velociraptor-discuss

1–30 of 226

This is a mailing list to discuss the Velociraptor Forensic Suite. You can find the code on https://gitlab.com/velocidex/velociraptor

Our website can be reached at https://docs.velociraptor.app

0 selected

Orcun Tagtekin, Mike Cohen4

Jan 20

Server Maintenance Tips

The artifact that is triggered by the GUI's delete flow button is Server.Utils.DeleteFlow you

unread,

Server Maintenance Tips

The artifact that is triggered by the GUI's delete flow button is Server.Utils.DeleteFlow you

Jan 20

Fusao Tanida, Mike Cohen3

Jan 13

handling CSV parameter in VQL

Hi Mike. Thank you for detailed explanation with internal behaviors. My question was completely

unread,

handling CSV parameter in VQL

Hi Mike. Thank you for detailed explanation with internal behaviors. My question was completely

Jan 13

martinl...@gmail.com, Mike Cohen3

12/19/21

Query that no longer works

It seems I was wrong - the file_store() function does in fact sanitize the path properly and also

unread,

Query that no longer works

It seems I was wrong - the file_store() function does in fact sanitize the path properly and also

12/19/21

Orcun Tagtekin, Mike Cohen2

12/16/21

Duplicate client-ids on Golden Images

This was discussed here https://github.com/Velocidex/velociraptor/issues/1143 with a proposed

unread,

Duplicate client-ids on Golden Images

This was discussed here https://github.com/Velocidex/velociraptor/issues/1143 with a proposed

12/16/21

Orcun Tagtekin, Mike Cohen8

12/16/21

Github action binary still reports glibc issues on older Rhel and Centos

Thank you. On Tuesday, December 7, 2021 at 8:38:18 AM UTC-5 mi...@velocidex.com wrote: Just to let

unread,

Github action binary still reports glibc issues on older Rhel and Centos

Thank you. On Tuesday, December 7, 2021 at 8:38:18 AM UTC-5 mi...@velocidex.com wrote: Just to let

12/16/21

martinl...@gmail.com, Michael Cohen7

11/11/21

Error when using collect_client

I discovered that the VM had originally been used as a Velo server and is used as a client. So I

unread,

Error when using collect_client

I discovered that the VM had originally been used as a Velo server and is used as a client. So I

11/11/21

learning account, Mike Cohen2

10/26/21

How to automatic Extract File from Velociraptor to excel using Python

You can just use the python API to run any queries from python and get the json to do whatever you

unread,

How to automatic Extract File from Velociraptor to excel using Python

You can just use the python API to run any queries from python and get the json to do whatever you

10/26/21

Mario DeTore, Mike Cohen3

10/22/21

Easiest way to map fields in a single row to a dict?

Thanks Mike, your response got me pointed in the right direction. Here's what I came up with that

unread,

Easiest way to map fields in a single row to a dict?

Thanks Mike, your response got me pointed in the right direction. Here's what I came up with that

10/22/21

learning account, Mike Cohen2

10/21/21

When you run the query in a notebook you are actually running it on the server (which is probably

unread,

When you run the query in a notebook you are actually running it on the server (which is probably

10/21/21

Jan Jacobs, Mike Cohen3

9/29/21

Uploading all results from a specific result

Thanks Mike, as always :-) We have that clock running to automaticly schedule the check artifact each

unread,

Uploading all results from a specific result

Thanks Mike, as always :-) We have that clock running to automaticly schedule the check artifact each

9/29/21

Navaneetha sankar, … Eric Capuano5

9/21/21

Integration with Timesketch

Not sure if this helps, but Whitney and I did a talk at DFIR summit about this. https://www.youtube.

unread,

Integration with Timesketch

Not sure if this helps, but Whitney and I did a talk at DFIR summit about this. https://www.youtube.

9/21/21

Trevor Hubbard, … Michael Cohen4

9/21/21

server 2003 install error [not a valid win32 application]

thank you for the prompt response On Tuesday, September 21, 2021 at 2:05:15 PM UTC-7 mike_cohen wrote

unread,

server 2003 install error [not a valid win32 application]

thank you for the prompt response On Tuesday, September 21, 2021 at 2:05:15 PM UTC-7 mike_cohen wrote

9/21/21

9/20/21

Velociraptor Contributor Contest - Deadline is Monday

There's still time to submit your entry to the Velociraptor Contributor Contest. We'll be

unread,

Velociraptor Contributor Contest - Deadline is Monday

There's still time to submit your entry to the Velociraptor Contributor Contest. We'll be

9/20/21

learning account, Mike Cohen2

9/14/21

cannot showing windows app edge history

Is there any clues in the query log? On Monday, September 6, 2021 at 6:03:36 PM UTC+10 learning...@

unread,

cannot showing windows app edge history

Is there any clues in the query log? On Monday, September 6, 2021 at 6:03:36 PM UTC+10 learning...@

