The open-source digital forensics and incident response tool Velociraptor has released version 0.74, introducing native support for cloud forensics across AWS, Azure, and Google Cloud Platform. The update enables investigators to collect artifacts from cloud workloads without deploying agents to individual instances.
Key additions include pre-built collection modules for cloud audit logs, container runtime analysis, and serverless function execution traces. The new cloud connector framework allows custom artifact creation using the same VQL query language familiar to existing users.
The development team also improved the platform's scalability, with benchmarks showing support for up to 50,000 concurrent endpoints on a single server instance. Community contributors can access the new features immediately through the project's GitHub repository.
