Incident Management with Velociraptor

Overview

Velociraptor is great for collecting, querying, and analyzing data across multiple endpoints, making it an essential tool for modern security operations. In this course, Incident Management with Velociraptor, you will delve into its powerful features and demonstrate practical applications in real-world scenarios.

First, you will be introduced to Velociraptor, providing a solid understanding of its purpose, architecture, and key functionalities. You will learn how to set up and configure Velociraptor to fit your security environment, ensuring you are well-prepared to utilize its full potential.

Next, you will focus on hunting across endpoints. You will discover how to perform targeted hunts on a single device or endpoint and explore methods for scaling these hunts across multiple endpoints to maximize coverage and efficiency.

Finally, you will explore hunting based on tactics, techniques, and procedures (TTPs). By the end of this course, you will have the skills and knowledge of Velociraptor needed to leverage known TTPs for proactive threat detection, develop the ability to create and execute custom hunts based on common or emerging TTPs, and enhance your detection capabilities by correlating Velociraptor data with threat intelligence.

Syllabus

• Incident Management with Velociraptor
• Resources

---

Taught by

Brian Dorr

---

Subjects

Information Security (InfoSec)