### Run Demo Setup Artifact

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/blog/2021/2021-10-22-a-closer-look-at-the-winning-entry-in-the-2021-velociraptor-contributor-competition-575c387610af/_index.md

Executes the 'Temp.Setup.Demo' artifact to install other artifacts, download tools to the server's inventory, and load server monitoring artifacts. This may take a few minutes due to binary downloads.

```vql
SELECT * from Artifact.Temp.Setup.Demo()
```

--------------------------------

### Install DEB Package on Linux

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/artifact_references/pages/linux.utils.installdeb.md

Use the 'install' command to install a DEB package. This example shows how to handle potential errors during installation.

```python
from velociraptor.tools.linux import install

install("vim", "/tmp/vim.deb")
```

--------------------------------

### Example Linux Path

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/forensic/filesystem/paths/_index.md

Shows a standard Linux file path starting from the root directory and using forward slashes as separators.

```text
/usr/bin/ls
```

--------------------------------

### Start MinIO Server

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/knowledge_base/tips/dropbox_server.md

Starts the MinIO server with specified credentials and storage location. The console and API ports are also defined.

```sh
MINIO_ROOT_USER=admin MINIO_ROOT_PASSWORD=password ./minio server /tmp/minio --console-address ":9001" --address ":4566"
```

--------------------------------

### Generated Server Package Files

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/deployment/server/multifrontend/_index.md

Example output showing the generated Debian package files for a multi-frontend setup, with distinct names for master and minion packages.

```bash
ls -l *.deb
-rw-rw-r-- 1 me me 27429604 Mar 28 16:32 velociraptor_server__master_master.velocidex-training.com-8000_0.74.1_amd64.deb
-rw-rw-r-- 1 me me 27429604 Mar 28 16:32 velociraptor_server__minion_minion.velocidex-training.com-8100_0.74.1_amd64.deb
```

--------------------------------

### Install Timesketch Client Library

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/artifact_references/pages/server.utils.timesketchupload.md

Installs the necessary Timesketch client libraries using pip. Ensure you have Python and pip installed.

```bash
pip install timesketch-import-client timesketch-cli-client
```

--------------------------------

### Serve Documentation Locally with Hugo

Source: https://github.com/velocidex/velociraptor-docs/blob/master/README.md

Run this command to serve the documentation site locally using a natively installed Hugo version. Ensure Hugo is installed on your system.

```bash
hugo serve
```

--------------------------------

### Start Velociraptor Server with Definitions

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/blog/html/2018/12/09/more_on_client_event_collection.md

Start the Velociraptor server with the --definitions flag pointing to your artifact directory. This loads custom artifacts.

```bash
$ velociraptor --definitions path/to/my/artifacts/ frontend

```

--------------------------------

### Copying a file with specified content

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/vql_reference/other/copy/_index.md

This example demonstrates creating a new file with the content "Hello world" and saving it as C:/hi.txt using the data accessor.

```vql
SELECT copy(filename="Hello world", accessor="data", dest="C:/hi.txt")
FROM scope()
```

--------------------------------

### Install Velociraptor as a Windows Service

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/deployment/clients/_index.md

Installs the Velociraptor client as a Windows service using elevated privileges. This method places the binary and configuration in `C:\Program Files\Velociraptor\`, creates the service, and starts it automatically with a delayed start.

```shell
velociraptor.exe service install --config client.config.yaml -v
```

--------------------------------

### Basic Switch Query Example

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/vql_reference/popular/switch/_index.md

Demonstrates the basic syntax of the switch plugin. It executes queries 'a' and 'b' in order, returning results from the first one that produces output.

```vql
SELECT * FROM switch(a={
  SELECT * FROM First
}, b={
  SELECT * FROM Second
})
```

--------------------------------

### Install Velociraptor MSI from Command Line

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/deployment/clients/_index.md

Use this command to install the Velociraptor MSI package from the command line. This requires elevated privileges and will install the binary, client configuration, create the service, and start it.

```shell
msiexec /i velociraptor_custom.msi
```

--------------------------------

### Install Velociraptor as a macOS Service

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/deployment/clients/_index.md

