Live response across a fleet: Velociraptor and osquery
You ask hundreds of endpoints the same question at once, collect targeted evidence with Velociraptor, query system state with osquery and bring the findings together centrally.
Level 401 · 13 lessons · 12 practice labs
Lessons
Thinking at scale
- From one machine to a fleet: the problems of responding at scale
- Velociraptor architecture: server, client, artifact
- osquery: querying the system with SQL
- Short task: list listening ports on every machine with osquery
Hunts and collection
- Writing queries with VQL and built-in artifacts
- A fleet-wide hunt: searching everywhere for a hash or filename
- Targeted collection packs: KAPE-style rapid evidence
- Remote quarantine and killing processes
- Short task: find the machines that match an indicator and quarantine them
Analysis and sustaining
- Stacking: separating what everyone has from what only one machine has
- Writing and sharing your own artifact
- Ongoing monitoring queries and alerts
- Capstone: find and clean the three compromised machines in a fleet of fifty
Practice labs
- List listening ports with osquery: List the listening ports and their processes on every lab machine with one query.
- Query privileged users and keys: Query administrator accounts and authorized_keys entries across the fleet and find the odd one.
- Set up a continuous monitoring query: Write a scheduled query pack that logs when a new listening port opens.
- Collect with a ready-made artifact: Collect the scheduled task artifact from one client and read the result.
- Search for a hash across the fleet: Launch a hunt searching every client for a given file hash and list the matching machines.
- Write your own artifact in VQL: Write and share an artifact collecting executables created in a given directory in the last seven days.
- Collect a targeted evidence package: Collect logs, shell history and persistence points from one client as a quick package.
- Quarantine the machines matching an indicator: Isolate the clients matching in the hunt from the network and verify only access to the response server remains.
- Terminate a process remotely and verify: Terminate the suspicious process on matching clients, remove its persistence and prove the clean-up by hunting again.
- Separate what everyone has from what one has: Stack the service lists of the fleet and find the service seen on only one machine.
- Rare autostart entries: Count autostart entries across all clients and examine the five rarest.
- Find the compromised machines in the fleet: In a prepared fifty-machine dataset find the three compromised machines by stacking and write the clean-up steps.
About this course
You ask hundreds of endpoints the same question at once, collect targeted evidence with Velociraptor, query system state with osquery and bring the findings together centrally.
What you will learn
- Thinking at scale
- Hunts and collection
- Analysis and sustaining
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.