run digital forensics and incident response hunts across your endpoints from one web console
Velociraptor is an open source endpoint visibility and digital forensics and incident response platform. A central server with a web GUI lets responders collect forensic artifacts, run hunts across many machines at once and monitor endpoints in real time using a flexible query language. Analysts use it to answer what happened on a host, to sweep a fleet for indicators of compromise, and to gather evidence for investigations, all driven from the browser and backed by a filesystem datastore that needs no separate database.
cloudimg ships the Velociraptor server assembled and hardened, with the web GUI bound to loopback behind nginx TLS so the management surface is reachable only over an encrypted connection. There is no shared credential in the image: it carries no server configuration, no certificate authority and no GUI account. On first boot each instance generates its own server configuration with a unique certificate authority, mints a random administrator password for the cloudimg GUI account and issues its own TLS certificate, writing the credentials to a root only file, with the server gated behind a bootstrap marker so an unprovisioned instance is never reachable and the documented default login simply does not exist. Every deployment is paired with a step by step guide and backed by 24/7 cloudimg support.
Real screenshots taken while testing this image against its deployment guide.