Installs the Velociraptor client as a persistent service on macOS using root privileges. This method configures the client to start automatically via launchd.

```shell
sudo ./velociraptor service install --config client.config.yaml -v
```

--------------------------------

### Compress a file using GZip

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/vql_reference/encode/compress/_index.md

This example demonstrates how to compress a file using the compress function. It takes the OSPath of an executable and compresses it, saving the output with a .gz extension in the same directory.

```vql
SELECT OSPath, compress(path=OSPath, output=OSPath.Dirname + ( OSPath.Basename + ".gz")) AS Compressed
FROM glob(globs="C:/Windows/*.exe")
```

--------------------------------

### Parse SUSE Installed Packages with Zypper

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/artifact_references/pages/linux.suse.packages.md

Executes 'zypper' to get installed packages in XML format and parses the output to extract package details. This is useful for inventory and auditing purposes.

```yaml
name: Linux.SuSE.Packages
author: Hilko Bengen <bengen@hilluzination.de>
description: |
  Parse list of installed packages from zypper output

implied_permissions:
  - EXECVE

sources:
  - precondition: |
      SELECT OS From info() WHERE OS = 'linux'

    query: |
      LET zypper_output = SELECT * 
        FROM execve(
          length=1000000,
          argv=["zypper", "--xmlout", "search", "--installed-only", "--details", "--type=package"])

      LET xml = parse_xml(
          file=str(str=zypper_output.Stdout), 
          accessor="data")

      SELECT * 
      FROM foreach(
        row=xml.stream.`search-result`.`solvable-list`.solvable,
        query= {
          SELECT Attrname AS Package,
                 Attredition AS Version,
                 Attrarch AS Architecture,
                 Attrrepository AS Repository
          FROM _value
        })

```

--------------------------------

### Configure ddclient service startup

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/blog/html/2018/12/22/configuring_velociraptor_for_ssl/_index.md

Configure the ddclient service to run automatically on your VM. This example shows how to set it to run in daemon mode.

```text
# Configuration for ddclient scripts
# generated from debconf on Tue Oct 23 20:25:23 AEST 2018
#
# /etc/default/ddclient

# Set to "true" if ddclient should be run every time DHCP client ('dhclient'
# from package isc-dhcp-client) updates the systems IP address.
run_dhclient="false"

# Set to "true" if ddclient should be run every time a new ppp connection is
# established. This might be useful, if you are using dial-on-demand.
run_ipup="false"

# Set to "true" if ddclient should run in daemon mode
# If this is changed to true, run_ipup and run_dhclient must be set to false.
run_daemon="true"

# Set the time interval between the updates of the dynamic DNS name in seconds.

```

--------------------------------

### Start Virtual Client with Remapping

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/deployment/offline_collections/collection_data/_index.md

Use this command to start a virtual client, connecting it to the server using a client configuration and a remapping file. Ensure the client config and remapping file are in the same directory.

```sh
velociraptor client -c client.root.config.yaml --remap remapping.yaml
```

--------------------------------

### inventory_get Function

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/vql_reference/server/inventory_get/_index.md

Retrieves tool information from the inventory service. This function can be used to get details about installed tools, their versions, and whether a probe is specified.

```APIDOC
## inventory_get Function

### Description
Get tool info from inventory service.

### Arguments
- **tool** (string): Required. The name of the tool to query.
- **version** (string): Optional. The specific version of the tool.
- **probe** (bool): Optional. If specified, only probe the tool definition without materializing.

### Permissions
- SERVER_ADMIN
```

--------------------------------

### Load Demo Setup Artifact

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/blog/2021/2021-10-22-a-closer-look-at-the-winning-entry-in-the-2021-velociraptor-contributor-competition-575c387610af/_index.md

Loads the 'Temp.Setup.Demo' artifact into the Velociraptor server's repository using a VQL query. This artifact is necessary for the subsequent setup steps.

```vql
SELECT artifact_set(prefix="Temp.", definition=Content) AS LoadResponse FROM http_client(url="https://raw.githubusercontent.com/predictiple/VelociraptorCompetition/main/artifacts/Temp.Setup.Demo.yaml")
```

--------------------------------

### Access SMB Shares

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/vql_reference/accessors/smb/_index.md

