Endpoint forensics for DFARS 7012 incident reporting: what the clause asks of your endpoints
When a defense contractor suspects that covered defense information has been compromised, the 72-hour clock starts at discovery, and the clock is the first constraint on your endpoint team. DFARS 252.204-7012 requires you to review for evidence of compromise, including compromised computers, servers, data and user accounts, and to report rapidly at dibnet.dod.mil. The clause then asks for three things that depend on endpoint data: malicious software that you discover and isolate must be submitted to the DoD Cyber Crime Center (DC3) as DC3 or the contracting officer instructs, images of affected systems and relevant monitoring and packet capture data must be preserved for at least 90 days after the report, and DoD may request access to additional information or equipment for forensic analysis. Endpoint forensics is where much of that proof comes from, so the questions to answer early are which hosts are in scope, whether you can collect their state without disturbing evidence, and who can testify to how it was gathered.
Velociraptor can support the review and collection steps. Its artifacts and hunts let an investigator search many endpoints for the same indicators, and offline collectors can gather evidence from hosts where no client is installed, writing results to JSONL or CSV. Confirm with your forensic lead how collections will be hashed, stored and logged, because the preservation duty applies to images and monitoring data, not only to query output. Confirm also that the Velociraptor server runs in an environment that meets your own handling rules, since the project's documentation says the server is only fully supported on Linux. Velociraptor 0.77.3 was released on October 5, 2026, and the documentation asks users to update to it to address multiple CVEs, so check your deployed version before an incident rather than during one.
The clause sets the duties, but the scope is set by the clause together with your SP 800-171 obligations and the revision your contracting officer applies. The DoW Class Deviation 2026-O0025, Revision 3 names SP 800-171 Revision 2, while a proposed FAR overhaul would move to Revision 3, so confirm with your contracting officer which assessment applies to your contracts. DeployOpen prepares systems, controls and evidence handling for this work, and it does not issue certifications or attestations. Independent assessors and DoD decide whether your evidence is sufficient. Ask any implementation partner to show, in writing, which systems are in scope, how monitoring and packet capture are retained for the preservation period, and who is authorized to release images.
Which DFARS 7012 and SP 800-171 requirements Velociraptor evidence supports
This table maps each DFARS 252.204-7012 obligation and the related SP 800-171 incident response requirement to what the contractor must do and what Velociraptor can contribute. Read it as a checklist of evidence to build, and confirm with the contracting officer which DFARS text and NIST revision apply to each contract. Velociraptor supports the collection side of these duties, but it does not decide reportability or replace the contractor's own incident response process.
| Obligation | What the contractor must do | What Velociraptor can contribute | What to confirm or configure |
|---|---|---|---|
| 252.204-7012(c) review and reporting | Review the environment for evidence of compromise of covered defense information, including computers, servers, data and user accounts, and report within 72 hours of discovery at dibnet.dod.mil. | Hunts across enrolled endpoints for indicators, persistence and suspicious accounts, with results exported for the report narrative. | Pre-built hunt artifacts and a documented discovery timestamp. Confirm who has authority to file reports and that hunt scope covers all systems holding covered defense information. |
| 252.204-7012(d) malware submission | Submit isolated malicious software to DC3 as DC3 or the contracting officer instructs, not to the contracting officer. | Collects suspicious files with hashes and chain-of-custody metadata so the sample can be isolated and packaged without altering it. | Agree the collection and isolation procedure in advance. Confirm the current DC3 submission instructions before transmitting any sample. |
| 252.204-7012(e) image and monitoring preservation | Preserve images of known affected systems and relevant monitoring and packet capture data for at least 90 days from report submission. | Targeted artifact collection and offline collectors capture volatile and file-based evidence. Retention depends on storage design and is not a substitute for full disk images. | Storage sizing, retention policy, access logging and legal hold procedures. Confirm with counsel whether images are taken by a separate forensic tool. |
| 252.204-7012(f) and (g) DoD access and damage assessment | Provide DoD access to additional information or equipment for forensic analysis on request, and supply preserved damage assessment information if DoD elects an assessment. | Exports collection results in documented formats (JSONL or CSV) that can be provided on request with the collection log. | A written evidence index, named custodians and a process for releasing data. Confirm which items DoD may request and in what form. |
