Velociraptor 0.77 on Ubuntu 24.04 on Azure User Guide

Overview

Velociraptor is a leading open-source digital forensics and incident response (DFIR) and endpoint-visibility platform. A central server with a web GUI lets responders collect forensic artifacts, run hunts across a fleet of endpoints at once, and monitor hosts in real time using VQL — the Velociraptor Query Language. It ships as a single self-contained Go binary that embeds the server, the client-communications frontend and the GUI, backed by a filesystem datastore (no external database).

The cloudimg image installs the pinned upstream v0.77.2 release binary (verified by SHA-256), runs the server as a hardened systemd service, and puts the web GUI behind an nginx TLS reverse proxy. At first boot, velociraptor-firstboot.service generates this VM's own server configuration (a unique certificate authority and server/GUI certificates), mints a random password for the cloudimg GUI administrator, issues the nginx TLS certificate, and writes the credentials to /stage/scripts/velociraptor-credentials.log (mode 0600, root only). There is no shared or default login in the image — a fresh configuration has zero GUI users until first boot creates the per-VM admin.

What is included:

• Velociraptor 0.77.2 single Go binary (/usr/local/bin/velociraptor, AGPL-3.0)
• Filesystem datastore + filestore at /var/lib/velociraptor (no database to maintain)
• velociraptor.service running the server as the velociraptor user, gated on the first-boot marker
• velociraptor-firstboot.service generating the per-VM config + GUI admin + TLS certificate
• Web GUI on loopback (127.0.0.1:8889, plain HTTP) fronted by nginx TLS on 443
• Client-communications frontend on TCP 8000 (mutual-TLS, certificate-pinned)
• The full built-in artifact catalogue (440+ forensic collectors) ready to hunt
• Ubuntu 24.04 LTS base, latest security patches applied at build time
• 24/7 cloudimg support, 24h response SLA

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet. Recommended VM size: Standard_B2s for evaluation and small deployments; scale up for large fleets. You will reach the GUI over HTTPS (port 443); endpoints you later enrol connect to the frontend on port 8000.

Step 1: Deploy from the Azure Portal

Search the Azure Marketplace for Velociraptor 0.77 on Ubuntu 24.04. Create the VM with an NSG that allows:

• TCP 22 (SSH) from your management network
• TCP 443 (the web GUI over TLS) from your admin network
• TCP 8000 (client communications) from the networks your endpoints live on — only needed once you enrol endpoints

Step 2: Deploy from the Azure CLI

RG="velociraptor-prod"; LOCATION="eastus"; VM_NAME="velociraptor-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/velociraptor-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name velo-vnet --address-prefix 10.104.0.0/16 --subnet-name velo-subnet --subnet-prefix 10.104.1.0/24
az network nsg create -g "$RG" --name velo-nsg
az network nsg rule create -g "$RG" --nsg-name velo-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name velo-nsg --name allow-gui --priority 110 \
  --source-address-prefixes "<your-admin-cidr>" --destination-port-ranges 443 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name velo-nsg --name allow-frontend --priority 120 \
  --source-address-prefixes "<your-endpoint-cidr>" --destination-port-ranges 8000 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name velo-vnet --subnet velo-subnet --nsg velo-nsg --public-ip-sku Standard

Step 3: Connect via SSH

ssh azureuser@<vm-ip>

Step 4: Verify the Services

Confirm first boot completed and the server plus TLS proxy are running. Note the GUI is bound to loopback only — nginx is the sole public entry point.

systemctl is-active velociraptor-firstboot.service velociraptor.service nginx.service
sudo /usr/local/bin/velociraptor version | grep -i version
ss -ltn | grep -E ':(443|8000|8889)'

Step 5: Retrieve the Admin Password

Each VM mints its own cloudimg GUI administrator password at first boot. Read it from the root-only credentials file:

sudo cat /stage/scripts/velociraptor-credentials.log

# Velociraptor 0.77.2 — Per-VM Credentials
#
# Web GUI (HTTPS via nginx):  https://<vm-ip>/
# Sign in:                    cloudimg / <password below>
#
VELOCIRAPTOR_USER=cloudimg
VELOCIRAPTOR_PASSWORD=<VELOCIRAPTOR_PASSWORD>
VELOCIRAPTOR_URL=https://<vm-ip>/
GUI_PORT=8889
FRONTEND_PORT=8000

