Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .wordlist.txt
Original file line number Diff line number Diff line change
Expand Up @@ -2033,3 +2033,6 @@ pathname

Bleve
dir

FTS
NoSQL
105 changes: 105 additions & 0 deletions content/blog/2026/2026-03-10-release-notes-0.76/_index.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,105 @@
---
title: "Velociraptor 0.76 Release"
description: |
Velociraptor Release 0.76 is now available

tags:
- Release

author: "Mike Cohen"
date: 2026-03-10
noindex: false
draft: true
---

I am very excited to announce that the latest Velociraptor release
0.76 is now available.

In this post I will discuss some of the new features introduced by
this release.

## GUI Improvements

This release improves a number of GUI features.

### Local searchable documentation

Recently we have been having issues with Google refusing to index of
our documentation website, despite our best efforts to get them to do
so. This has made it frustrating for users trying to find relevant
technical information.

To help mitigate this problem we have added a local documentation
search feature that allows you to search our docs directly from the
Velociraptor GUI. You can read more about how to use it
[here]({{< ref "/docs/gui/local_docs/" >}}).

![Local documentation search and preview](local_docs_search.png)

This search feature is powered by the
[Bleve](https://blevesearch.com/) search engine, which is also now
available to be used for indexing and searching VQL query results
[as described below]({{< relref "#full-text-indexing-and-searching" >}}).


## New VQL plugins

### Full text indexing and searching

Many users forward their Velociraptor results to Elasticsearch or
Opensearch so that the data is indexed and more easily searchable. In
this release we've added the ability to index and search results
locally using the [Bleve](https://blevesearch.com/) search engine,
which provides Full Text Search (FTS) capabilities similar to
Elasticsearch and other NoSQL database solutions.

This capability is provided by the following new VQL plugins:
- [index]({{< ref "/vql_reference/other/index" >}})
- [index_search]({{{< ref "/vql_reference/other/index_search/" >}}})



## Removed plugins

[ need to rephrase etc - this is just coped from the PR ]

There are a couple of very large libraries with huge API surface,
making the binary extremely large:

1. The Elastic library is now handled via a fork to isolate just the
Bulk upload API - reducing the binary size by 16mb
2. The next largest library is the AWS client library used by
`s3_upload()` increasing the binary size by 6mb.
3. The Google cloud client library is also huge at around 5mb

However for regular builds:

- Use the MinIO S3 library to connect to AWS - this library is much
much smaller and easier to use.
- Remove Google cloud dependencies: pubsub is a rarely used feature,
and with Google cloud storage (GCS) we can always enable S3
compatible mode so there is no real need for specific GCS access.
- Removed the starlark() plugin since it is not really very often
used.

From this version we've introduced a new build tag `sumo` which
includes these large libraries if anyone really needs them.
By enabling `sumo` build tags (i.e. `make linux_sumo`) it is possible
to build a larger binary with the full AWS and Google client
libraries.


## Conclusions

There are many more new features and bug fixes in the latest release.
Please download the release candidate and give it a test and provide
feedback.

If you like the new features, take [Velociraptor for a
spin](https://github.com/Velocidex/velociraptor)! It is available
on GitHub under an open source license. As always please file issues
on the bug tracker or ask questions on our mailing list
[velociraptor-discuss@googlegroups.com](mailto:velociraptor-discuss@googlegroups.com)
. You can also chat with us directly on discord
[https://www.velocidex.com/discord](https://www.velocidex.com/discord)
.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
14 changes: 11 additions & 3 deletions content/docs/file_collection/exporting/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -90,10 +90,18 @@ files. If you are preparing exports for collections or hunts that are
unusually large, then the default timeout (10 minutes) for this process may be
insufficient.

In that case, you may need to set a greater timeout value, which you can do via
the
In that case, you may need to set a greater timeout value, which you
can do by preparing the export via a server artifact, with an extended
timeout value. This approach is demonstrated by the
`Server.Utils.ExportHunt` artifact.

Alternatively, if you persistently need a higher timeout value, you
can set it globally via the
[defaults.export_max_timeout_sec]({{< ref "/docs/deployment/references/#defaults.export_max_timeout_sec" >}})
setting in the server config.
setting in the server config. However, as with all resource limits,
the default values are intended to protect your server from unusual
resource consumption, so you should try to avoid changing the global
defaults unless you've considered the potential impacts.

