MANAGED VELOCIRAPTOR
Forensic-grade hunts on every endpoint. Not a CrowdStrike replacement — a different job, done well.
Velociraptor's VQL engine, artifact library, and live remote acquisition — operated by senior IR engineers with on-call escalation. Pairs with your existing prevention layer (Defender, NGAV) so you get DFIR depth without paying for capability you already own.
What you get
A query engine on every endpoint, operated for you.
VQL across the fleet
Velociraptor Query Language is the product. SQL-shaped, runs on every endpoint, answers "every host that loaded this DLL in the last 24 hours" in minutes.
Live remote acquisition
Memory captures, registry, $MFT, USN journal, browser history, EVTX, prefetch — pulled live over the agent connection. No imaging, no shipping disks.
400+ artifacts, plus your own
Velocidex's built-in artifact library plus the community Exchange — and we author custom collectors against your specific stack during tuning.
Hunts, not just alerts
Server-orchestrated VQL fan-outs across thousands of endpoints. A single frontend handles ~15k clients before clustering; multi-frontend setups scale past 150k endpoints.
Multi-OS, single binary
Windows, macOS, and Linux — including eBPF on Linux and ETW on Windows. The same Go binary acts as agent or server depending on configuration.
Evidence-grade by default
Chain-of-custody hashing on every collection — evidence packages built to the standard SOC 2, ISO 27001, PCI DSS, and HIPAA auditors expect.
VQL at fleet scale
Past 15,000 endpoints, this stops being a server config and starts being an operations job.
A single Velociraptor frontend is regularly used to serve 10–15k endpoints. Past that point you are not configuring a server — you are running a distributed system. Mike Cohen's own scaling guidance is explicit: at high endpoint counts "we are starting to hit limitations with the single server model," and the documented horizontal-scaling path (Master + Minion frontends, gRPC replication, NFS/EFS distributed storage) is "currently considered experimental" with a per-frontend cap that still lands around 10k.
What changes architecturally past 100k endpoints is not the agent — the agent is the same Go binary. What changes is everything around it. TLS termination becomes CPU-bound on the frontends. The NFS/EFS storage hop adds 40–60 ms per read/write per request. A single hunt across 10k hosts can collect 5 TB of artifact data before anyone has read a line of it. Scheduled-hunt fan-out, content packaging, frontend autoscaling, storage-tier lifecycle, and analyst-query rate-limiting are now load-bearing — and none of them are in the documentation.
We operate that layer. The customer keeps Velociraptor, the open-source core, and every artifact ever collected. We keep the frontends healthy, the storage sized, the hunt queue moving, and the analyst experience fast.
VQL operations
The Exchange is the start, not the deliverable.
The built-in artifact library and the community Exchange cover the well-trodden cases — Sysmon parsing, Linux persistence checks, browser history, $MFT, USN, prefetch, EVTX, Defender quarantine. They will not catch what is novel in your environment. Custom artifact authoring is where the operation earns its keep.
What that actually means: VQL queries written against your specific log shapes, your internal CA chain, your build-bot fingerprints, your service-account naming conventions, your bespoke endpoint-management agent. Active query cancellation and per-query timeouts are first-class in VQL precisely so a misjudged hunt does not melt your endpoints — Cohen's design call, documented and worth respecting. Scheduled hunts get version-controlled. Content is packaged into named bundles, reviewed before fan-out, rolled back when a hunt is too noisy.
The artifact catalog we maintain for an established customer is roughly 60% Exchange, 30% bespoke-to-them, 10% live during an active investigation. The 30% is the moat. It is also the part that decays without an engineer reading new Sigma rules, new ATR releases, and new vendor advisories every week.
DFIR operating model
What 24×7 actually looks like when you run it for someone else.
Senior IR engineers should be on novel-threat research, not on shift. The operating model we run is the one Netflix's Alex Maestretti described in 2018: every triggered rule should fire automation before it fires an alert to a human; the person with the best understanding of a system is its owner, and they get pulled in last, after the automation has already gathered evidence. Velociraptor is a comfortable fit for that model — VQL plus server-side hunt orchestration plus active response is the on-endpoint primitive that "fires automation before a human" gets to the point of caring.
Concretely, for the customer that means: a documented escalation runbook per artifact class; a tier-1 rotation that triages hits against that runbook; a tier-2 IR-grade engineer on call for the cases that survive triage; weekly hunt-rollup notes that name the false-positive sources we suppressed and why. Quarterly purple-team. Monthly posture report that admits which controls drifted.
The reason this matters for a security team that already runs IR internally: the on-call rotation is the part you cannot outsource credibly without a hand-back. Our model is to operate the rotation, document the runbook against your environment, and hand both back at the end of the engagement if you want them. No proprietary content. No hostage data. The runbook lives in your repo.
Velociraptor vs CrowdStrike / SentinelOne
Different tools. Different jobs. Be honest about which you need.
The most common scoping mistake we see is treating Velociraptor as a 1:1 swap for a commercial EDR. It isn't. Here's the dollar-honest comparison.
Velociraptor (managed)
- VQL hunts across the fleet in minutes
- Live memory + disk + registry acquisition
- Evidence-grade chain-of-custody by default
- ~400 built-in artifacts + community Exchange[5]
- Open source — you keep the stack if we part ways
- No real-time blocking. Not a prevention agent.
CrowdStrike Falcon Insight XDR
- Real-time ML-driven prevention and process kill
- Vendor-curated detection content (large library)
- Falcon Enterprise list ~$184.99/endpoint/yr[6]
- Falcon Complete MDR adds 24/7 vendor SOC (quote-only)[6]
- Closed source, vendor lock-in
- DFIR depth available, but premium-tier gated
SentinelOne Singularity
- Real-time autonomous response, AI assistant
- Singularity Complete list ~$179.99/endpoint/yr[7]
- 14-day data retention on Complete tier[7]
- Vigilance/MDR sold separately
- Closed source, vendor lock-in
The pattern that works: Velociraptor for IR + hunt, paired with whatever prevention layer you're keeping — most often Microsoft Defender for Endpoint P2 (already paid for in many M365 E3/E5 stacks at ~$5.20/user/month[8]) or a commercial NGAV. Don't sell yourself a swap that loses prevention coverage. For the line-by-line version, read our full Velociraptor vs CrowdStrike Falcon comparison.
Deployment + tuning
Four phases. Honest timeline.
Stand up
Server in your cloud or ours. Agent rolled out to a 10% canary. Baseline VQL queries against the canary. Two weeks.
Roll out
Fleet rollout, label hierarchy by asset class and criticality, default monitoring artifact set enabled. Two weeks.
Tune
Custom artifacts against your stack. False-positive triage baseline. Hunt cadence set. Four weeks.
Operate
Continuous hunts, IR-grade triage, quarterly purple-team. Monthly posture report. Senior engineer on call.
A single frontend handles ~15,000 concurrent clients before clustering becomes mandatory; multi-frontend setups scale to 150k+[4]. Server is fully supported on Linux only — no external database, state on the local filesystem (or EFS/Filestore for HA)[2].
ROI · 500 endpoints
What the math actually looks like.
Honest framing: this is not a 1:1 swap. We compare Velociraptor for IR + hunt + your existing prevention layer against an all-in commercial EDR bundle. Numbers are 2024–2025 list pricing, directional only — real procurement discounts 15–25% at 500+ endpoints[7].
| Stack (500 endpoints) | Annual list |
|---|---|
| Managed Velociraptor (ThinSky) — directional Quote-only across the industry; range based on managed-OSS DFIR comparables | $60,000 – $95,000 |
| + Microsoft Defender for Endpoint P2 — prevention pair 500 × $5.20/user/month × 12[8] | $31,200 |
| Combined: Velociraptor + Defender | ≈ $91,200 – $126,200 |
| CrowdStrike Falcon Enterprise (no MDR bundled) 500 × $184.99 list[6] | $92,495 |
| SentinelOne Singularity Complete (Vigilance MDR separate) 500 × $179.99 list[7] | $89,995 |
| CrowdStrike Falcon Complete MDR — directional Quote-only; typically 1.5–2× Enterprise list[6] [uncertain] | $140,000 – $185,000 |
Honest read. Velociraptor + Defender lands competitive with Falcon Enterprise on list price and includes DFIR depth Falcon Enterprise doesn't. The real crossover is against Falcon Complete MDR — that bundle is 30–60% more expensive at directional list, and the savings increase if Defender entitlements are already paid for through M365.
One note on scale. The 500-endpoint math above is the buyer most of this page is written for. If your fleet is materially larger — past 15,000 endpoints is where the architecture changes, past 100,000 is where the operating model is the entire game — the conversation is different. The pricing is not a multiple of 500-endpoint pricing, the deployment is not the four-phase walkthrough above, and the value of a managed offering is much more about operating the multi-frontend topology day-to-day than about deploying it once. If that is the conversation, the scoping call is the same — book the same form — and we will skip the 500-endpoint walkthrough.
Counterpoints
Where Velociraptor is the wrong tool. Read this first.
Four real limits, not the marketing-page version.
It is not a prevention agent. A guest post on Velociraptor's own blog states it plainly: "while detection is not the most typical use-case of Velociraptor, it can be used for that." Translation: it is a DFIR and hunt platform, not an inline AV or NGAV. Keep your preventative EDR. The pattern that works is Velociraptor for hunt + IR alongside Microsoft Defender, CrowdStrike Falcon, or whatever you are already running for real-time blocking.
It is not stealthy and it is not exempt from AV. Independent research from SEC Consult notes the same thing: "Velociraptor is not designed to be stealthy. It is also not excluded by default from AV / EDR scrutiny." The agent is overt — a binary on disk, a config file, local admin to start. That is fine for a sanctioned IR tool. It is not fine if your threat model assumes the responder must hide from the host's own EDR.
