jlt032/velociraptor

Velociraptor is an endpoint visibility and collection tool that uses The Velociraptor Query Language (VQL) to gather host-based state information. It's designed for digital forensics, incident response, and security professionals who need to collect and analyze data from endpoints across Windows, Linux, and macOS platforms. The tool offers both local and enterprise deployment options, with a built-in GUI for easy use and extensive artifact support for common investigative tasks.