| 1 | --- |
| 2 | title: Artifacts (Velociraptor) |
| 3 | description: Run Velociraptor artifacts from CoPilot to collect DFIR evidence from endpoints and review results. |
| 4 | --- |
| 5 | |
| 6 | # Artifacts (Velociraptor) |
| 7 | |
| 8 | **Menu:** Artifacts |
| 9 | |
| 10 | CoPilot’s Artifacts feature integrates with **Velociraptor** (DFIR / threat hunting) to run **Velociraptor Artifacts** via the Velociraptor API and pull results back into CoPilot. |
| 11 | |
| 12 |  |
| 13 | |
| 14 | --- |
| 15 | |
| 16 | ## What is Velociraptor? |
| 17 | |
| 18 | Velociraptor is an advanced **digital forensics and incident response (DFIR)** platform that gives you endpoint visibility and targeted evidence collection at scale. |
| 19 | |
| 20 | A few key concepts (Velociraptor terminology): |
| 21 | - **VQL**: Velociraptor Query Language (how evidence is collected) |
| 22 | - **Artifacts**: packaged collections (YAML) of one or more VQL queries + parameters + preconditions |
| 23 | |
| 24 | Velociraptor artifacts are designed to be reusable and safe to run across fleets using **preconditions** (if a precondition fails, that source is skipped). |
| 25 | |
| 26 | Reference: |
| 27 | - Velociraptor docs: https://docs.velociraptor.app |
| 28 | - Artifacts concept: https://docs.velociraptor.app/docs/vql/artifacts/ |
| 29 | |
| 30 | --- |
| 31 | |
| 32 | ## What you can do in CoPilot |
| 33 | |
| 34 | From an operator perspective, CoPilot lets you: |
| 35 | |
| 36 | - **Select an endpoint** (agent/hostname / Velociraptor ID) |
| 37 | - **Choose an artifact** to run (collection) |
| 38 | - **Provide parameters** (when the artifact requires them) |
| 39 | - **Run the artifact** and review the returned results |
| 40 | |
| 41 | --- |
| 42 | |
| 43 | ## Before you start (required identifiers) |
| 44 | |
| 45 | CoPilot needs a way to target the correct Velociraptor client. |
| 46 | |
| 47 | In the UI you’ll typically see fields like: |
| 48 | - **Hostname** (optional) |
| 49 | - **Velociraptor ID** (the Velociraptor client id) |
| 50 | |
| 51 | If the endpoint doesn’t have a valid Velociraptor ID mapped, collections won’t run against that host. |
| 52 | |
| 53 | --- |
| 54 | |
| 55 | ## Step 1 — Run an artifact collection |
| 56 | |
| 57 |  |
| 58 | |
| 59 | 1) Open **Artifacts** |
| 60 | 2) Select (or enter) the target endpoint (Hostname / **Velociraptor ID**) |
| 61 | 3) Choose the artifact you want to run |
| 62 | 4) Fill in any required parameters |
| 63 | 5) Start the collection |
| 64 | |
| 65 | Operator tips: |
| 66 | - Prefer artifacts that are **targeted** (high-signal) rather than “collect everything.” |
| 67 | - If an artifact supports parameters (time range, path, user, regex), start narrow. |
| 68 | |
| 69 | --- |
| 70 | |
| 71 | ## Step 2 — Review results |
| 72 | |
| 73 |  |
| 74 | |
| 75 | After the artifact finishes, review: |
| 76 | - returned rows/tables (the “answers” from VQL) |
| 77 | - any files collected (if the artifact uploads files) |
| 78 | - errors or skipped preconditions (common when an artifact is OS-specific) |
| 79 | |
| 80 | What good looks like: |
| 81 | - You can answer: *what evidence did we collect, from which host, and what does it mean for the alert/case?* |
| 82 | |
| 83 | --- |
| 84 | |
| 85 | ## Step 3 — Use artifacts from an alert (fast triage) |
| 86 | |
| 87 | CoPilot also surfaces artifact collection entry points from **Alerts → Assets**. |
| 88 | |
| 89 | Practical workflow: |
| 90 | 1) Open an alert |
| 91 | 2) Go to the impacted asset |
| 92 | 3) Run a targeted artifact (process listing, persistence checks, event logs, etc.) |
| 93 | 4) Bring the result back into the case via notes/comments |
| 94 | |
| 95 | --- |
| 96 | |
| 97 | ## Step 4 — (Optional) Artifact recommendations |
| 98 | |
| 99 | Some CoPilot views may provide artifact recommendations to speed up response. |
| 100 | |
| 101 |  |
| 102 | |
| 103 | --- |
| 104 | |
| 105 | ## Operator artifact starter pack (recommended) |
| 106 | |
| 107 | Use this section as a default playbook when you’re in triage and need to move fast. |
| 108 | |
| 109 | ### 1) Identify the host (what system is this?) |
| 110 | |
| 111 | Run: |
| 112 | - `Generic.Client.Info` (basic host facts) |
| 113 | - `Generic.Client.DiskSpace` (quick disk pressure check) |
| 114 | |
| 115 | ### 2) Process triage (what’s running right now?) |
| 116 | |
| 117 | Run: |
| 118 | - Windows: `Windows.System.Pslist` |
| 119 | - Linux: `Linux.Sys.Pslist` |
| 120 | |
| 121 | ### 3) Network triage (is it talking to something?) |
| 122 | |
| 123 | Run: |
| 124 | - Windows: `Windows.Network.Netstat` |
| 125 | - Linux: `Linux.Network.Netstat` |
| 126 | |
| 127 | ### 4) Persistence triage (will it come back?) |
| 128 | |
| 129 | Run: |
| 130 | - `Windows.Sys.StartupItems` |
| 131 | |
| 132 | ### 5) Find a file fast (where is this binary/script across the host?) |
| 133 | |
| 134 | Run: |
| 135 | - `Windows.Search.FileFinder` |
| 136 | |
| 137 | ### 6) Execution evidence (what ran recently?) |
| 138 | |
| 139 | Run: |
| 140 | - `Windows.Forensics.Prefetch` |
| 141 | - `Windows.System.Amcache` (alternate view of execution evidence) |
| 142 | |
| 143 | ### 7) Log triage (high-signal Windows event hunting) |
| 144 | |
| 145 | Run: |
| 146 | - `Windows.EventLogs.EvtxHunter` |
| 147 | |
| 148 | ### 8) YARA hunting (when you have an IOC or suspect binary) |
| 149 | |
| 150 | Run: |
| 151 | - Windows: `Windows.Detection.Yara.Process` (fast, memory/process focused) |
| 152 | - Windows: `Windows.Detection.Yara.NTFS` (disk scan) |
| 153 | - Linux: `Linux.Detection.Yara.Process` |
| 154 | |
| 155 | > Tip: Start with **Process**-scoped YARA first (fastest), then broaden to disk if needed. |
| 156 | |
| 157 | --- |
| 158 | |
| 159 | ## Common gotchas |
| 160 | |
| 161 | ### “The artifact didn’t run / no results returned” |
| 162 | Common causes: |
| 163 | - The endpoint doesn’t have a correct **Velociraptor ID** mapped. |
| 164 | - The artifact precondition skipped the collection (e.g., wrong OS). |
| 165 | - Velociraptor connectivity/API credentials are not configured correctly. |
| 166 | |
| 167 | ### “This collected too much data” |
| 168 | Use parameterized artifacts, tighten time windows, and prefer targeted artifacts. Velociraptor is designed to return high-value results rather than bulk collection. |