Velociraptor

Velociraptor is a Digital Forensic and Incident Response (DFIR) tool that integrates with the Insight Platform as a component of the Insight Agent. You can use Velociraptor alongside InsightIDR to add DFIR capabilities to your investigative toolset, allowing a greater level of monitoring and swifter responses to issues.

On its own, you can use Velociraptor to continuously monitor endpoints for unusual or suspicious events. When integrated, you can send the event data that Velociraptor collects to InsightIDR. This integration provides you with a single place to detect on and investigate all of the event data in your environment.

Requirements

To access Velociraptor in InsightIDR, you'll need:

• An InsightIDR Ultimate, Managed Threat Complete Ultimate, or Threat Complete Ultimate license
• A deployed Insight Agent

User access control

To access Velociraptor, request that your Platform Administrator assign a custom role to your user account with either read-only or full use permissions to the Velociraptor toolset.

Create a custom role with Velociraptor access

Only a Platform Administrator has permission to create custom Platform roles.

To configure a custom role as a Platform Administrator:

1. From the Insight Platform, navigate to User Management and select Roles.
2. Click Create Role.
3. Enter a name and optional description for the new role.
4. In the Permissions table, select the Hosted Velociraptor feature, and then select the permission level.
5. After saving the new role, you can assign it to users or user groups as you would other existing roles.

Configure Velociraptor to integrate with InsightIDR

Before you can use InsightIDR to detect on data that Velociraptor collects, you need to configure Velociraptor to monitor clients, track processes, and send data.

Task 1: Set up client monitoring

Velociraptor’s client monitoring feature is a powerful supplement to InsightIDR's detection rules. With client monitoring, you can run continuous queries on each endpoint, retrieving only the events that match the query.

When you set up client monitoring in Velociraptor, you specify the query—also known as an artifact—to run and the endpoints to monitor.

When it's combined with InsightIDR's detection rules, client monitoring allows you to monitor threats and other notable activity in more endpoint data sources, at a greater level of detail. For example, you might use client monitoring to scan your endpoints for known vulnerabilities that have been recently disclosed, using artifacts from the open source Artifact Exchange.

To set up client monitoring:

• Refer to the open source Velociraptor documentation to learn how to set up client monitoring.

Task 2: Enable the process tracker

You can use a designated type of client monitoring to track the processes that occur on your endpoints.

Rapid7 recommends setting up Velociraptor's process tracker to gather details about parent and child processes in hunts and collections.

You can enable the process tracker on Windows endpoints only.

To enable the process tracker:

1. From the Insight Platform navigation menu, select Velociraptor. Velociraptor opens in a new tab.

Example processes

The process tracker collects Sysmon process data, which is typically more detailed than other types of process data.

Keep in mind that some processes might be missing Sysmon data if the process started before the artifact was deployed.

 
1
{
2
"Pid":"4300-1684320864"
3
"Ppid":"2632-1683687903"
4
"Name":"ir_agent.exe"
5
"StartTime":"2023-05-17T10:54:24.546Z"
6
"EndTime":"2023-05-17T10:54:29.732Z"
7
"Username":"NT AUTHORITY\SYSTEM"
8
"Exe":"C:\Program Files\Rapid7\Insight Agent\components\insight_agent\3.3.0.2\ir_agent.exe"
9
"CommandLine":""C:\Program Files\Rapid7\Insight Agent\
10
components\insight_agent\3.3.0.2\ir_agent.exe" "--multiproces..."
11
"CurrentDirectory":"C:\Program Files\Rapid7\Insight Agent\components\insight_agent\common\"
12
"FileVersion":"3.3.0.2"
13
"Description":"Rapid7 Insight Agent"
14
"Company":"Rapid7, LLC."
15
"Product":"Insight Agent"
16
"ParentImage":"C:\Program Files\Rapid7\Insight Agent\components\insight_agent\3.3.0.2\ir_agent.exe"
17
"ParentCommandLine":""C:\Program Files\Rapid7\Insight Agent\components\insight_agent\3.3.0.2\ir_agent.exe" "--multiproces..."
18
"TerminalSessionId":"0"
19
"IntegrityLevel":"System"
20
"Hashes":{
21
...
22
}
23
}

 
1
{
2
"Name":"ir_agent.exe"
3
"Username":
4
"NT AUTHORITY\SYSTEM""Exe":
5
"C:\Program Files\Rapid7\Insight Agent\components\insight_agent\3.3.0.2\ir_agent.exe"
6
"CommandLine":""C:\Program Files\Rapid7\Insight Agent\components\
7
insight_agent\3.3.0.2\ir_agent.exe" "--multiproces...""
8
StartTime":"2023-05-10T03:05:09.1065166Z"
9
"EndTime":"2023-05-17T14:13:44.263Z"
10
"Pid":"3340-1683687909"
11
"Ppid":"5012"
12
}

Task 3: Send Velociraptor data to InsightIDR

Once you've started collecting event data through client monitoring, you can send that data to InsightIDR to be detected on.

You send data to InsightIDR by specifying the word Alert in Velociraptor artifact names. Velociraptor sends only the event data retrieved from artifacts that have the word Alert in their name. For example, events from Alert.Windows.ETW.AMSI are sent to InsightIDR, but events from Windows.ETW.AMSI are not.

Refer to the open source Velociraptor documentation to learn how to manage artifacts.

Modify Velociraptor detection rules

Once you've configured Velociraptor to send data to InsightIDR, you can modify InsightIDR detection rules to best suit the needs of your environment.

Your InsightIDR Ultimate license provides access to built-in detection rules that monitor events retrieved from Velociraptor. For a complete list of these rules and their details, refer to the Detection Library.

To modify Velociraptor detection rules:

1. In InsightIDR, navigate to Detection Rules from the left menu.
2. On the Attacker Behavior Analytics tab, filter for Velociraptor Rules.
3. Modify the detection rules as needed by changing the Rule Action or Rule Priority, or by adding exceptions.

Velociraptor investigations

When an event occurs that meets the logic for a Velociraptor detection rule and the Rule Action is set to Creates Investigation, InsightIDR creates a new investigation. You can take action on Velociraptor investigations in the same ways that you would act on investigations created from other detection rules.

Velociraptor investigations also offer some additional features, including:

• The ability to inspect the evidence sent from Velociraptor directly in the investigation. When InsightIDR detects on an event that was sent from Velociraptor, the resulting investigation contains information about the associated Velociraptor artifact and the JSON-formatted event data.
• The ability to select View in Velociraptor, which opens Velociraptor to the endpoint and artifact event page associated with the investigation. Because Velociraptor displays events in a time-bound table, this view can contain additional events that might not be available in the investigation.

Use Velociraptor for DFIR

When integrated with the Insight Platform, you can access Velociraptor and its DFIR features using your Insight Platform login credentials. Read the open source Velociraptor documentation to learn more about using Velociraptor.

To navigate to Velociraptor from the Insight Platform:

1. Log in to the Insight Platform.
2. From the platform navigation menu, select Velociraptor. Velociraptor opens in a new tab.
3. If you have access to multiple organizations, you can select the organization that you want to view directly in Velociraptor.

To navigate to Velociraptor from an investigation:

1. In InsightIDR, navigate to an investigation that was created from a Velociraptor detection rule.
2. Click View in Velociraptor. Velociraptor opens in a new tab to the endpoint and artifact event page associated with the investigation.

Troubleshooting

Velociraptor integrated with the Insight Platform offers the majority of the same capabilities as the open source version. However, due to security and performance considerations, integrated Velociraptor has certain differences.