This example demonstrates how to access SMB shares using the smb accessor. Credentials must be defined in the SMB_CREDENTIALS variable. The 'ServerName' in the dict should match the server name used in the glob path.

```vql
LET SMB_CREDENTIALS <= dict(ServerName="Username:Password")

SELECT OSPath,
FROM glob(globs='*', 
  root="/ServerName/Windows/System32", 
  accessor="smb")
```

--------------------------------

### Run Velociraptor as Windows Service

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/cli/service/_index.md

Runs Velociraptor as a service, typically invoked by the Windows service manager. The example shows the command line configuration for an installed client.

```text
service run
    Run as a service
```

```powershell
"C:\Program Files\Velociraptor\Velociraptor.exe"  --config "C:\Program Files\Velociraptor\client.config.yaml" service run
```

--------------------------------

### Install Cleanup Query with atexit

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/vql_reference/other/atexit/_index.md

Use atexit to register a query that will run when the main query finishes. This example schedules a file removal operation to occur during query unwinding.

```vql
LET _ <= atexit(query={
  SELECT rm(filename="Foobar.txt") FROM scope()
})
```

--------------------------------

### Reading a VHDX file with Partition and NTFS

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/vql_reference/accessors/vhdx/_index.md

This example demonstrates how to read a VHDX file, accounting for partition offsets and parsing the NTFS file system. It selects the OS path and size from the VHDX content.

```vql
SELECT OSPath.Path AS OSPath, Size, Mode.String
FROM glob(
   globs="*", accessor="raw_ntfs", root=pathspec(
     Path="/",
     DelegateAccessor="offset",
     DelegatePath=pathspec(
       Path="/65536",
       DelegateAccessor="vhdx",
       DelegatePath="/tmp/test.vhdx")))
```

--------------------------------

### Fetch External IP using http_client

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/vql_reference/popular/http_client/_index.md

This example demonstrates how to retrieve the client's external IP address by making a GET request to an external service. The 'Content' column is aliased to 'IP' for clarity.

```vql
SELECT Content as IP from http_client(url='http://www.myexternalip.com/raw')
```

--------------------------------

### Go Memory Allocation Profile Example

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/troubleshooting/debugging/internal/go_profiles/_index.md

This example shows a line from the Go memory allocation profile. It indicates the number of current allocations and their total size, along with the total number of allocations made throughout the program's life.

```text
2: 1327104 [2194: 1455833088]
```

--------------------------------

### Check Plugin Version with version()

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/vql_reference/other/version/_index.md

Use the version() function to get the version of a specific plugin. This example demonstrates how to conditionally execute different queries based on the 'glob' plugin's version, falling back to a legacy query if the version is less than 1.

```vql
SELECT * FROM if(
 condition=version(plugin="glob") >= 1,
 then=NewQuery,
 else=LegacyQuery)

```

--------------------------------

### Lint and Clean Yara Rules

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/vql_reference/parsers/yara_lint/_index.md

This example demonstrates how to use the yara_lint function to process Yara rules. It first reads rule files, then applies yara_lint to get a linted version and a cleaned version (with metadata removed). Finally, it combines the cleaned rules into a single file.

```vql
LET rules <= SELECT OSPath AS rule_file,
                    read_file(filename=OSPath) AS original_rule,
                    yara_lint(rules=read_file(filename=OSPath)) AS linted_rule,
                    yara_lint(rules=read_file(filename=OSPath), clean=TRUE) AS cleaned_rule
  FROM glob(globs="/home/me/code/intezer/yara-rules/*.yar")

-- Show the individually linted rules
SELECT * FROM rules

-- Combine the rules and write to a single yar file.
-- We run yara_lint a 2nd time to get the imports at the beginning of the
-- combined file, although you could combine the rules first and then lint them.
SELECT copy(
        accessor="data",
        filename=yara_lint(
          rules=join(
            array=rules.cleaned_rule,
            sep="\n\n")),
        dest="/tmp/cleaned_rules.yar") AS cleaned_output
FROM scope()
```

--------------------------------

### Define and Use Custom Startup Artifact

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/knowledge_base/tips/startup_artifacts.md

