Velociraptor

Search the Azure Marketplace for Velociraptor 0.77 on Ubuntu 24.04. Create the VM with a network security group (NSG) that allows:

• TCP 22 (SSH) from your management network
• TCP 443 (the web GUI over TLS) from your admin network
• TCP 8000 (client communications) from the networks your endpoints live on. You need this only once you enrol endpoints.

RG="velociraptor-prod"; LOCATION="eastus"; VM_NAME="velociraptor-01" IMAGE_URN="sac1647283583153:velociraptor-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name velo-vnet --address-prefix 10.104.0.0/16 --subnet-name velo-subnet --subnet-prefix 10.104.1.0/24 az network nsg create -g "$RG" --name velo-nsg az network nsg rule create -g "$RG" --nsg-name velo-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name velo-nsg --name allow-gui --priority 110 \
  --source-address-prefixes "<your-admin-cidr>" --destination-port-ranges 443 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name velo-nsg --name allow-frontend --priority 120 \
  --source-address-prefixes "<your-endpoint-cidr>" --destination-port-ranges 8000 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:velociraptor-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name velo-vnet --subnet velo-subnet --nsg velo-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

Confirm that first boot completed and that the server and the TLS proxy are running. The GUI is bound to loopback only, so nginx is the sole public entry point.

systemctl is-active velociraptor-firstboot.service velociraptor.service nginx.service
sudo /usr/local/bin/velociraptor version | grep -i version ss -ltn | grep -E ':(443|8000|8889)'

Each VM generates its own SecureAnyCloud GUI administrator password at first boot. Read it from the root-only credentials file:

sudo cat /stage/scripts/velociraptor-credentials.log

# Velociraptor 0.77.2 — Per-VM Credentials
#
# Web GUI (HTTPS via nginx): https://<vm-ip>/
# Sign in: sac / <password below>
# VELOCIRAPTOR_USER=sac VELOCIRAPTOR_PASSWORD=<VELOCIRAPTOR_PASSWORD> VELOCIRAPTOR_URL=https://<vm-ip>/ GUI_PORT=8889 FRONTEND_PORT=8000

nginx serves the GUI over HTTPS and enforces HTTP Basic authentication. Run these checks to confirm that the front door is up and that authentication is enforced. Missing or guessed credentials are rejected, and the per-VM admin succeeds:

PASS=$(sudo grep '^VELOCIRAPTOR_PASSWORD=' /stage/scripts/velociraptor-credentials.log | cut -d= -f2-)
curl -ks -o /dev/null -w 'healthz -> HTTP %{http_code}\n' https://127.0.0.1/healthz
curl -ks -o /dev/null -w 'no credentials -> HTTP %{http_code}\n' https://127.0.0.1/app/index.html
curl -ks -o /dev/null -w 'admin:admin guess -> HTTP %{http_code}\n' -u admin:admin https://127.0.0.1/app/index.html
curl -ks -o /dev/null -w 'sac admin -> HTTP %{http_code}\n' -u "sac:$PASS" https://127.0.0.1/app/index.html

Expected: healthz -> 200, no credentials -> 401, admin:admin guess -> 401, SecureAnyCloud admin -> 200.

Now open https://<vm-ip>/ in your browser and sign in as SecureAnyCloud with the password from Step 5. The TLS certificate is self-signed per VM. Accept it, or replace it with your own certificate in /etc/nginx/ssl/. You land on the Velociraptor welcome dashboard.

Open View Artifacts to browse the built-in artifact catalogue. It holds hundreds of forensic collectors, each defined in VQL. Select one, for example Generic.Client.Info, to see its description and source query.

Open Hunt Manager to create and monitor fleet-wide collections. A hunt runs a chosen artifact across every enrolled endpoint and streams the results back.

Open Notebooks for collaborative VQL investigation notebooks. Use them to post-process collected data, pivot, and document findings alongside the queries that produced them.

The same DFIR engine runs VQL directly from the command line, which suits scripting and quick checks. Query the server's own host, then confirm that the artifact catalogue is loaded:

sudo /usr/local/bin/velociraptor --config /etc/velociraptor/server.config.yaml \
  query "SELECT OS, Platform, Hostname, Fqdn FROM info()"
sudo /usr/local/bin/velociraptor --config /etc/velociraptor/server.config.yaml \
  artifacts list | wc -l

To collect from real endpoints, generate a client configuration and install the Velociraptor client (agent) on each host. The client config embeds this server's certificate authority, so endpoints connect to the frontend (port 8000) over pinned mutual TLS.

# Generate a client config for endpoints to use (writes to stdout):
sudo /usr/local/bin/velociraptor --config /etc/velociraptor/server.config.yaml \
  config client > /tmp/client.config.yaml head -20 /tmp/client.config.yaml

Copy client.config.yaml to each endpoint. Install the matching Velociraptor client package, which you can download from the GUI welcome screen under Build Linux/Windows client packages. Start the client with that config. Enrolled hosts then appear in the GUI search and become targets for hunts.

sudo systemctl status velociraptor --no-pager sudo systemctl restart velociraptor
sudo journalctl -u velociraptor -n 50 --no-pager

The server configuration lives at /etc/velociraptor/server.config.yaml and the datastore at /var/lib/velociraptor. Back up both to preserve your server identity (CA) and your collected data.

• Restrict the NSG. Expose port 443 only to your admin network and port 8000 only to the networks your endpoints live on. Limit SSH (22) to management ranges.
• Replace the self-signed TLS certificate. Place your own certificate and key in /etc/nginx/ssl/velociraptor.crt / .key and reload nginx to get a browser-trusted GUI.
• Use per-analyst accounts. Rotate the GUI admin password and add an account for each analyst with an appropriate role (velociraptor user add <name> --role <role>), rather than sharing the SecureAnyCloud login.
• Keep the GUI private. It binds to 127.0.0.1:8889 and is reachable only through the nginx TLS proxy.

Velociraptor is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). The complete corresponding source is available from the upstream project at github.com/Velocidex/velociraptor. The AGPL-3.0 license text ships in the image and is also available from the upstream release.

Need Help?

SecureAnyCloud images come with 24/7 support and a 24-hour response SLA. Contact support through the Azure Marketplace listing or at secureanycloud.com.

Deploy on Azure

Launch Velociraptor 0.77 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com