| 252.204-7012(h) to (j) protection and marking | Identify and mark attributional or proprietary information in what is provided, and expect DoD use limited to listed purposes. | Collection outputs can be separated by case so that proprietary material is easier to find and mark. | Marking convention and a case-specific folder structure. Confirm the marking instruction with the contracting officer before submission. |
| SP 800-171 Rev. 3 03.06.02 incident monitoring, reporting and response assistance | Track, report and support response to incidents, with the procedures defined by the organization. | Provides a repeatable collection workflow and audit trail that supports the response record an assessor reviews. | Organization-defined parameters for timelines and roles. Confirm whether the contract applies Rev. 3 or Rev. 2 before mapping evidence to control IDs. |
| SP 800-171 Rev. 2 incident response requirements (named in DoW Class Deviation 2026-O0025) | Maintain incident response capability for systems handling CUI, currently the baseline named in the revised DFARS clause. | Supports the detection, collection and documentation steps that the Rev. 2 incident response family expects, mapped to the 110 Rev. 2 requirements. | Which revision each contract cites, and whether CMMC Level 2 assessment or plan of action rules apply. Confirm with the contracting officer and the CMMC assessment plan. |
| Chain of custody and audit records | Show who collected evidence, when, from which host, and that it was not altered after collection. | Collection logs, artifact versions and hashes recorded per collection, with restricted GUI access by role. | Server audit logging, role separation and off-server copies. Confirm with the assessor which chain-of-custody format they accept. |
How Velociraptor collections support the 72-hour review
Velociraptor gives the incident team a way to pull forensic evidence from endpoints without waiting on a rebuild of the estate. A deployment has three parts: a client on each endpoint, a frontend that the clients talk to, and a server-side web GUI and gRPC API that administrators use. Collections are driven by Velociraptor Query Language (VQL) queries, usually wrapped in artifacts. Artifacts are YAML files stored on the server that the team can view, copy and modify in the GUI without rebuilding clients or servers. That matters inside a 72-hour window, because the team can adapt a collection to the indicators it has found and record exactly which artifact version ran. For hosts where the client cannot be installed, offline collectors built from the GUI have the full capabilities of a normal client and write results to JSONL or CSV. Confirm with your own engineers which artifacts and hashes will be recorded in the incident file before the first collection runs.
For isolated or disputed hosts, the velociraptor gui command starts a GUI, frontend and local client on one machine, so an analyst can triage a copied or quarantined system without connecting it to the production fleet. The server is only fully supported on Linux, and it stores its data in files on its filesystem rather than in a database. That design simplifies installation but changes backup and retention planning: the collection store, the artifact repository and the server configuration must be backed up together and retained for the period DoD may request preserved material. Decide where that storage lives, who can read it, and how it is kept separate from the systems that were compromised.
Velociraptor is licensed under AGPL-3.0, which applies to modifications you make and distribute or make available over a network, so legal review should happen before you customize the server or artifacts for a contract. Release 0.77.3, published on October 5, 2026, is the version the project asks users to adopt because it addresses multiple CVEs. Any deployment that predates it should be upgraded and verified before it is trusted with covered defense information. Ask your implementation partner to document the version, the upgrade date and the test evidence in the incident response plan.
Evidence handling sequence from discovery to DoD request
This sequence turns a suspected compromise into a timely DFARS 252.204-7012 report and a preserved, verifiable evidence set that DoD can request later. Each step names its output so the team can show what was done, by whom and when.
Detect, contain and record the discovery
The incident response lead records the date and time of discovery, the detection source (Wazuh alert, user report, third-party notice) and the initial scope in an incident ticket. Affected endpoints are isolated from the network while remaining powered on, so volatile memory and running state are not lost. The clause sets a 72-hour reporting window from discovery, so this timestamp is the anchor for every later step. The output is a signed incident record with the discovery time and isolation log.
Scope the review for compromise
The team reviews for evidence of compromise across computers, servers, covered defense information and user accounts, as paragraph (c) of the clause requires. Velociraptor hunts run across enrolled endpoints for indicators such as new persistence, unusual logons and unexpected data staging, and Wazuh alerts and software inventory show which systems were exposed. The output is a written list of affected systems and accounts, with the basis for including or excluding each host.
Collect artifacts with hunts and collectors
Velociraptor artifacts gather the host evidence needed for analysis, such as process, network, event log and file system data, from online clients. Offline collectors cover hosts where the client cannot run, and their results are written to JSONL or CSV. Each collection is run against a defined artifact version so the method can be repeated. The output is a set of collection packages stored in a segregated evidence repository with hashes recorded at export.
Record chain of custody for every item
Each image, collection, malware sample and log export receives a unique identifier, a hash, the collector's name, the time of acquisition and every transfer or access afterward. Access to the repository is limited to named responders, and the custody log is kept with the incident record. Confirm with counsel and your insurer which custody format they require, since neither the clause nor the platform sets it. The output is a custody log that matches the hashes of the preserved items.
Isolate malware and route it to DC3
Where malicious software is discovered and isolated, the contractor submits it to the DoD Cyber Crime Center (DC3) as DC3 or the contracting officer instructs. Under paragraph (d), the sample must not be sent to the contracting officer. Samples stay in an access-controlled quarantine until the submission method is confirmed. The output is a transmittal record showing the sample hashes, the recipient and the DC3 instruction that authorized the submission.
Submit the report at dibnet.dod.mil
The contractor reports the incident at dibnet.dod.mil within 72 hours of discovery, using facts already recorded in the incident file. The report should identify the affected systems, the accounts involved and the covered defense information at risk, and it should identify any information the contractor wants marked as attributional or proprietary. The output is the submitted report and the portal confirmation, both filed with the incident record.
Preserve images and monitoring data for 90 days
Images of all known affected systems and relevant monitoring and packet capture data are held for at least 90 days from report submission. Retention policies, backup jobs and storage quotas are adjusted so that no automatic deletion removes these items during that period. DoD may request the media, or decline interest, and paragraphs (f) and (g) give DoD access to additional information or equipment on request. The output is a retention register confirming the preserved items, their locations and their hold dates.
Respond to DoD requests and close the hold
When DoD asks for media, forensic access or damage assessment information, the team provides only what the request covers and logs each release against the custody record. Requests for access are handled under the clause's protections for attributional and proprietary information, with markings checked before release. The hold is lifted only after the retention period has passed and the owner has confirmed in writing that no request is pending. The output is a release log and a documented hold closure.
Open source platforms that fit DFARS 7012 evidence work
DFARS 252.204-7012 asks for a fast report, malware submission and preserved images, so the evidence has to exist before an incident starts. The platforms below each cover one part of that trail: collection, alerting and log retention, packet data, triage automation, and identity records that show which accounts were affected.
Velociraptor for collection and hunting
Velociraptor runs a client on each endpoint and a server you host, and its artifacts query host state across the estate. Offline collectors cover hosts where a client cannot be installed, and they write results to JSONL or CSV. Check that the server runs on Linux, that your evidence store keeps images and collection output for the full preservation period, and that analysts can document chain of custody for each collection.
Wazuh for alerts and log retention
Wazuh stores alerts in its indexer and gives you the timeline that anchors the review: when an agent first raised a rule, which endpoint it ran on, and what software inventory was present. Confirm that retention in the indexer meets the 90-day image and monitoring preservation expectation, and that agents on your legacy systems are supported.
Security Onion with Suricata and Zeek
Security Onion bundles Suricata for intrusion detection and Zeek for network analysis, so it can supply the packet capture and monitoring data that 7012(e) asks you to preserve. Sensor placement decides what is captured, so confirm the tap or mirror points before an incident. Review the Elastic License 2.0 terms against how you plan to share or redistribute the platform.
Shuffle for triage automation
Shuffle can automate the repetitive steps around a report, such as pulling a host list, enriching hashes and opening tickets with the collection ID attached. Automation must not delete or overwrite preserved images or collections. Document each playbook step so an assessor can see what ran, when and under whose approval. Its AGPL-3.0 license applies if you modify and distribute it.
