Open source endpoint forensics for ransomware response

Open source endpoint forensics for ransomware response: why the first hours decide the evidence

For ransomware response, Velociraptor is the forensic collection and hunting layer, and Wazuh is the detection and alerting layer that tells you where to look. Your situation is usually one of two: encryption is still spreading, or it has been contained and leadership now wants a defensible answer on scope. Insurers and possibly law enforcement will ask for evidence, and the responders must contain the attack without wiping the artifacts that prove what happened. Decisions made in the first hours, such as rebooting hosts, reimaging machines or clearing logs, can permanently remove the evidence you will later need.

Ransomware response differs from routine EDR in four ways. First, chain of custody matters: you need to record who collected what, from which host, with which artifact and when, and keep those records intact for outside parties. Second, scope must cover every endpoint, not only the alerts that fired, so Velociraptor hunts across the fleet for persistence, lateral movement and staging tools. Third, some hosts will not have a working agent, so Velociraptor offline collectors, which run any artifact and write JSONL or CSV output, become the way to collect from them. Fourth, the findings must flow back into Wazuh rules so that the next affected host raises an alert.

Velociraptor is licensed under AGPL-3.0, which your legal team should review before you modify or redistribute it. Velociraptor 0.77.3 was released on October 5, 2026, and the project documentation asks users to update to that release to address multiple CVEs, so confirm your running version before any incident. Before you need it, test a collector on a non-production host, confirm where collected evidence is stored, and agree in advance who may authorize collection and containment steps.

What a ransomware investigation must satisfy and what it means for the build

This table maps the evidence expectations a ransomware investigation faces to their source, then states what each one requires from the Velociraptor and Wazuh build. Read each row as a requirement you must be able to show, then check the build consequence before you size storage, roles and retention. Items marked for confirmation depend on your counsel, insurer and regulator, so get their written position before the build is fixed.

Requirement	Source or basis	Build consequence
Record and examine activity in systems holding ePHI	HIPAA Security Rule audit controls (45 CFR 164.312), paraphrased	Enable Wazuh audit and endpoint logs on in-scope hosts, forward them to storage outside the affected estate, and review collector and hunt activity on a defined cadence.
Unique identification of every person who runs a collection or hunt	HIPAA access control and unique user identification (45 CFR 164.312)	Use named Velociraptor accounts only, disable shared administrator logins, and record the user, artifact and target in every collection.
Monitor and log authorized user activity	FTC Safeguards Rule monitoring and logging (16 CFR 314.4)	Log every Velociraptor GUI and API action and every Wazuh configuration change, and retain those logs separately from the endpoints being investigated.
Who may authorize forensic collection on which hosts	Insurer and counsel expectations (confirm in writing before the build)	Define a collector authorization step with an incident lead sign-off, and restrict which roles can run hunts that touch personal or clinical data.
Preserve collections in a form that resists later change	Law enforcement and insurer evidence handling (confirm the format and chain-of-custody steps with counsel)	Write collection output to a write-once or object-lock location, keep originals unmodified, and work only on copies during analysis.
Show that files were not altered after collection	Chain-of-custody and integrity expectations (confirm the hash method with counsel and the forensic provider)	Record a hash and a collection timestamp for each output file, and keep the time source of the server and clients synchronized and documented.
Separate duties between responders and approvers	Access control and audit expectations (confirm with your auditor)	Split hunt-running, approval and log-review roles so no single responder can run and then review their own collections without a second check.
Retain Velociraptor and Wazuh logs long enough to answer later questions	Regulator, insurer and litigation timelines (confirm retention periods with counsel)	Set retention for Velociraptor server logs, collections and Wazuh alerts from written requirements, and size the indexer and storage for that period before the incident.

How the response differs when the host has an agent, when it does not and when the network is segmented

When a Velociraptor client is already installed and connected to the frontend, the team can run artifacts against the affected host directly from the GUI or the gRPC API. This is the fastest path to triage data because the client executes VQL queries that are usually wrapped in artifacts, and the results return to the server for review and hunting across other endpoints in the same pass. Collection from a live client preserves the host's current process, network, persistence and file state at the time of the query, which is the evidence most useful for scoping the intrusion.

