Artifacts are at the heart of everything Velociraptor does. An artifact is simply a collection of VQL queries encapsulated in a YAML file.
In this part of the interface you may view all the artifacts available to be used. The builtin directory contains all the artifacts which come built into Velociraptor, while the custom directory contains artifacts edited or created locally.
If you want to add or edit existing artifacts, simply click the button above. An editor will appear where you may edit the artifact.
The server can be configured to run VQL event queries server side. These queries are encapsulated in server event artifacts.
Typically server event artifacts are used to watch and react to client side events. The artifacts run indefinitely and write their results into daily logs (similar to client side event artifacts).
Select a server event artifact in the tree view to see the daily logs from this artifact.
If you want to add or remove the running server event artifacts, click the button above.
Each time an artifact is collected from a client, Velociraptor stores it centrally under the artifacts tree. You can see an overview of all the artifacts and the time they were collected on that host.
Select an artifact in the tree view to see all the times this particular artifact was collected.
Clients are monitored for specific events of interest by launching monitoring artifacts on them. These artifacts stream events to the server as soon as they occur on the client. The server stores these events in daily monitoring log files.
Select an artifact in the tree view to see the daily event logs from this particular artifact.
If you want to add or remove the monitoring artifacts collected
from clients, click the button above.