veyepar: Velociraptor

Author(s):	Mike Cohen
Location	Room 9
Date	jan Wed 15	Days Raw Files
Start	13:30	First Raw Start	error-in-template
Duration	0:100:0	Offset	None
End	15:10	Last Raw End
Chapters
Total cuts_time	None min.

https://lca2020.linux.org.au/schedule/presentation/80/
raw-playlist raw-mp4-playlist encoded-files-playlist mp4 svg png

assets release.pdf Velociraptor_Dig_Deeper.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

This hands-on lab introduces delegates to Velociraptor: a new open-source (AGPL) platform to perform surgical forensic evidence collection and incident response across a distributed computer network. It’s fast, precise, powerful … and free.  It also supports Linux, Windows and MacOS. Velociraptor is a unique tool since it offers a query language so that users may query their end point flexibly in response to new threat information.

Participants will download the latest Velociraptor executable, then configure and deploy a Velociraptor server and agent before collecting and examining evidence from across their personal test network. This workshop will focus on Linux.

The instructors will walk through several real-life investigation scenarios, including collecting evidence of program execution, searching for evidence of lateral movement, hunting for back doors and hunting for attacker IOCs. We also explore how Velociraptor can be used to perform continuous security monitoring on the endpoints. Participants will become familiar with the main deployment options, elements of the Velociraptor interface and the procedure for configuring and executing basic hunts, before moving to the powerful Velociraptor Query Language (VQL) which opens the doors to developing custom hunts to meet specific investigation needs. We’ll also be covering management and monitoring features which ensure that Velociraptor can be used at scale, with minimal impact on network performance.

Comment:

production notes