velociraptor DFIR server. - API Config Base64: A base64-encoded string containing the API configuration details for secure communication with the Velociraptor server. ## Capabilities This Connector provides the following capabilities: - Add Client Label - Add Client Quarantine - Get Client Flow Results - Get Client Flows - Get Client ID - Get Client Label - Get Hunt Flows - Get Hunt Results - Remove Client Label - Remove Client Quarantine - Search Filename - Search Hash - Search with Custom Query ### Limitations Include information about known limitations here, including supported or minimum versions, especially known unsupported versions. ## Asset Setup ## Create a Client API Certificate - create a client api certificate using this command - **velociraptor --config server.config.yaml config api\_client --name Mike --role administrator api.config.yaml** - Now convert the api.config.yaml to base64. - Pass the Base64 in the API Config Base64 field in the asset. ## Notes - [API Documentation](https://docs.velociraptor.app/docs/server_automation/server_api/) # Configurations ## Velociraptor Asset Authenticates using API Config File. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------------- | ---------------------------------------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | api\_config\_base64 | Convert API Config Yaml File to Base64. Check readme to generate a API config yaml file. | string | Required | | verify\_ssl | Verify SSL certificate. | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add Client Label Assigns a specified label to a client in Velociraptor DFIR using the provided Client ID. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------ | | `client_id` | string | Required | Client ID to label. | | `label` | string | Required | Parameter for Add Client Label | ### Input Example `{"client_id":"C.b279741549ca223d","label":"First_Label_1"}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | -------------------------------------------------- | | `response` | array | Output field: response | | `response.client_id` | string | Unique identifier | | `response.agent_information` | object | Output field: response.agent\_information | | `response.agent_information.version` | string | Output field: response.agent\_information.version | | `response.agent_information.name` | string | Name of the resource | | `response.agent_information.build_time` | string | Time value | | `response.agent_information.build_url` | string | URL endpoint for the request | | `response.os_info` | object | Output field: response.os\_info | | `response.os_info.system` | string | Output field: response.os\_info.system | | `response.os_info.hostname` | string | Name of the resource | | `response.os_info.release` | string | Output field: response.os\_info.release | | `response.os_info.machine` | string | Output field: response.os\_info.machine | | `response.os_info.fqdn` | string | Output field: response.os\_info.fqdn | | `response.os_info.mac_addresses` | array | Output field: response.os\_info.mac\_addresses | | `response.first_seen_at` | number | Output field: response.first\_seen\_at | | `response.last_seen_at` | number | Output field: response.last\_seen\_at | | `response.last_ip` | string | Output field: response.last\_ip | | `response.last_interrogate_flow_id` | string | Unique identifier | | `response.last_interrogate_artifact_name` | string | Name of the resource | | `response.labels` | array | Output field: response.labels | | `response.labels.file_name` | string | Name of the resource | | `response.labels.file` | string | Output field: response.labels.file | | `response.last_hunt_timestamp` | number | Output field: response.last\_hunt\_timestamp | | `response.last_event_table_version` | number | Output field: response.last\_event\_table\_version | | `response.last_label_timestamp` | number | Output field: response.last\_label\_timestamp | ### Output Example `{"response":[{"client_id":"C.b279741549ca223d","agent_information":{},"os_info":{},"first_seen_at":1724747862,"last_seen_at":1724774682386090,"last_ip":"127.0.0.1:41040","last_interrogate_flow_id":"F.CR6P0LGJFCVJC","last_interrogate_artifact_name":"Generic.Client.Info/BasicInformation","labels":[],"last_hunt_timestamp":0,"last_event_table_version":0,"last_label_timestamp":0,"label(client_id='C.b279741549ca223d', labels='First_Label_1', op='set')":{}}]}` ## Add Client Quarantine Initiates quarantine for a specified client in Velociraptor DFIR using the provided Client ID. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------- | | `client_id` | string | Required | Unique identifier | ### Input Example `{"client_id":"C.b279741549ca223d"}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------------------- | | `response` | array | Output field: response | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict()))` | object | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).flow_id` | string | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request` | object | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.creator` | string | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.user_data` | string | Response data | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.client_id` | string | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.flow_id` | string | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.urgent` | boolean | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.artifacts` | array | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.specs` | array | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.specs.artifact` | string | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.specs.max_batch_wait` | number | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.specs.max_batch_rows` | number | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.specs.max_batch_rows_buffer` | number | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.cpu_limit` | number | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.iops_limit` | number | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.progress_timeout` | number | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.timeout` | number | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.max_rows` | number | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.max_upload_bytes` | number | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.trace_freq_sec` | number | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.allow_custom_overrides` | boolean | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.log_batch_time` | number | Unique identifier | | `response.collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict())).request.compiled_collector_args` | array | Unique identifier | ### Output Example `{"response":[{"collect_client(client_id='C.b279741549ca223d', artifacts=['Windows.Remediation.Quarantine'], spec=dict(`Windows.Remediation.Quarantine`=dict()))":{}}]}` ## Get Client Flow Results Retrieve results for a specific flow from Velociraptor DFIR using the provided Client ID, Flow ID, and Artifact. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------- | | `client_id` | string | Required | Unique identifier | | `flow_id` | string | Required | Unique identifier | | `artifact` | string | Required | Parameter for Get Client Flow Results | ### Input Example `{"client_id":"C.b279741549ca223d","flow_id":"F.efsd245323453dfds","artifact":"Generic.Client.DiskSpace"}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | --------------------------------- | | `response` | array | Output field: response | | `response.Filesystem` | string | Output field: response.Filesystem | | `response.Size` | string | Output field: response.Size | | `response.Used` | number | Output field: response.Used | | `response.Avail` | string | Output field: response.Avail | | `response.Use%` | string | Output field: response.Use% | | `response.Mounted` | string | Output field: response.Mounted | ### Output Example `{"response":[{"Filesystem":"udev","Size":"16G","Used":0,"Avail":"16G","Use%":"0%","Mounted":"/dev"},{"Filesystem":"tmpfs","Size":"3.2G","Used":"1.6M","Avail":"3.2G","Use%":"1%","Mounted":"/run"},{"Filesystem":"/dev/sda5","Size":"688G","Used":"28G","Avail":"625G","Use%":"5%","Mounted":"/"}]}` ## Get Client Flows Retrieve all active and completed flows for a specified client in Velociraptor DFIR using the client's unique identifier. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------- | | `client_id` | string | Required | Unique identifier | ### Input Example `{"client_id":"C.b279741549ca223d"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------- | -------- | ------------------------------------------------------------- | | `response` | array | Output field: response | | `response.client_id` | string | Unique identifier | | `response.session_id` | string | Unique identifier | | `response.request` | object | Output field: response.request | | `response.request.creator` | string | Output field: response.request.creator | | `response.request.user_data` | string | Response data | | `response.request.client_id` | string | Unique identifier | | `response.request.flow_id` | string | Unique identifier | | `response.request.urgent` | boolean | Output field: response.request.urgent | | `response.request.artifacts` | array | Output field: response.request.artifacts | | `response.request.specs` | array | Output field: response.request.specs | | `response.request.specs.artifact` | string | Output field: response.request.specs.artifact | | `response.request.specs.parameters.env` | array | Parameters for the Get Client Flows action | | `response.request.specs.max_batch_wait` | number | Output field: response.request.specs.max\_batch\_wait | | `response.request.specs.max_batch_rows` | number | Output field: response.request.specs.max\_batch\_rows | | `response.request.specs.max_batch_rows_buffer` | number | Output field: response.request.specs.max\_batch\_rows\_buffer | | `response.request.cpu_limit` | number | Output field: response.request.cpu\_limit | | `response.request.iops_limit` | number | Output field: response.request.iops\_limit | | `response.request.progress_timeout` | number | Output field: response.request.progress\_timeout | | `response.request.timeout` | number | Output field: response.request.timeout | | `response.request.max_rows` | number | Output field: response.request.max\_rows | | `response.request.max_upload_bytes` | number | Output field: response.request.max\_upload\_bytes | | `response.request.trace_freq_sec` | number | Output field: response.request.trace\_freq\_sec | | `response.request.allow_custom_overrides` | boolean | Unique identifier | | `response.request.log_batch_time` | number | Time value | ### Output Example `{"response":[]}` ## Get Client ID Obtain the unique Client ID for a given host within Velociraptor DFIR, requiring the host's specific identifier. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------- | | `host` | string | Required | Parameter for Get Client ID | ### Input Example `{"host":"127.0.0.1"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ---------------------- | | `response` | string | Output field: response | ### Output Example `{"response":"C.b279741549ca223d"}` ## Get Client Label Retrieves a specific label for a client in Velociraptor DFIR using the given client ID. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------ | | `client_id` | string | Required | Unique identifier | | `label` | string | Required | Parameter for Get Client Label | ### Input Example `{"client_id":"C.b279741549ca223d","label":"First_Label_1"}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | -------------------------------------------------- | | `response` | array | Output field: response | | `response.client_id` | string | Unique identifier | | `response.agent_information` | object | Output field: response.agent\_information | | `response.agent_information.version` | string | Output field: response.agent\_information.version | | `response.agent_information.name` | string | Name of the resource | | `response.agent_information.build_time` | string | Time value | | `response.agent_information.build_url` | string | URL endpoint for the request | | `response.os_info` | object | Output field: response.os\_info | | `response.os_info.system` | string | Output field: response.os\_info.system | | `response.os_info.hostname` | string | Name of the resource | | `response.os_info.release` | string | Output field: response.os\_info.release | | `response.os_info.machine` | string | Output field: response.os\_info.machine | | `response.os_info.fqdn` | string | Output field: response.os\_info.fqdn | | `response.os_info.mac_addresses` | array | Output field: response.os\_info.mac\_addresses | | `response.first_seen_at` | number | Output field: response.first\_seen\_at | | `response.last_seen_at` | number | Output field: response.last\_seen\_at | | `response.last_ip` | string | Output field: response.last\_ip | | `response.last_interrogate_flow_id` | string | Unique identifier | | `response.last_interrogate_artifact_name` | string | Name of the resource | | `response.labels` | array | Output field: response.labels | | `response.last_hunt_timestamp` | number | Output field: response.last\_hunt\_timestamp | | `response.last_event_table_version` | number | Output field: response.last\_event\_table\_version | | `response.last_label_timestamp` | number | Output field: response.last\_label\_timestamp | | `response.label_check` | object | Output field: response.label\_check | | `response.label_check.ClientId` | string | Unique identifier | ### Output Example `{"response":[{"client_id":"C.b279741549ca223d","agent_information":{},"os_info":{},"first_seen_at":1724747862,"last_seen_at":1724774918462058,"last_ip":"127.0.0.1:41040","last_interrogate_flow_id":"F.CR6P0LGJFCVJC","last_interrogate_artifact_name":"Generic.Client.Info/BasicInformation","labels":[],"last_hunt_timestamp":0,"last_event_table_version":0,"last_label_timestamp":0,"label_check":{}}]}` ## Get Hunt Flows Retrieves all flows initiated by a specific hunt in Velociraptor DFIR using the unique Hunt ID. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------- | | `hunt_id` | string | Required | Unique identifier | ### Input Example `{"hunt_id":"H.CR6P61P95H6CG"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------- | -------- | ------------------------------------------------------- | | `response` | array | Output field: response | | `response.HuntId` | string | Unique identifier | | `response.ClientId` | string | Unique identifier | | `response.FlowId` | string | Unique identifier | | `response.Flow` | object | Output field: response.Flow | | `response.Flow.client_id` | string | Unique identifier | | `response.Flow.session_id` | string | Unique identifier | | `response.Flow.request` | object | Output field: response.Flow\.request | | `response.Flow.request.creator` | string | Output field: response.Flow\.request.creator | | `response.Flow.request.user_data` | string | Response data | | `response.Flow.request.client_id` | string | Unique identifier | | `response.Flow.request.flow_id` | string | Unique identifier | | `response.Flow.request.urgent` | boolean | Output field: response.Flow\.request.urgent | | `response.Flow.request.artifacts` | array | Output field: response.Flow\.request.artifacts | | `response.Flow.request.specs` | array | Output field: response.Flow\.request.specs | | `response.Flow.request.specs.file_name` | string | Name of the resource | | `response.Flow.request.specs.file` | string | Output field: response.Flow\.request.specs.file | | `response.Flow.request.cpu_limit` | number | Output field: response.Flow\.request.cpu\_limit | | `response.Flow.request.iops_limit` | number | Output field: response.Flow\.request.iops\_limit | | `response.Flow.request.progress_timeout` | number | Output field: response.Flow\.request.progress\_timeout | | `response.Flow.request.timeout` | number | Output field: response.Flow\.request.timeout | | `response.Flow.request.max_rows` | number | Output field: response.Flow\.request.max\_rows | | `response.Flow.request.max_upload_bytes` | number | Output field: response.Flow\.request.max\_upload\_bytes | | `response.Flow.request.trace_freq_sec` | number | Output field: response.Flow\.request.trace\_freq\_sec | | `response.Flow.request.allow_custom_overrides` | boolean | Unique identifier | ### Output Example `{"response":[]}` ## Get Hunt Results Retrieve results for a specific Velociraptor DFIR hunt using the Hunt ID and artifact parameters. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------ | | `hunt_id` | string | Required | Unique identifier | | `artifact` | string | Required | Parameter for Get Hunt Results | ### Input Example `{"hunt_id":"H.CR6P61P95H6CG","artifact":"Generic.Client.DiskSpace"}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | --------------------------------- | | `response` | array | Output field: response | | `response.Filesystem` | string | Output field: response.Filesystem | | `response.Size` | string | Output field: response.Size | | `response.Used` | number | Output field: response.Used | | `response.Avail` | string | Output field: response.Avail | | `response.Use%` | string | Output field: response.Use% | | `response.Mounted` | string | Output field: response.Mounted | | `response.FlowId` | string | Unique identifier | | `response.ClientId` | string | Unique identifier | | `response._OrgId` | string | Unique identifier | | `response.Fqdn` | string | Output field: response.Fqdn | ### Output Example `{"response":[]}` ## Remove Client Label Removes a specified label from a Velociraptor DFIR client using the provided Client ID and label. ### Endpoint - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------- | | `client_id` | string | Required | Unique identifier | | `label` | string | Required | Parameter for Remove Client Label | ### Input Example `{"client_id":"C.b279741549ca223d","label":"First_Label_1"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------------------------------------------------ | -------- | -------------------------------------------------- | | `response` | array | Output field: response | | `response.client_id` | string | Unique identifier | | `response.agent_information` | object | Output field: response.agent\_information | | `response.agent_information.version` | string | Output field: response.agent\_information.version | | `response.agent_information.name` | string | Name of the resource | | `response.agent_information.build_time` | string | Time value | | `response.agent_information.build_url` | string | URL endpoint for the request | | `response.os_info` | object | Output field: response.os\_info | | `response.os_info.system` | string | Output field: response.os\_info.system | | `response.os_info.hostname` | string | Name of the resource | | `response.os_info.release` | string | Output field: response.os\_info.release | | `response.os_info.machine` | string | Output field: response.os\_info.machine | | `response.os_info.fqdn` | string | Output field: response.os\_info.fqdn | | `response.os_info.mac_addresses` | array | Output field: response.os\_info.mac\_addresses | | `response.first_seen_at` | number | Output field: response.first\_seen\_at | | `response.last_seen_at` | number | Output field: response.last\_seen\_at | | `response.last_ip` | string | Output field: response.last\_ip | | `response.last_interrogate_flow_id` | string | Unique identifier | | `response.last_interrogate_artifact_name` | string | Name of the resource | | `response.labels` | array | Output field: response.labels | | `response.last_hunt_timestamp` | number | Output field: response.last\_hunt\_timestamp | | `response.last_event_table_version` | number | Output field: response.last\_event\_table\_version | | `response.last_label_timestamp` | number | Output field: response.last\_label\_timestamp | | `response.label(client_id='C.b279741549ca223d', labels=['First_Label_2'], op='remove')` | object | Unique identifier | | `response.label(client_id='C.b279741549ca223d', labels=['First_Label_2'], op='remove').ClientId` | string | Unique identifier | ### Output Example `{"response":[{"client_id":"C.b279741549ca223d","agent_information":{},"os_info":{},"first_seen_at":1724747862,"last_seen_at":1724779073002068,"last_ip":"127.0.0.1:41040","last_interrogate_flow_id":"F.CR7022D3L4CHO","last_interrogate_artifact_name":"Generic.Client.Info/BasicInformation","labels":[],"last_hunt_timestamp":0,"last_event_table_version":0,"last_label_timestamp":0,"label(client_id='C.b279741549ca223d', labels=['First_Label_2'], op='remove')":{}}]}` ## Remove Client Quarantine Removes a client from quarantine in Velociraptor DFIR by utilizing the specified Client ID. ### Endpoint - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------- | | `client_id` | string | Required | Unique identifier | ### Input Example `{"client_id":"C.b279741549ca223d"}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------------------- | | `response` | array | Output field: response | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y")))` | object | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).flow_id` | string | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request` | object | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.creator` | string | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.user_data` | string | Response data | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.client_id` | string | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.flow_id` | string | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.urgent` | boolean | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.artifacts` | array | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.specs` | array | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.specs.artifact` | string | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.specs.max_batch_wait` | number | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.specs.max_batch_rows` | number | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.specs.max_batch_rows_buffer` | number | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.cpu_limit` | number | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.iops_limit` | number | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.progress_timeout` | number | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.timeout` | number | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.max_rows` | number | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.max_upload_bytes` | number | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.trace_freq_sec` | number | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.allow_custom_overrides` | boolean | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.log_batch_time` | number | Unique identifier | | `response.collect_client(client_id="C.b279741549ca223d", artifacts=["Windows.Remediation.Quarantine"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`="Y"))).request.compiled_collector_args` | array | Unique identifier | ### Output Example `{"response":[{"collect_client(client_id=\"C.b279741549ca223d\", artifacts=[\"Windows.Remediation.Quarantine\"], spec=dict(`Windows.Remediation.Quarantine`=dict(`RemovePolicy`=\"Y\")))":{}}]}` ## Search Filename Initiates a search for a specific file by name and path across endpoints using Velociraptor DFIR. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------- | | `file_name` | string | Required | Name of the resource | | `file_path` | string | Required | Parameter for Search Filename | ### Input Example `{"file_name":"file.txt","file_path":"/users/downloads/text.txt"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ---------------------- | | `response` | array | Output field: response | ### Output Example `{"response":[]}` ## Search Hash Initiate a hunt for a specific file hash with Velociraptor DFIR to detect potential security incidents. Requires a file hash as input. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------- | | `file_hash` | string | Required | Parameter for Search Hash | ### Input Example `{"file_hash":"advgwertreretewewrtth234werqwae2345qw"}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ---------------------- | | `response` | array | Output field: response | ### Output Example `{"response":[]}` ## Search with Custom Query Executes a user-defined VQL query in Velociraptor DFIR to search across collected data, with 'query' as a required input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------- | | `query` | string | Required | Parameter for Search with Custom Query | ### Input Example `{"query":"SELECT * info()"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ------------------------------------------- | | `response` | array | Output field: response | | `response.Hostname` | string | Name of the resource | | `response.Uptime` | number | Time value | | `response.BootTime` | number | Time value | | `response.Procs` | number | Output field: response.Procs | | `response.OS` | string | Output field: response.OS | | `response.Platform` | string | Output field: response.Platform | | `response.PlatformFamily` | string | Output field: response.PlatformFamily | | `response.PlatformVersion` | string | Output field: response.PlatformVersion | | `response.KernelVersion` | string | Output field: response.KernelVersion | | `response.VirtualizationSystem` | string | Output field: response.VirtualizationSystem | | `response.VirtualizationRole` | string | Output field: response.VirtualizationRole | | `response.CompilerVersion` | string | Output field: response.CompilerVersion | | `response.HostID` | string | Unique identifier | | `response.Exe` | string | Output field: response.Exe | | `response.CWD` | string | Output field: response.CWD | | `response.IsAdmin` | boolean | Output field: response.IsAdmin | | `response.ClientStart` | string | Output field: response.ClientStart | | `response.Fqdn` | string | Output field: response.Fqdn | | `response.Architecture` | string | Output field: response.Architecture | ### Output Example `{"response":[{"Hostname":"SaiKumars-MacBook-Pro.local","Uptime":59860,"BootTime":1724596444,"Procs":704,"OS":"darwin","Platform":"darwin","PlatformFamily":"Standalone Workstation","PlatformVersion":"14.6.1","KernelVersion":"23.6.0","VirtualizationSystem":"","VirtualizationRole":"","CompilerVersion":"go1.20.6","HostID":"aa4d852d-2960-5a06-830a-670f1e88ce99","Exe":"/usr/local/bin/velociraptor","CWD":"/Users/saikumar.kondapalli/Downloads"}]}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |