Endpoint visibility and collection tooling with artifact and query workflows, including offline collection options. Exact operating-system support and behavior depend on artifact definitions and the selected release.
What did the collection query ask the endpoint to produce?
A collected row depends on the artifact definition, parameters, permissions, client state, and collection timing. It is not a complete physical image merely because it arrived in an evidence bundle. Distinguish source file acquisition from a live query result and from a server-side transformation.
Preserve a reproducible analysis
Record server/client versions, artifact-definition version or digest, parameters, collection times, errors, client identity, and the output bundle. Preserve original collection logs and any downloaded files with their own hashes. Explain live changes caused by the collection where known.
A useful validation question
Test the exact artifact and target conditions on a controlled endpoint. Include an inaccessible path or unsupported condition to see how omissions are reported. Compare selected results with an independent native source rather than treating a successful collection status as completeness.
Project and applicability record
- Purpose
- Endpoint collection and response
- Input
- Artifact definitions, query results and collected endpoint data
- Analysis platform
- Cross-platform; verify requirements for the selected release and feature.
- License / cost
- Upstream license terms require direct inspection; the repository API labels them Other. Do not infer unrestricted redistribution from public availability. Upstream source and license files
- Maintenance observation
- Repository not archived; recorded upstream push 2026-10-22T15:38:10Z. Activity does not guarantee support.
- Exact version tested here
- None. Documentation and repository metadata checks only.
Original sources and next steps
- Official Velociraptor documentation
Producer documentation; select the release relevant to your analysis.
- Velocidex/velociraptor
Original upstream source repository.
- Release history and changes
Upstream release availability is separate from local validation.
- Plan a bounded validation study
Check the feature and input format that support the conclusion.
- Verify the input and derivatives
Keep analysis outputs traceable to preserved sources.