velociraptor

Velociraptor DFIR integration for LimaCharlie. List available VQL artifacts, view artifact definitions, launch forensic collections on endpoints. Find raw collection data in Artifacts (type:velociraptor, source:SID). Query processed JSON events from the 'velociraptor' sensor (tag:ext:ext-velociraptor). Build D&R rules for velociraptor_collection events. Use for: forensic triage, incident response, threat hunting, VQL artifact collection.

$ Installer

git clone https://github.com/refractionPOINT/lc-ai /tmp/lc-ai && cp -r /tmp/lc-ai/marketplace/plugins/lc-essentials/skills/velociraptor ~/.claude/skills/lc-ai

// tip: Run this command in your terminal to install the skill