Active response is host-firewall quarantine, not kernel-level kill. Pen Test Partners' DFIR write-up puts it cleanly: Velociraptor's "Host Quarantine" alters local firewall rules to deny all connections save the agent's own server channel — and "there are caveats and limitations to this capability." If your response runbook requires killing a process tree, rolling back ransomware encryption, or unhooking a kernel rootkit, your commercial EDR does that, not Velociraptor.
No native mobile or VR-OS agent. The docs document Windows, macOS, and Linux. No iOS, no Android, no Quest / Reality Labs device support. If your fleet includes endpoints we cannot reach, we are explicit about which classes are out of scope at the start of an engagement.
FAQ
The questions a CISO actually asks.
Is Velociraptor a replacement for CrowdStrike or SentinelOne?
Honestly — no, not 1:1. Velociraptor doesn't block ransomware mid-execution. It's a forensic query engine on every endpoint, not a real-time prevention agent. The pattern that works is Velociraptor for hunt and IR, paired with Microsoft Defender (already paid for in most M365 E3/E5 stacks) or a commercial NGAV for prevention. If you currently run only signature AV and no EDR, Velociraptor alone is a downgrade on prevention.
If we already run osquery, what does Velociraptor add?
Server, GUI, hunt orchestration, and forensic acquisition — the parts of an endpoint-query operation that osquery deliberately left out. Mike Cohen has written this directly: "OSQuery has been around for a while now, and was actually the initial inspiration for Velociraptor… [osquery] does not provide a server, nor does it provide a GUI." Velociraptor ships all of that, plus live memory and disk acquisition, plus an osquery-compat bridge for the queries you do not want to rewrite yet. In a benchmark Cohen ran himself, the VQL example returned 3,384 rows in under a second; the equivalent osquery query took over six. That gap matters most when you are running a hunt across a fleet large enough that osquery's per-host execution model starts adding up. The migration story is incremental: keep your osquery agents where they are, run Velociraptor in parallel for the IR / hunt / acquisition workload, port queries to VQL on the schedule your team can sustain.
Have you run Velociraptor alongside a commercial EDR? How does that actually work?
Yes — and it is the deployment we recommend over a swap. The pattern is documented by other practitioners too: Hexastrike Cybersecurity published a 2025 case study of using "CrowdStrike Falcon in combination with Velociraptor to streamline our incident response processes," with Falcon's real-time response feature kicking off Velociraptor offline collection on demand and SOAR automating the deployment. The one operational gotcha worth flagging from their experience: a 4 GB forensic artifact can take a long time to upload through your EDR's response channel — we route large artifact transfers directly to object storage in your cloud rather than back through the EDR. With Microsoft Defender for Endpoint the same pattern works using Live Response and a managed package. Either way, the prevention agent keeps doing what it is good at and Velociraptor does the deep-collection work where the commercial product's depth ends.
Who maintains the project?
Velocidex / Rapid7. Rapid7 acquired Velociraptor from Velocidex in 2021. The original founder, Mike Cohen, still leads it. The project remains open source under standard FOSS licensing. Releases ship on a regular cadence — 60+ tagged releases, current 0.76 line as of early 2026.
How long until it's tuned and useful?
The agent rolls out in days. The useful hunt library — the one that catches real things in your environment without burying analysts in noise — is a 60–90 day curation project. The shape of that curation is roughly 60% Exchange and built-in artifacts tuned for your stack, 30% bespoke VQL written against your specific telemetry shapes (custom log formats, internal service-account naming, the build agents your CI uses), 10% live-during-investigation content authored against a real incident. The 30% is what dies if it is not maintained. New Sigma rules, new advisories, new threat-actor TTPs come out every week — and they have to land in your artifact catalog within days, not quarters, or the hunt library decays into noise. The recurring engineering load is the part the managed delivery is actually for. Anyone telling you it's faster than 60–90 days is selling you the binary, not the operation.
What about 24/7 SOC coverage?
That's why this is a managed service. Velociraptor itself is not an MDR. We staff the on-call rotation, triage artifact hits and behavioural alerts on a documented escalation runbook, and engage IR-grade collection when something is real. Below 1,000 endpoints, internal 24/7 staffing rarely pencils out — managed delivery is the answer.
Where does data live and who owns it?
Either in your cloud (most common — Velociraptor server on a VM in your AWS/GCP/Azure tenant) or in ours with mTLS-pinned agents. In both cases, you keep a copy of every collected artifact. If we part ways, you keep the stack — no proprietary formats, no hostage data.
A note on what this page is not. We do not claim to be the Velociraptor experts. The experts are the people in the Velocidex GitHub history. We are the operators. The senior practitioners on this team have run multi-frontend deployments under the kind of load where the docs say "currently considered experimental," and we have written the runbooks that get filed afterward. If you are deciding whether to run that operation in-house or hand it off, the scoping call is 30 minutes, the engineer who joins it has been on call this quarter, and they will tell you if the answer is "do it in-house" — that conversation has happened.
Map the gap before the renewal.
30 minutes with a senior IR engineer. We'll look at your current EDR posture, where Velociraptor fits, and where it doesn't. No pitch deck.
Book a DFIR scoping call →