Step 6: Sign in to the Web GUI over TLS

The GUI is served over HTTPS by nginx and enforces HTTP Basic authentication. Prove the front door is up and that authentication is enforced (no or guessed credentials are rejected, the per-VM admin succeeds):

PASS=$(sudo grep '^VELOCIRAPTOR_PASSWORD=' /stage/scripts/velociraptor-credentials.log | cut -d= -f2-)
curl -ks -o /dev/null -w 'healthz            -> HTTP %{http_code}\n' https://127.0.0.1/healthz
curl -ks -o /dev/null -w 'no credentials     -> HTTP %{http_code}\n' https://127.0.0.1/app/index.html
curl -ks -o /dev/null -w 'admin:admin guess  -> HTTP %{http_code}\n' -u admin:admin https://127.0.0.1/app/index.html
curl -ks -o /dev/null -w 'cloudimg admin     -> HTTP %{http_code}\n' -u "cloudimg:$PASS" https://127.0.0.1/app/index.html

Expected: healthz -> 200, no credentials -> 401, admin:admin guess -> 401, cloudimg admin -> 200.

Now open https://<vm-ip>/ in your browser and sign in as cloudimg with the password from Step 5. (The TLS certificate is self-signed per VM; accept it, or replace it with your own certificate in /etc/nginx/ssl/.) You land on the Velociraptor welcome dashboard:

Step 7: Explore the DFIR Console

Open View Artifacts to browse the built-in artifact catalogue — hundreds of forensic collectors, each defined in VQL. Selecting one (for example Generic.Client.Info) shows its description and source query:

Open Hunt Manager to create and monitor fleet-wide collections — a hunt runs a chosen artifact across every enrolled endpoint and streams the results back:

Open Notebooks for collaborative VQL investigation notebooks — post-process collected data, pivot, and document findings alongside the queries that produced them:

Step 8: Run a VQL Query from the CLI

The same DFIR engine runs VQL directly from the command line — useful for scripting and quick checks. Query the server's own host, then confirm the artifact catalogue is loaded:

sudo /usr/local/bin/velociraptor --config /etc/velociraptor/server.config.yaml \
  query "SELECT OS, Platform, Hostname, Fqdn FROM info()"
sudo /usr/local/bin/velociraptor --config /etc/velociraptor/server.config.yaml \
  artifacts list | wc -l

Step 9: Enrol Endpoints

To collect from real endpoints, generate a client configuration and install the Velociraptor client (agent) on each host. The client config embeds this server's certificate authority, so endpoints connect to the frontend (port 8000) over pinned mutual TLS:

# Generate a client config for endpoints to use (writes to stdout):
sudo /usr/local/bin/velociraptor --config /etc/velociraptor/server.config.yaml \
  config client > /tmp/client.config.yaml
head -20 /tmp/client.config.yaml

Copy client.config.yaml to each endpoint, install the matching Velociraptor client package (downloadable from the GUI welcome screen under Build Linux/Windows client packages), and start it pointing at that config. Enrolled hosts then appear in the GUI search and become targets for hunts.

Step 10: Managing the Service

sudo systemctl status velociraptor --no-pager
sudo systemctl restart velociraptor
sudo journalctl -u velociraptor -n 50 --no-pager

The server configuration lives at /etc/velociraptor/server.config.yaml; the datastore at /var/lib/velociraptor. Back up both to preserve your server identity (CA) and collected data.

Step 11: Security Recommendations

• Restrict the NSG. Expose port 443 only to your admin network and port 8000 only to the networks your endpoints live on. Keep SSH (22) limited to management ranges.
• Replace the self-signed TLS certificate. Drop your own certificate and key into /etc/nginx/ssl/velociraptor.crt / .key and reload nginx for a browser-trusted GUI.
• Rotate the GUI admin password and add per-analyst accounts with appropriate roles (velociraptor user add <name> --role <role>), rather than sharing the cloudimg login.
• The GUI is never exposed directly — it binds to 127.0.0.1:8889 and is only reachable through the nginx TLS proxy.

Step 12: Support and Licensing

Velociraptor is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). The complete corresponding source is available from the upstream project at github.com/Velocidex/velociraptor. The AGPL-3.0 licence text ships in the image and is retrievable from the upstream release.

Need Help?

cloudimg images come with 24/7 support and a 24-hour response SLA. Contact support through the Azure Marketplace listing or at cloudimg.co.uk.