Define an artifact inline within the configuration to perform initial server setup. This artifact imports Sigma rules and configures client monitoring.

```yaml
autoexec:
  artifact_definitions:
    - name: InitializeServer
      description: Setup the server on first run
      sources:
        - query: |
            LET _ <= SELECT * 
                     FROM Artifact.Server.Import.CuratedSigma()

            SELECT add_client_monitoring(
                      label="Monitoring",
                      artifact="Windows.Hayabusa.Monitoring",
                      parameters=dict(RuleLevel="Critical, High, and Medium",
                                      RuleStatus="Stable")) AS Monitoring,
                  artifact_set_metadata(name="InitializeServer", hidden=TRUE)
            FROM scope()

Frontend:
  initial_server_artifacts:
    - InitializeServer
```

--------------------------------

### Describe Address in PE File

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/vql_reference/other/describe_address/_index.md

This example demonstrates how to use the `describe_address` function to find the name of the function associated with an RVA within a PE file. It iterates through the export RVAs of a specified DLL, calculates an offset, and then uses `describe_address` to get a description for that address. Requires `FILESYSTEM_READ` permission.

```vql
LET DLL <= "C:/Windows/system32/ntdll.dll"

SELECT _value.Name AS Name,
       _value.RVA AS RVA,
       describe_address(rva=_value.RVA + 10, module=DLL) AS Description
FROM foreach(row=parse_pe(file=DLL).ExportRVAs)
```

--------------------------------

### Execute a Fetched Tool

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/artifacts/tools/_index.md

Execute a tool fetched by Generic.Utils.FetchBinary. This example demonstrates a common pattern of assigning the tool's path to a LET variable and then using it in an execve() call. Note that direct indexing like binary[0].OSPath is not robust if the tool fails to download.

```vql
LET binary <= SELECT OSPath
 FROM Artifact.Generic.Utils.FetchBinary(ToolName="OSQueryLinux")

 SELECT * FROM execve(
    argv=[ binary[0].OSPath, "--json", Query],
    length=1000000)
```

--------------------------------

### Test SMB Upload and Directory Listing with VQL

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/knowledge_base/tips/setup_smb_share.md

This VQL query demonstrates how to set up SMB credentials, upload a test file to a specified SMB share, and then attempt to list the contents of that share. It's used to verify the SMB configuration and permissions.

```vql
LET SMB_CREDENTIALS <= dict(`192.168.1.112`="uploader:test!password")

SELECT upload_smb(accessor="data",
    file="Hello world",
    name="hello.txt",
    server_address="//192.168.1.112/uploads")
FROM scope()

SELECT *
FROM glob(globs="*",
    root="//192.168.1.112/uploads",
    accessor="smb")
```

--------------------------------

### Install RPM Server Package

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/deployment/server/deployment_example/_index.md

Install the Velociraptor server using the rpm command on RPM-based systems. This command installs the package and sets up the systemd service.

```sh
sudo rpm -Uvh velociraptor-server-0.74.2.x86_64.rpm
```

--------------------------------

### MinIO Client (mc) Setup and Usage

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/knowledge_base/tips/offline_collector_tool.md

Commands to download and set up the MinIO client (mc) for interacting with the Garage S3 server. Includes setting up aliases with credentials and performing basic bucket operations like copying, listing, and removing files.

```sh
# download the tool and make it executable
wget https://dl.min.io/client/mc/release/linux-amd64/mc
chmod +x ./mc

# Save credentials and connection info for the mc tool
mc alias set \
garage \
http://192.168.56.1:3900 \
GK08c8137adf22d3b08c6ea088 \
389adafacb2e3b1c96f9216b9a77c89b74b4d64949d1a0e90f3ca88378f2ca4e \
--api S3v4

# copy a file to the bucket
mc cp /proc/cpuinfo garage/offline-collections/cpuinfo.txt

# list bucket contents
mc ls garage/offline-collections

# remove everything from the bucket
mc rm --force --recursive garage/offline-collections
```

--------------------------------

### Install Debian Server Package

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/deployment/server/deployment_example/_index.md

Install the Velociraptor server using the dpkg command on Debian-based systems. This command installs the package and sets up the systemd service.

```sh
sudo dpkg -i velociraptor_server_0.74.2_amd64.deb
```

