MANAGED VELOCIRAPTOR
Forensic-grade hunts on every endpoint. Not a CrowdStrike replacement — a different job, done well.
Velociraptor's VQL engine, artifact library, and live remote acquisition — operated 24/7 by senior IR engineers. Pairs with your existing prevention layer (Defender, NGAV) so you get DFIR depth without paying for capability you already own.
What you get
A query engine on every endpoint, operated for you.
VQL across the fleet
Velociraptor Query Language is the product. SQL-shaped, runs on every endpoint, answers "every host that loaded this DLL in the last 24 hours" in minutes.
Live remote acquisition
Memory captures, registry, $MFT, USN journal, browser history, EVTX, prefetch — pulled live over the agent connection. No imaging, no shipping disks.
400+ artifacts, plus your own
Velocidex's built-in artifact library plus the community Exchange — and we author custom collectors against your specific stack during tuning.
Hunts, not just alerts
Server-orchestrated VQL fan-outs across thousands of endpoints. A single frontend handles ~15k clients before clustering. Rapid7 cites 150k+ deployments.
Multi-OS, single binary
Windows, macOS, and Linux — including eBPF on Linux and ETW on Windows. The same Go binary acts as agent or server depending on configuration.
Evidence-grade by default
Chain-of-custody hashing on every collection. SOC 2, ISO 27001, PCI DSS, and HIPAA auditors accept Velociraptor packages — we've packaged them for all four.
Velociraptor vs CrowdStrike / SentinelOne
Different tools. Different jobs. Be honest about which you need.
The most common scoping mistake we see is treating Velociraptor as a 1:1 swap for a commercial EDR. It isn't. Here's the dollar-honest comparison.
Velociraptor (managed)
- VQL hunts across the fleet in minutes
- Live memory + disk + registry acquisition
- Evidence-grade chain-of-custody by default
- ~400 built-in artifacts + community Exchange[5]
- Open source — you keep the stack if we part ways
- No real-time blocking. Not a prevention agent.
CrowdStrike Falcon Insight XDR
The pattern that works: Velociraptor for IR + hunt, paired with whatever prevention layer you're keeping — most often Microsoft Defender for Endpoint P2 (already paid for in many M365 E3/E5 stacks at ~$5.20/user/month[8]) or a commercial NGAV. Don't sell yourself a swap that loses prevention coverage.
Deployment + tuning
Four phases. Honest timeline.
Stand up
Server in your cloud or ours. Agent rolled out to a 10% canary. Baseline VQL queries against the canary. Two weeks.
Roll out
Fleet rollout, label hierarchy by asset class and criticality, default monitoring artifact set enabled. Two weeks.
Tune
Custom artifacts against your stack. False-positive triage baseline. Hunt cadence set. Four weeks.
Operate
Continuous hunts, IR-grade triage, quarterly purple-team. Monthly posture report. Senior engineer on call.
A single frontend handles ~15,000 concurrent clients before clustering becomes mandatory; multi-frontend setups scale to 150k+[4]. Server is fully supported on Linux only — no external database, state on the local filesystem (or EFS/Filestore for HA)[2].
ROI · 500 endpoints
What the math actually looks like.
Honest framing: this is not a 1:1 swap. We compare Velociraptor for IR + hunt + your existing prevention layer against an all-in commercial EDR bundle. Numbers are 2024–2025 list pricing, directional only — real procurement discounts 15–25% at 500+ endpoints[7].
| Stack (500 endpoints) | Annual list |
|---|---|
| Managed Velociraptor (ThinSky) — directional Quote-only across the industry; range based on managed-OSS DFIR comparables | $60,000 – $95,000 |
| + Microsoft Defender for Endpoint P2 — prevention pair 500 × $5.20/user/month × 12[8] | $31,200 |
| Combined: Velociraptor + Defender | ≈ $91,200 – $126,200 |
| CrowdStrike Falcon Enterprise (no MDR bundled) 500 × $184.99 list[6] | $92,495 |
| SentinelOne Singularity Complete (Vigilance MDR separate) 500 × $179.99 list[7] | $89,995 |
| CrowdStrike Falcon Complete MDR — directional Quote-only; typically 1.5–2× Enterprise list[6] [uncertain] | $140,000 – $185,000 |
Honest read. Velociraptor + Defender lands competitive with Falcon Enterprise on list price and includes DFIR depth Falcon Enterprise doesn't. The real crossover is against Falcon Complete MDR — that bundle is 30–60% more expensive at directional list, and the savings increase if Defender entitlements are already paid for through M365.
FAQ
The questions a CISO actually asks.
Is Velociraptor a replacement for CrowdStrike or SentinelOne?
Honestly — no, not 1:1. Velociraptor doesn't block ransomware mid-execution. It's a forensic query engine on every endpoint, not a real-time prevention agent. The pattern that works is Velociraptor for hunt and IR, paired with Microsoft Defender (already paid for in most M365 E3/E5 stacks) or a commercial NGAV for prevention. If you currently run only signature AV and no EDR, Velociraptor alone is a downgrade on prevention.
Who maintains the project?
Velocidex / Rapid7. Rapid7 acquired Velociraptor from Velocidex in 2021. The original founder, Mike Cohen, still leads it. The project remains open source under standard FOSS licensing. Releases ship on a regular cadence — 60+ tagged releases, current 0.76 line as of early 2026.
How long until it's tuned and useful?
The agent rolls out in days. The useful hunt library — the one that catches real things in your environment without burying analysts in noise — is a 60–90 day curation project. Anyone telling you it's faster than that is selling you the binary, not the operation.
What about 24/7 SOC coverage?
That's why this is a managed service. Velociraptor itself is not an MDR. We staff the on-call rotation, triage artifact hits and behavioural alerts on a documented escalation runbook, and engage IR-grade collection when something is real. Below 1,000 endpoints, internal 24/7 staffing rarely pencils out — managed delivery is the answer.
Where does data live and who owns it?
Either in your cloud (most common — Velociraptor server on a VM in your AWS/GCP/Azure tenant) or in ours with mTLS-pinned agents. In both cases, you keep a copy of every collected artifact. If we part ways, you keep the stack — no proprietary formats, no hostage data.
Map the gap before the renewal.
30 minutes with a senior IR engineer. We'll look at your current EDR posture, where Velociraptor fits, and where it doesn't. No pitch deck.
Book a DFIR scoping call →