At baseVISION, we use Velociraptor as a forensic agent alongside Microsoft Defender XDR in incident response cases to understand what happened on affected systems.
In many environments, forensic data is still handled outside the main security stack. It often involves manual collection and does not integrate well with other security signals, i.e. EDR/XDR telemetry.
As a Microsoft-focused security partner, we aim to use the Microsoft security stack consistently, not just for customers but also in our own incident response work.
Enabling Velociraptor in Azure
Over the last months, we designed, built, and contributed an integration that allows Velociraptor to ingests the collected data directly into Azure Data Explorer (ADX).
This makes it possible to work with forensic endpoint data in the same environment already used for Microsoft Defender, Sentinel, and advanced hunting scenarios, without needing a separate platform for forensic data.
What this means in practice
This approach enables:
- Better use of existing Azure investments: Extend your Azure-based detection and hunting capabilities with forensic endpoint data.
- Correlate data using KQL: Work with Velociraptor data using Kusto Query Language (KQL) and combine it with Defender, identities, or network data when needed.
- Less manual work: Move away from offline collectors and access the data directly in your Azure environment. Offline collectors can still be used i.e. for air-gapped environments.
- Keep the toolset simple: Stay within the Microsoft ecosystem instead of adding more platforms.
Example: Velociraptor Data in Azure
Below is an example of how Velociraptor data can be explored once it is available in Azure Data Explorer.
Velociraptor data ingested into Azure Data Explorer, enabling analysis using KQL