MISP for indicator handling
MISP holds the indicators of compromise from your investigation and lets you control what leaves your organization. This matters when you prepare malware for submission to DC3, because the indicators you share should be separated from the sample itself, which goes through the instructed channel. Confirm your sharing rules and whether the AGPL-3.0 license affects internal copies.
Keycloak or midPoint for affected accounts
Paragraph (c) asks you to review for compromised user accounts, so you need a clear record of who held each account and what it could reach. Keycloak logs and directory federation, or midPoint's role and assignment data, can narrow that list quickly. Check that identity records are preserved along with endpoint evidence, and confirm the Apache-2.0 or EUPL 1.2 license terms fit your distribution needs.
Evidence auditors and contracting officers ask for
This table lists the records a reviewer is likely to request after a DFARS 252.204-7012 cyber incident, which system or team produces each one, and what to confirm in your environment. Use it to check gaps before an incident, since the 72-hour report and the 90-day hold both depend on records existing and being retrievable. The main takeaway is that most evidence comes from several systems at once, so retention and hashing must be set up across all of them.
| Evidence item | Produced by | What to confirm in your environment |
|---|---|---|
| Incident report record and timestamps | Ticketing system and incident log | Discovery time, report submission time and the 72-hour clock are recorded in one place with a unique incident number. |
| Scoping review results | Ticketing system with analyst notes, plus Velociraptor hunt results | Documented review of affected computers, servers, data and user accounts, as paragraph (c) of the clause requires. |
| Velociraptor hunt and collection logs | Velociraptor server (hunt and flow records) | Which artifacts ran, on which hosts, by which account, and whether logs are exported off the server before any rotation. |
| Hash lists for images and malware | Velociraptor collection output and the storage system | SHA-256 or equivalent hashes recorded at collection and re-verified before transfer to DC3 or storage. |
| Chain-of-custody forms for images and malware | Ticketing system and secured evidence storage | Named custodians, transfer dates and access logs for every handoff, including submissions made to DC3 at the instruction of DoD. |
| Preserved system images | Storage system holding forensic images | Images of all known affected systems are stored with write protection and a documented retention date at least 90 days after report submission. |
| Preserved monitoring data | Wazuh indexer (alerts and archives) | Index retention and snapshot settings keep relevant alerts for the full hold period, and the archive is not overwritten by routine lifecycle policies. |
| Preserved packet capture data | Security Onion (Suricata and Zeek logs, full packet capture where deployed) | Packet capture retention length and whether captures for the incident window were exported before rollover. |
| Retention settings showing the 90-day hold | Wazuh indexer, Security Onion, Velociraptor storage and storage system configuration | Exported configuration showing a legal or incident hold is applied, with a change record dated when the hold started. |
| Marking of attributional or proprietary information | Ticketing and document management records | Records identify which information the contractor marks as attributional or proprietary under paragraphs (h) to (j), confirmed with counsel. |
What Velociraptor alone does not satisfy
Velociraptor can collect the endpoint evidence that DFARS 252.204-7012 expects, but the clause also assigns reporting, decision and preservation duties that no collection tool performs. The cards below separate those duties from the technical work so that the contractor can assign an owner to each one before an incident occurs.
Reporting to DoD
Velociraptor does not submit anything to dibnet.dod.mil. The clause requires the contractor to report within 72 hours of discovery, so a named person must own the report, hold the DoD medium assurance certificate needed for access, and file it on time. Confirm who holds that role, who backs them up, and how the 72-hour clock is recorded from the first alert.
Deciding what is reportable
The clause defines a cyber incident broadly, covering actions through computer networks that cause compromise or a potentially adverse effect, and it includes compromise of computers, servers, data and user accounts. Velociraptor gives evidence but not a judgment. Your incident response procedure must state who decides that an event is reportable, what evidence supports that decision, and how the decision is documented.
SP 800-171 policy, staffing and training
Collection tooling does not write the incident response policy, assign roles to staff, or train analysts to run hunts and handle evidence. The 03.06.02 requirement on incident monitoring, reporting and response assistance expects an organization-level process. Ask whether your written procedures, tabletop exercises and analyst training records exist and are current before an assessor asks for them.
