Velociraptor Install Debian

Install and Setup Velociraptor on Debian 10

Introduction

Velociraptor is an open source endpoint monitoring tool that allows collection of host-based state information.

Requirements

To install a Velociraptor Linux server and use it to monitor a Windows endpoint, you will need the following:

• A Debian 10 Linux machine (64-bit)
• A Windows endpoint to monitor

Installation

### Server Installation 1. Download the latest Velociraptor release binary from the GitHub Release Page. 2. Regenerate a new Debian package using the following commands: ``` dpkg-deb -b velociraptor--linux-amd64.tar.gz ``` 3. Push the Debian package to the server using Secure Copy Protocol (SCP): ``` scp velociraptor_server.deb :/tmp ``` 4. Install the package: ``` sudo dpkg -i velociraptor_server.deb ``` 5. Start the Velociraptor service: ``` sudo service velociraptor start ``` ### Client Installation (Linux) 1. Install the Velociraptor client packages: ``` sudo apt-get install velociraptor-client ``` ### Client Installation (Windows) 1. Download the Velociraptor MSI installer from the GitHub Release Page. 2. Run the installer. 3. Select the "Custom" installation type and specify the following configuration file path: ``` C:\Program Files\Velociraptor\Velociraptor.exe config clientconfig.yaml service install ```

Configuration

1. Create a configuration file for the server and clients: ``` sudo nano /etc/velociraptor/serverconfig.yaml sudo nano /etc/velociraptor/clientconfig.yaml ``` 2. Add the following settings to the server config file: ``` datastore_address: 127.0.0.1:50051 ``` 3. Add the following settings to the client config file: ``` datastore_address: :50051 ```

Usage

1. Start the Velociraptor GUI: ``` sudo velociraptor ``` 2. Connect to the server: ``` File -> Connect to Server ``` 3. Enter the server's IP address and port (default: 50051). 4. Investigate the endpoints.

Conclusion

Congratulations! You have now successfully installed and configured Velociraptor on Debian 10 and can use it to monitor endpoints.