Lion Cipher Lab
Hunt across your endpoints with Velociraptor and VQL
- SOC Analyst / Blue Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Endpoint visibility only becomes incident response when you can ask a hard question of many machines at once and get every answer back in one place. osquery is the lightweight, continuous, per-host lens; Velociraptor is the other half of the picture — a client/server DFIR platform where a server has agents (clients) enrolled to it, a huge library of forensic 'artifacts' packages the collection logic, and a Hunt runs the same artifact against a whole fleet in minutes. That is exactly the move a real responder makes: an indicator lands, and instead of logging into 500 boxes by hand, they push…
What you'll learn
- fleet-wide threat hunting
- running a Velociraptor test deployment
- understanding the client/server DFIR model
- writing VQL queries (SELECT ... FROM plugin() WHERE ...)
- using the Velociraptor notebook
- collecting built-in DFIR artifacts
- launching a hunt across enrolled clients
- reading collection and hunt results
- choosing Velociraptor vs osquery for a job
- treating a collection server as sensitive infrastructure
Steps in this lab
- What Velociraptor is, in one breath
- Velociraptor vs osquery — which lens, and when
- Get the binary — one static file, no install
- Bring it up: Instant Velociraptor in gui mode
- Speak VQL: your first queries in the notebook
- Collect an artifact, then hunt the fleet
- Know the edges: scope, and guard the server