Live artifact collection: Run triage artifacts for processes, network connections, scheduled tasks, services and autoruns, and record the artifact names and parameters used.
Hunts across the estate: Apply the same artifacts to every connected client to find the same persistence or encryption indicators elsewhere.
Server-side retention: Results are stored on the Velociraptor server, which keeps the chain of collection in one place for later export.
Client health risk: A ransomware actor may have stopped or tampered with the client, so confirm the client is still reporting before relying on it.

Before responding, confirm which artifacts are approved for live use, who holds the admin role for the GUI, and whether the server's storage is backed up and access-logged for the insurer and investigators.

Which open-source platforms fit ransomware response and why

Ransomware response needs three things at once: a way to examine every endpoint quickly, a way to collect evidence from hosts that cannot run an agent, and a detection layer that turns what responders learn into alerts. The platforms below cover those roles, and the cards explain where each one fits and what to confirm before relying on it.

Velociraptor as the forensic hunt platform

Velociraptor is the primary tool for hunting across the estate and collecting triage data. It ships as a single statically compiled Go executable, runs its collections as artifacts written in YAML, and needs no separate database because the server keeps data in files on its filesystem. The server is only fully supported on Linux, so plan the host and storage before an incident. Confirm that your responders can write and review VQL artifacts in the GUI before they are under pressure.

Offline collectors for unmanaged hosts

Offline collectors are built from the GUI for hosts where the client cannot be installed, such as hosts already encrypted, isolated or outside the agent policy. They have all the capabilities of a normal client, can run any artifact, and write results to JSONL or CSV. Test the collector on a sample host, record the hash and version used, and confirm that your chain-of-custody procedure covers the removable media that carries it.

Wazuh as the detection and alerting layer

Wazuh provides the alerting layer: the indexer stores alerts, the server analyzes agent data with decoders and rules, the dashboard presents results, and agents run on endpoints. It is distributed under GPL version 2 and can run as a cluster for horizontal scaling. Its agents and rules are where Velociraptor findings become repeatable detections, so confirm which operating systems in your estate are supported by agents before you rely on them for coverage.

Wazuh vulnerability detection from inventory

Wazuh correlates the software inventory that agents collect with vulnerability data from its Cyber Threat Intelligence platform or from an offline repository. Ransomware often exploits known flaws in internet-facing or unpatched systems, so this inventory helps responders identify exposed hosts during triage. For air-gapped sites, confirm that the offline vulnerability repository is updated by media transfer and that the update cadence matches your change process.

Security Onion as network evidence

Security Onion is an optional source of network evidence. It bundles Suricata, Zeek, osquery and the Elastic stack into one platform for threat hunting and monitoring, which helps when responders need to show lateral movement or command-and-control traffic. It is licensed under the Elastic License 2.0, not an OSI-approved open source license, so have counsel review the terms against your redistribution and internal use model before adoption.

Shuffle for optional triage automation

Shuffle is an optional automation layer for repetitive triage steps, such as enriching alerts or opening tickets when a Velociraptor hunt returns hits. It is licensed under AGPL-3.0. Keep automated containment out of the first version of your playbooks, because an automated isolation step that runs against the wrong host can disrupt a clinical, trading or production system. Human approval should gate every destructive action.

Continuity commitments for Velociraptor

Rapid7 announced its acquisition of Velociraptor on April 21, 2021, and said it would continue to build the open-source community. The project remains open source under AGPL-3.0, but ownership changes can affect roadmap, release practice and commercial terms. Before you standardize on Velociraptor, ask your implementation partner and the vendor to confirm continuity commitments in writing, and set a plan to maintain a tested fork or pinned release if those commitments change.

How a ransomware response engagement runs from triage to detection tuning

The sequence moves from pre-approved readiness through scoped triage, estate-wide hunting and defensible evidence packaging, then returns what was learned to Wazuh detections so the next attempt is caught earlier. Each phase ends with a named output and a named approver.

