gdataadvancedanalytics/velociraptor

Velociraptor is an endpoint visibility and collection tool that uses VQL queries to gather host-based state information. It's designed for digital forensics and incident response professionals who need to collect and analyze data from endpoints across Windows, Linux, and macOS systems. The tool offers both local triage capabilities and enterprise-wide deployment options, with a built-in GUI for ease of use.