9/14/21

desmond ozurumba, Mike Cohen7

8/16/21

A red icon indicates that the host has not been seen for 24 hours

It looks like your clients are not properly installed - how have you deployed them? They need to

unread,

A red icon indicates that the host has not been seen for 24 hours

It looks like your clients are not properly installed - how have you deployed them? They need to

8/16/21

8/3/21

unable to add FQDN to script

My apologies! The above script works correct, what i failed to do was unload the artifact from the

unread,

unable to add FQDN to script

My apologies! The above script works correct, what i failed to do was unload the artifact from the

8/3/21

mariano kabakian2

7/27/21

cannot enrroll my client

Forget the qst. Was a firewall issue! Thanks anyway El martes, 27 de julio de 2021 a las 19:01:29 UTC

unread,

cannot enrroll my client

Forget the qst. Was a firewall issue! Thanks anyway El martes, 27 de julio de 2021 a las 19:01:29 UTC

7/27/21

Axel Andriot, Mike Cohen5

7/23/21

Problem with the CN of my own certificate (Wildcard Certificate)

Hello Mike, Thanks a lot for your help ! Everything works as i wanted, so i just did "

unread,

Problem with the CN of my own certificate (Wildcard Certificate)

Hello Mike, Thanks a lot for your help ! Everything works as i wanted, so i just did "

7/23/21

martinl...@gmail.com, Mike Cohen2

7/14/21

Problem getting flows using API

As you can see the artifacts_with_results contain two artifacts: artifacts_with_results': ['

unread,

Problem getting flows using API

As you can see the artifacts_with_results contain two artifacts: artifacts_with_results': ['

7/14/21

ali, Mike Cohen2

6/12/21

Velociraptor uses the write back file located in the config file to store it's private key and

unread,

Velociraptor uses the write back file located in the config file to store it's private key and

6/12/21

Trevor Hubbard, Mike Cohen3

6/7/21

server/client config generate from corporate-provided certificate ?

Got it working, thanks for the help. We decided to not go with our own GoDaddy-provided cert, as the

unread,

server/client config generate from corporate-provided certificate ?

Got it working, thanks for the help. We decided to not go with our own GoDaddy-provided cert, as the

6/7/21

Trevor Hubbard, Mike Cohen3

6/1/21

Server 2019 x64 - not showing in client list

that worked, thank you On Friday, May 28, 2021 at 6:05:52 PM UTC-4 Mike Cohen wrote: Can you search

unread,

Server 2019 x64 - not showing in client list

that worked, thank you On Friday, May 28, 2021 at 6:05:52 PM UTC-4 Mike Cohen wrote: Can you search

6/1/21

ali, Mike Cohen2

5/31/21

update on redhat/centos

Hi Ali, Usually you just create a new deb/rpm file with the same command as usual and just upgrade

unread,

update on redhat/centos

Hi Ali, Usually you just create a new deb/rpm file with the same command as usual and just upgrade

5/31/21

Mike Cohen, Arun R M2

5/31/21

Online trainings sessions

This URL is not working anymore. Could you please point us to somewhere we can atleast pay for the

unread,

Online trainings sessions

This URL is not working anymore. Could you please point us to somewhere we can atleast pay for the

5/31/21

martinl...@gmail.com

5/23/21

Hostname on AWS Linux instances

We are using Velociraptor with our AWS test network and have a module that queries the Velociraptor

unread,

Hostname on AWS Linux instances

We are using Velociraptor with our AWS test network and have a module that queries the Velociraptor

5/23/21

martinl...@gmail.com, Mike Cohen3

5/21/21

Strange issue with AWS instances.

Thanks Mike, I'll delete the writeback file when we fire up the instance and then it should

unread,

Strange issue with AWS instances.

Thanks Mike, I'll delete the writeback file when we fire up the instance and then it should

5/21/21

5/16/21

Add default shells in Host Information for FreeBSD

HI all, Another thing that I think it needs to be fixed is “Shell” option under Host information for

unread,

Add default shells in Host Information for FreeBSD

HI all, Another thing that I think it needs to be fixed is “Shell” option under Host information for

5/16/21

5/16/21

Testing Velociraptor under FreeBSD 13

Hi all, With the good news that velociraptor now supports FreeBSD I decided to give it a try. At this

unread,

Testing Velociraptor under FreeBSD 13

Hi all, With the good news that velociraptor now supports FreeBSD I decided to give it a try. At this

5/16/21

martinl...@gmail.com

5/12/21

Windows event artifacts

Hi Mike, I have the following artifact that I'm sure we had working before, but now I don't

unread,

Windows event artifacts

Hi Mike, I have the following artifact that I'm sure we had working before, but now I don't

5/12/21

mariano kabakian, … Wes Lambert5

5/10/21

Cannot enroll client to server

Mariano, You may want to try changing your server URL to be that of: https://192.168.232.15:8000/

unread,

Cannot enroll client to server

Mariano, You may want to try changing your server URL to be that of: https://192.168.232.15:8000/

5/10/21

Search

Clear search

Close search

Google apps

Main menu