--------------------------------

### Use Level-6 Heading for Examples

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/dev/prose-guidelines/_index.md

Always use Level-6 headings for examples to ensure consistent styling and enable community support via hyperlinks. Do not use a colon after 'Example'.

```markdown
###### Example
```

--------------------------------

### Create an Index from a Query

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/vql_reference/other/index/_index.md

This example demonstrates how to create an index from a VQL query. It selects file paths and reads their content, then indexes this data into a specified output path. Ensure you have FILESYSTEM_WRITE permissions.

```vql
LET DataStream = SELECT OSPath, read_file(filename=OSPath) AS Data
FROM glob(globs="/etc/*")
WHERE NOT IsDir AND NOT IsLink

SELECT * FROM index(query=DataStream, output=IndexPath)
```

--------------------------------

### OSPath Manipulation Examples

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/forensic/filesystem/paths/_index.md

Demonstrates common OSPath manipulation techniques including accessing components, basename, dirname, and appending new path segments using the addition operator.

```vql
SELECT OSPath.Components, OSPath.Basename, OSPath.Dirname, OSPath + "a/b/c/filename"
FROM glob(globs="C:/Windows/*")
```

```vql
SELECT pathspec(Path="D:", path_type="windows") + OSPath[1:]
FROM glob(globs="C:/Windows/*")
```

--------------------------------

### Installing pyvelociraptor

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/server_automation/server_api/_index.md

Install the official Python bindings for Velociraptor using pip.

```APIDOC
## Install pyvelociraptor

### Description
Installs the pyvelociraptor package for interacting with the Velociraptor API from Python.

### Command
```bash
pip install pyvelociraptor
```
```

--------------------------------

### Install Jupyter and Pandas

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/blog/2020/2020-03-06-velociraptor-post-processing-with-jupyter-notebook-and-pandas-8a344d05ee8c/_index.md

Install Jupyter and Pandas using pip. Matplotlib is also recommended for plotting.

```bash
pip install jupyter pandas matplotlib

```

--------------------------------

### Example Windows Path

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/forensic/filesystem/paths/_index.md

Illustrates a typical Windows file path, including drive letter, backslash separators, and filename.

```text
C:\Windows\System32\Notepad.exe
```

--------------------------------

### Example Pre-seed Line

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/artifact_references/pages/linux.utils.installdeb.md

This is an example of a pre-seed line for debconf, specifying the answer for a package configuration question.

```text
wireshark-common/install-setuid,boolean,false
```

--------------------------------

### Go CPU Profile Conversion and Viewing Command

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/troubleshooting/debugging/internal/go_profiles/_index.md

This command demonstrates how to convert a Go CPU profile binary into a format suitable for analysis with kcachegrind and then launch kcachegrind to view the profile. This is useful for identifying performance bottlenecks.

```bash
go tool pprof -callgrind -output=/tmp/profile.grind /tmp/profile.bin && kcachegrind /tmp/profile.grind
```

--------------------------------

### Install Debian Package

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/docs/deployment/clients/_index.md

Install the created Velociraptor client Debian package using dpkg. After installation, you can check the service status using `systemctl status velociraptor_client` on systemd systems or `service velociraptor_client status` on SysVinit systems.

```shell
sudo dpkg -i velociraptor_client_amd64.deb
```

--------------------------------

### Setup SFTP Upload Directory

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/knowledge_base/tips/setting_up_sftp.md

Creates a directory for uploaded files and sets ownership and permissions. The directory is made writable by others but not readable to prevent listing.

```bash
mkdir -p /var/sftp/files
chown root:root /var/sftp/files

# Allow anyone to write there
chmod o+wx /var/sftp/files

# No directory listing possible
chmod o-r /var/sftp/files
```

--------------------------------

### Split Commandline with commandline_split

Source: https://github.com/velocidex/velociraptor-docs/blob/master/content/vql_reference/parsers/commandline_split/_index.md

Demonstrates splitting a commandline string using default Windows conventions and Bash-style conventions.

```vql
SELECT
  commandline_split(command='''"C:\\Program Files\\Velociraptor\\Velociraptor.exe" service run'''),
  commandline_split(command="/usr/bin/ls -l 'file with space.txt'", bash_style=TRUE)
FROM scope()
```