Prepare clients, collectors and approvals before an incident
Before any incident, the platform team deploys Velociraptor clients where the environment allows, builds offline collector templates for hosts that cannot take an agent, and agrees with the incident lead which artifact sets may run without further approval. Legal and the incident commander also define how evidence is hashed, labeled, stored and transferred. The output is a runbook with tested collector builds and a signed evidence-handling standard, approved by the CISO and general counsel. The step is done when a test collection has been run and its output checked against that standard.
Scope the incident and triage affected hosts
When an incident is declared, the responders identify the first confirmed hosts and collect triage artifacts from them, such as running processes, network connections, scheduled tasks, services and recent logins. Each collection is hashed at acquisition and the hashes are recorded in the case log so the evidence can be verified later. The output is a scoped host list, a first timeline and a hash manifest, reviewed and accepted by the incident commander before the hunt begins.
Hunt the estate for persistence and encryptor binaries
Using the artifacts approved in the preparation phase, the team runs estate-wide hunts in Velociraptor for persistence mechanisms, unexpected services, encryptor file names and hashes, and lateral movement traces. Hosts without agents are covered with offline collectors, whose results are imported into the case. The output is a host-by-finding matrix that separates confirmed, suspected and cleared systems, signed off by the incident lead before any containment decision relies on it.
Coordinate containment before recovery begins
Containment decisions, such as isolating hosts, disabling accounts or blocking indicators, are made by the incident commander using the hunt matrix, and the actions are timed so that evidence on live systems is captured first. Velociraptor is used to confirm that isolated hosts stay quiet and that no unapproved changes are made during collection. The output is a containment log that records each action, the decision owner and the evidence collected beforehand, approved by the incident commander and the business owner of each affected system.
Package evidence for insurers and law enforcement
The evidence team assembles collections, hash manifests, chain-of-custody records and the analyst notes into a case package. Copies are prepared for the cyber insurer and, where it is involved, law enforcement, and each recipient receives the same verified set. Any data that contains personal information is reviewed by counsel before release. The output is a sealed package with an index and custody log, approved by counsel before it leaves the organization.
Recover systems from known-good state
Recovery restores systems from backups or rebuilds that have been checked against the hunt findings, and clean hosts are verified with the same artifact sets before they rejoin the network. Credentials that appeared in the hunt are rotated in an order agreed with the owners of affected services. The output is a per-host recovery record showing the verification result, approved by the system owner and the incident commander.
Feed findings into Wazuh rules and dashboards
After the incident closes, the detection engineer converts confirmed indicators and behaviors into Wazuh rules, decoders and dashboard views, and tests each rule against the collected evidence to confirm it fires on the attacker activity and not on normal administration. Gaps found during the response are logged as backlog items. The output is a change record listing new or tuned rules, the test results and the review by the security operations lead, and the step is complete when those rules are deployed and monitored.

How Velociraptor artifacts and offline collectors keep the work repeatable

Velociraptor queries are wrapped in artifacts, and that is what makes ransomware collection repeatable. Each artifact is a YAML file stored on the server that holds the VQL logic for a collection, such as persistence locations, scheduled tasks, lateral movement evidence or encryption indicators. Responders can view, adjust and add artifacts in the GUI without rebuilding clients or the server, so a new indicator from a fresh ransomware strain can become a hunt within the same incident. The decision to make before an incident is who is allowed to change artifacts during one, and how those changes are recorded so the chain of custody can be explained later to an insurer or law enforcement. The same artifact set can run live through the client on a reachable host or through an offline collector built from the GUI for machines where the agent cannot be installed. Offline collectors have the capabilities of a normal client and write results to JSONL or CSV, so the output from an isolated server or a sealed workstation can be compared with hunt results from the rest of the estate. Confirm with your own engineers which artifacts are tested against offline collectors in your environment, because the collector output format and the artifact parameters you need should be exercised before an incident, not during one.

Version and review artifacts before an incident, not during one. Store artifact definitions in version control, require a second reviewer for changes, and record which release of Velociraptor each collector was built with. The Velociraptor documentation asks users to update to release 0.77.3, published on October 5, 2026, to address multiple CVEs, so the artifact and collector build baseline should include a dated check against the Velociraptor releases page and against your own patch cycle. Test each artifact on a lab host so that a known-good version of the collection logic exists when the incident starts. The server keeps its data in files rather than a separate database, so backup and retention are filesystem decisions. Back up the server data directory and the artifact repository on a schedule that matches your evidence retention policy, and test restores on a separate host. Confirm where the files live if the server runs on a cloud virtual machine with network storage, and confirm that retention settings for collected evidence match legal hold requirements, since deleting collections on a live server can remove evidence that insurers or investigators will ask for.

