Anthropic-Cybersecurity-Skills/skills/implementing-velociraptor-for-ir-collection/references/standards.md

Standards and Frameworks for Velociraptor IR Collection

NIST SP 800-86 - Guide to Integrating Forensic Techniques

• Evidence collection procedures for digital investigations
• Chain of custody requirements for forensic data
• Volatile and non-volatile evidence prioritization

ForensicArtifacts Standard

• YAML-based artifact definition format used by Velociraptor
• Cross-platform artifact repository
• Community-contributed artifact definitions
• Reference: https://github.com/ForensicArtifacts/artifacts

SANS DFIR Collection Standards

• FOR500: Windows Forensic Analysis artifact prioritization
• FOR508: Advanced Incident Response collection methodology
• Evidence acquisition order of volatility
• Triage collection best practices

Velociraptor Query Language (VQL) Reference

• SQL-like query language for endpoint interrogation
• Plugin system for extending collection capabilities
• Artifact definition YAML format
• Reference: https://docs.velociraptor.app/docs/vql/

MITRE ATT&CK Framework

• Artifact mapping to ATT&CK techniques
• Detection-oriented collection strategies
• Threat-informed artifact selection
• Reference: https://attack.mitre.org/

Sigma Detection Standard

• Velociraptor supports Sigma rule execution on endpoints
• Direct event log analysis without SIEM forwarding
• Community detection rules integration
• Reference: https://github.com/SigmaHQ/sigma

CISA Recommended Practices

• Velociraptor listed as CISA-recommended tool
• Federal incident response procedures
• Evidence preservation requirements
• Reference: https://www.cisa.gov/resources-tools/services/velociraptor

Rapid7 Integration Standards

• InsightIDR SIEM integration documentation
• Managed Detection and Response workflows
• Velociraptor alert forwarding specifications