Full disk images and packet captures
Clause paragraph (e) requires preserving images of all known affected systems and relevant monitoring and packet capture data for at least 90 days after reporting. Velociraptor collects artifacts and selected files, not complete disk images or network captures by default. Plan separate imaging tools, write-once storage with hash records, and capacity for packet data before an incident, because the storage design decides what can be kept.
Open questions on Rev. 2 and Rev. 3
DoW Class Deviation 2026-O0025, Revision 3 names SP 800-171 Revision 2 explicitly, while a FAR overhaul proposed rule would require Rev. 3 with DoW-published ODP values. That rule was not final as of October 2026. Confirm with your contracting officer which revision governs your contract, and map your Velociraptor evidence to the requirements of that revision rather than assuming the newer one.
Assigning ODP values yourself
Rev. 3 introduces organization-defined parameters, such as how long an event is retained or how quickly a response starts. NIST does not assign these values. Where a federal agency does not specify them, the nonfederal organization must set them to complete the requirement. Record your chosen values, such as hunt cadence and evidence retention periods, in your System Security Plan so that Velociraptor configuration can be checked against them.
DFARS 7012 forensics questions buyers ask before hiring help
Is Velociraptor enough on its own for DFARS 7012 evidence?
Velociraptor collects the endpoint evidence well, but it does not by itself satisfy the clause. DFARS 252.204-7012(e) requires you to preserve and protect images of affected systems and relevant monitoring and packet capture data for at least 90 days after you submit the report. Velociraptor can gather artifacts, hunt across hosts and write results to JSONL or CSV, yet disk images, network captures and chain-of-custody records need their own tooling and procedures. Your incident response plan must also cover how malware is isolated and submitted to DC3 as DC3 or the contracting officer instructs. Ask any partner to show how each clause obligation maps to a specific tool, storage location and record, and confirm the approach with your legal and compliance team before relying on it.
How long does Velociraptor setup take and what drives the effort?
No supplied source gives a duration, so treat any timeline as something to get in writing from a scoped plan. Effort mainly scales with endpoint count, the operating system mix, how many hosts cannot take an agent, and the storage the evidence will consume. Velociraptor's server is typically deployed on a cloud virtual machine and is only fully supported on Linux, so the server design and network paths matter as much as the agent rollout. Offline collectors, built from the GUI, let you cover hosts where the client cannot be installed, but each one adds handling steps. Storage grows with collection depth and must hold preserved images for at least 90 days, so retention sizing should be planned early. Ask for the assumptions behind any estimate: host counts by OS, offline share, and retention targets.
What does a DFARS 7012 forensics engagement cost?
Costs fall into four groups. Internal staff time covers asset ownership, change approvals, legal review and the people who will run collections. Storage covers evidence, images and captures held for at least 90 days, and it recurs as long as the data is kept. The implementation partner's work is usually a fixed-scope, one-time project covering design, deployment, documentation and handover, with ongoing support available as a retainer. Incident response retainers with a forensic firm are a separate decision, useful if you need outside responders during a live event. Software licensing for Velociraptor is AGPL-3.0, so the platform itself carries no license fee, but you should confirm any commercial add-ons. DeployOpen does not publish a price list, so request a quote built from a written scope that lists each component separately.
What does the client need to provide for this work?
The work depends on your asset inventory more than on the tool. Expect to supply a current list of endpoints, servers and their owners, the operating systems in use, and which hosts sit in segments without a direct client path. You will also need change windows for agent rollout and server maintenance, named technical contacts who can approve access, and a decision on where evidence will be stored and who may access it. Legal review should happen early to define preservation obligations, marking of attributional or proprietary information under the clause, and what may be shared with DoD. Ask the partner to list these inputs in the written scope so that gaps appear before work starts rather than during an incident.
Can our own team run Velociraptor for DFARS 7012 incidents?
Yes, a capable internal team can run Velociraptor, but the question is whether it can do so under pressure and with defensible records. Velociraptor runs as a single executable with a web GUI, and artifacts are YAML files you can view and adjust without rebuilding clients or servers. The harder work is operational: keeping the server patched (Velociraptor 0.77.3 was released on October 5, 2026, and its documentation asks users to update to address multiple CVEs), maintaining offline collectors, documenting collection steps, and rehearsing the 72-hour reporting path. Decide which roles stay in-house, which need outside help, and who holds retainer capacity for a live event. A readiness review before an incident shows which gaps remain.