Which evidence insurers and investigators ask for and which component produces it

This table maps the evidence insurers, counsel and law enforcement typically ask for after a ransomware event to the Velociraptor or Wazuh output that can produce it. Read each row as a request to confirm with your insurer and counsel before collection starts, since required formats and chain of custody rules vary by claim and jurisdiction. The main takeaway is that Velociraptor produces most host-level evidence, while Wazuh supplies the alert history and retention records that show what was seen and when.

Evidence item	Primary component	Supporting component and notes
Scope list of affected hosts	Velociraptor hunt results across enrolled clients	Wazuh agent inventory and vulnerability data to show which hosts were in scope at the time; offline collectors cover hosts without agents
Timeline of execution and logons	Velociraptor artifacts for process, service, scheduled task and logon history	Wazuh alert history and archived events to correlate with the host timeline; confirm time zone and clock source with counsel
Collection hashes and chain of custody records	Velociraptor exports with operator logs and file hashes	Confirm the hashing method, storage location and handover steps against counsel's requirements before the first collection
Wazuh alert and log retention exports	Wazuh indexer storage of alerts and archived events	Confirm the retention period configured for your environment and export it in the format the investigator requests
Detection rules created during the incident	Wazuh rule and decoder changes made after triage	Velociraptor hunt findings that informed each new rule, with version history kept for the investigator
Preparation of evidence packages	Operator-produced documentation from both platforms	DeployOpen prepares systems, controls and evidence. It does not issue audit reports, attestations or certifications; independent auditors and investigators do

What to ask an implementation partner before an incident happens

Most ransomware response delays come from decisions nobody made before the incident: which artifacts exist, who may run them, and how evidence will hold up. The six questions below help you test a partner's readiness while there is still time to fix gaps.

Which artifacts are ready, and who approves changes?

Ask which collection artifacts are already written, tested and stored on the Velociraptor server for ransomware triage, such as running processes, scheduled tasks, services, remote access tools and recent file changes. Ask how each artifact is versioned, who reviews changes before they reach production, and how a partner records which version ran on which host. A library that changes without review makes evidence harder to defend later.

Which hosts get pre-built offline collectors?

Ask which systems in your estate cannot take an agent, such as isolated servers, legacy hosts or operational devices, and whether the partner has built offline collectors for them in advance. Ask what the collector writes (JSONL or CSV), where the output is stored and how a responder would copy it off a host without network access. Pre-built collectors save time when a domain controller or shared file server is already encrypting.

Is the evidence procedure reviewed by counsel?

Ask for a written evidence handling procedure covering chain of custody, hashing, storage location, access logs and how collections are shared with insurers, outside forensic firms or law enforcement. Ask whether your legal counsel has reviewed it and whether the partner can show how a collection would be exported with its metadata intact. Ask who signs the handover record during an incident.

Who can run hunts, and who approves them?

Ask how hunt operator accounts are created, which roles can launch collections across all endpoints, and which roles can only read results. Ask whether one person can both request and approve a hunt, and how the partner logs every action taken in the Velociraptor GUI during an incident. Clear separation of duties keeps a compromised or rushed operator from quietly widening the search or deleting evidence.

How fast are Velociraptor patches applied?

Velociraptor 0.77.3 was released on October 5, 2026, and the documentation asks users to update to that release to address multiple CVEs. Ask the partner which version runs in your environment, how they learn of new security releases, how long they take to test and roll out updates to the server and clients, and what they do if an update cannot be applied during an incident. An unpatched forensic server is also an attack path.

How do findings reach Wazuh detections?

Ask how indicators, persistence locations and attacker tooling found in a hunt become Wazuh rules, decoders or file integrity checks, and who approves them. Ask how each new detection is tested against known-good activity and replayed against the collected samples before it is enabled. A feedback loop without tests can flood analysts with false positives on the day they can least afford it.

Ransomware forensics questions buyers ask before hiring help

What drives the cost of ransomware endpoint forensics help?

The cost follows the written scope, and the main drivers are the number of hosts in scope, how many of them have no agent, how deep the evidence work must go, and how many people must work in parallel. A partner is paid for scoping, collector preparation, hunts, triage analysis and reporting, and the client pays for its own staff time, storage and any retained incident response support. Costs that recur are retainers and support, while collection setup, the first hunt and the report are usually one-time. Ask for the quote to separate these lines, to state assumptions about host counts and log retention, and to say what happens if the incident scope grows. DeployOpen does not publish prices, so the quote comes from the agreed scope.

