Large-Scale DFIR Hunt with Velociraptor (Multi-Endpoint / Active Breach)
Scaled artifact collection, anomaly detection, and DFIR triage across dozens to thousands of endpoints with a deployed Velociraptor agent, using a wave-based hunt architecture (volatile → IOC-driven → deep triage).
Prepare
5 steps- Velociraptor server and agent readiness
Verify that the Velociraptor 0.76.x server is installed and up to date; that agents are deployed to endpoints via MSI/GPO; and that the server certificate is valid
- Certificate rotation (if needed)
Generate a new certificate using `velociraptor.exe --config server.config.yaml config rotate_key > newkey_server.config.yaml` followed by `velociraptor.exe --config newkey_server.config.yaml frontend -v`
- Zimmerman Tools and analysis environment
Update tools on the analysis workstation using `Get-ZimmermanTools.ps1 -NetVersion 6`; keep Timeline Explorer and Plaso/log2timeline ready
- Storage and export infrastructure
Pre-configure Elasticsearch or SIEM integration for large hunt outputs; determine the ELK address and index name for the `Elastic.Flows.Upload` artifact
- Escalation matrix
If affected endpoints number 1–3, redirect to the KAPE Playbook; if network access is unavailable, redirect to the Offline Collector Playbook; if domain compromise is suspected, run this playbook in parallel with the Identity Breach Playbook