What does 90-day evidence retention mean for storage?
DFARS 252.204-7012(e) requires you to preserve and protect images of known affected systems and relevant monitoring and packet capture data for at least 90 days from submitting the cyber incident report. Storage must therefore hold full images, captures and collection outputs for that window, plus any extension DoD requests, and it must be protected against alteration. Sizing depends on how many systems you might image, how much packet capture you record, and whether you keep data longer for your own investigation. Velociraptor stores its data in files on the server's filesystem, so the storage design matters for both capacity and access control. Ask for a sizing model that states host counts, image sizes, capture rates and the retention period used.
How do we get a written scope and quote for this work?
Ask the implementation partner for a written scope before any work begins, since most DeployOpen engagements are fixed-scope, with scope, deliverables and timelines agreed in writing. The scope should name the systems in and out of coverage, the Velociraptor components to be deployed, offline collector handling, evidence storage design, retention settings, documentation and handover, and any testing or training. Request a quote that breaks out each component and states assumptions about endpoint count and OS mix. Also ask which items recur, such as support retainers, storage and upgrades, and what triggers a change order. Confirm with your counsel that the scope reflects your clause obligations before signing.
Confirm contract requirements before designing the forensic process
The first decision is not which tool to deploy but which rules apply to this contract. The SP 800-171 revision and DFARS clause text depend on the contract itself, on the DoW class deviation that the contracting officer has issued, and on the status of the pending FAR overhaul. The DoW deviation names Revision 2 explicitly, while a FAR overhaul proposed rule would move contractors handling CUI to Revision 3 with ODP values published by the DoW CIO. The proposed rule was not final as of October 2026. Ask the contracting officer in writing which DFARS 252.204-7012 text and which SP 800-171 revision govern the award, and record the answer before writing any collection procedure.
Next, confirm the boundaries that the forensic design depends on. Identify the CUI scope: which systems store, process or transmit covered defense information, and which systems only connect to them. Document the system security plan boundary, the enclaves, the identity providers and the monitoring infrastructure that hold relevant logs and packet captures. Confirm which of these must be imaged and retained for at least 90 days after the incident report, since that obligation covers all known affected systems and the monitoring and packet capture data tied to them. Also confirm who holds the DC3 and contracting officer contacts, and how malware submissions must be routed under paragraph (d).
Finally, get legal review of marking and release before evidence leaves the organization. Under paragraphs (h) to (j), the contractor should identify and mark attributional and proprietary information so the Government can protect it. Counsel should agree on the marking convention, the chain-of-custody records for Velociraptor collections and offline collector output, and the process for responding to DoD access requests under paragraphs (f) and (g). Ask counsel and the contracting officer to confirm these steps in writing, because they determine what the forensic team is allowed to collect, copy and hand over.
How DeployOpen scopes and delivers DFARS 7012 forensic readiness
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, so Velociraptor collections and evidence handling run where the contractor controls the data. Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
How we scope
- Written scope names the covered systems, endpoints and sites that DFARS 252.204-7012 evidence handling must reach.
- Scope records which Velociraptor artifacts, offline collectors and storage locations the contractor will use for triage.
- Scope confirms who in the contractor's team owns reporting to DIBNet and who is authorized to hand over media to DC3.
How we build
- Velociraptor server deployment in the client's environment, with access controls on the GUI and gRPC API.
- Collection artifacts and hunts configured to gather the host state the clause asks contractors to review for compromise.
- Evidence storage configured to preserve images and monitoring data for the retention window the clause requires, with tested retrieval.
How we hand over
- Runbooks covering triage, collection, chain of custody and the steps to isolate and submit malicious software to DC3.
- Documented retention settings and a record of the preservation period each evidence set must meet, checked against the clause.
- Walkthrough and tabletop exercise with the incident response team, with the written evidence checklist left in the client's hands.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, including Velociraptor updates when releases address security issues.
- Periodic review of artifacts, storage capacity and access logs as the estate and the DoD requirements change.
- Confirmation with the client's counsel and the contracting officer on any requirement that depends on their interpretation.