How long does a ransomware endpoint investigation take?

The duration depends on the written scope, not on a fixed number of days. The main variables are how many endpoints must be triaged, whether collectors must be run on hosts without an agent, how quickly the client can grant access, and how deep the analysis must go before containment decisions are made. Early triage of a known set of hosts can move faster than a full estate hunt that must report to insurers or counsel. Ask any partner to state the phases, the deliverables for each phase, the dependencies on your staff, and the points where they need your decisions. DeployOpen agrees timelines in writing before work starts.

What must our team provide before an forensics engagement starts?

Before work starts, the client needs to provide administrative access to the Velociraptor server or the cloud or data center account that hosts it, a current asset inventory or a way to discover endpoints, and read access to relevant logs such as Wazuh alerts and domain controller events. Legal contacts must be named, including counsel who controls privilege, along with the insurer's contact if a policy requires notice. You also need approval paths for isolating hosts, disabling accounts and changing firewall rules, and a named decision maker who can approve those actions at any hour. Ask for these items in the written scope so that delays do not come from missing access.

Can our own team run ransomware triage without outside help?

Yes, trained staff can run triage with Velociraptor, including the local triage mode started by the velociraptor gui command, which runs a GUI, frontend and local client on one machine. Staff can also run artifacts across the fleet, build offline collectors for hosts without agents and export results to JSONL or CSV. The limits are around court-grade packaging, chain of custody documentation, expert testimony and deep malware analysis, which usually need a specialist or counsel-directed examiner. Your team should decide early which outputs must be defensible in court or to insurers, and whether a partner will be engaged for that part of the work.

Is it safe to deploy Velociraptor during an active incident?

Deploying the client to affected hosts changes those hosts, so it should follow a pre-approved change path, but the agent itself is designed for read-oriented collection through VQL artifacts. Before deployment, confirm which artifacts will run, whether any will write to disk or change state, and how the collection will be logged. Keep the server on a segment that the attacker cannot reach, and confirm that the release you run is current, since the Velociraptor documentation asks users to update to release 0.77.3 to address multiple CVEs. Test the offline collector on one clean host before using it across an estate.

Is Velociraptor still supported since Rapid7 acquired it?

Rapid7 announced on April 21, 2021 that it had acquired Velociraptor and said it would continue to build the community and support the open-source project. The project remains licensed under AGPL-3.0 according to its LICENSE file, so you can run and modify it under those terms. Support for your own deployment depends on whether you run the community release, buy a vendor support arrangement from Rapid7, or engage a partner for planning, upgrades and documentation. Ask any partner which releases they support, how they handle security updates, and what they will do if upstream direction changes.

Should we buy a retainer or a fixed-scope forensics engagement?

A fixed-scope engagement suits a defined incident, such as a known set of affected hosts with a clear question to answer, because scope, deliverables and timelines are agreed in writing before work starts. A retainer suits organizations that want a partner on call for incidents across a changing estate, along with recurring collector updates, playbook reviews and tabletop support. Both models can coexist. Compare how each handles surge work, who holds the evidence, how quickly the partner can start, and what is included in the standby period. DeployOpen offers fixed-scope work and retainers, and ongoing support is available as a retainer.

How DeployOpen scopes and supports ransomware response readiness

DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For ransomware readiness, that means agreeing in writing which Velociraptor deployment, offline collectors and Wazuh integration your environment needs before any work starts.

How we scope

Written scope defines which endpoints, operating systems and network zones Velociraptor must reach.
Scope names the artifacts, hunt types and evidence handling steps your team and counsel require.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work begins.

How we build

Velociraptor server is deployed in your environment, typically on a cloud VM or on-premises Linux host.
Offline collector packages are built for hosts where an agent cannot be installed, and tested before release.
Findings are mapped to Wazuh detection rules so confirmed indicators feed back into alerting.

How we hand over

Runbooks cover triage, hunt, offline collection, chain of custody and evidence export steps.
Documentation records configuration, artifact versions, access roles and retention settings for your records.
Your staff are trained to run collections and hunts, and to review outputs before sharing them externally.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Upgrades address published Velociraptor and Wazuh releases, including security fixes, on an agreed schedule.
Retainers can include periodic exercises that test collection, hunting and evidence steps against your runbooks.

Open source endpoint forensics for ransomware response