There is also a default limit of 10 concurrent export preparation processes. If
your server hardware is capable of more then you might need to increase this
Expand Down
72 changes: 39 additions & 33 deletions content/docs/gui/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -90,46 +90,52 @@ by editing the `Server.Monitor.Health` artifact.

{{% /notice %}}

### Table Widgets
### Working with tables

A common UI element in the Velociraptor GUI is the table widget. Since
Velociraptor deals with VQL queries and all queries simply return a
list of rows, the GUI presents a lot of results in a table form.
Since VQL queries are at the core of Velociraptor, and all queries
return a list of rows (i.e. a table of data), much of the GUI is
dedicated to presenting these results in tabular form.

![Table widgets](table_widgets.png)
All Velociraptor tables have a common set of tools available, which
are available in a common table toolbar that you'll see whenever
tabular results are presented in the GUI.

All Velociraptor tables have some common tools available as can be
seen above:
![Table manipulation and navigation widgets](table_widgets.png)

1. **Collapse/Expand All Columns** - Sometimes the content of some cells can take up
a lot of vertical space. This option toggles between showing the full row
heights or shrinking the row display to a standard height.
![](widget_collapse.png)
The table toolbar consists of the following buttons:

2. **The Column Selector** - Allows users to show/hide columns. This is
useful when there are many columns and the table takes up a lot of
horizontal real estate, or when some columns provide too much
data that you don't want to see.
![](widget_columns.png)
- **Collapse/Expand All Columns** - Sometimes the content of some
cells can take up a lot of vertical space. This option toggles
between showing the full row heights or shrinking the row display to
a standard height.

3. **View Raw JSON** - All VQL queries simply return a result set encoded
as a list of JSON objects. For more complex tables it is sometimes
easier to see the precise JSON returned, and clicking on this
button displays the raw json in a dialog box.
![](widget_collapse.png)

![Raw JSON viewer](raw_json_view.png)
- **The Column Selector** - Allows users to show/hide columns. This is
useful when there are many columns and the table takes up a lot of
horizontal real estate, or when some columns provide too much data
that you don't want to see.

4. **Download table as CSV or JSON** - Clicking on these buttons exports the
_visible_ table data to a CSV or JSON file. This is usually used to filter
out uninteresting columns and produce data files that can be used in other
applications, e.g. Excel.
![](widget_columns.png)

5. **Fullscreen** - A new feature in version 0.75 is that an individual table
can be viewed fullscreen. This opens the table in fullscreen view in a new
browser tab. This is useful when working with large tables where you need all
the screen space you can get.
- **View Raw JSON** - All VQL queries simply return a result set
encoded as a list of JSON objects. For more complex tables it is
sometimes easier to see the precise JSON returned, and clicking on
this button displays the raw json in a dialog box.

6. **Pagination/Navigation Widget** - The right side of the table widget is
where you will find all the options to navigate through the table data. You
can choose how many rows to display per page and navigate forward/back, or
skip to the first, last, or a specific page number.
![Raw JSON viewer](raw_json_view.png)

- **Download table as CSV or JSON** - Clicking on these buttons
exports the _visible_ table data to a CSV or JSON file. This is
usually used to filter out uninteresting columns and produce data
files that can be used in other applications, e.g. Excel.

- **Fullscreen** - This opens the table in fullscreen view in a new
browser tab. This is useful when working with large tables where you
need all the screen space you can get.

- **Pagination/Navigation Widget** - To the right side is the table
navigation widget. This is where you will find all the options to
navigate through the table data. You can choose how many rows to
display per page and navigate forward/backward, skip to the first,
last, or go to a specific page number.
4 changes: 2 additions & 2 deletions content/docs/gui/artifacts/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ menutitle: Managing Artifacts
date: 2025-05-03
last_reviewed: 2025-05-18
draft: false
weight: 10
summary: "How to find, manage, create and edit artifacts in the GUI"
weight: 60
summary: How to find, manage, create and edit artifacts in the GUI
---

## Finding, managing, creating and editing artifacts in the GUI
Expand Down
6 changes: 3 additions & 3 deletions content/docs/gui/authentication/_index.md
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
---
menutitle: "Authentication"
title: "Authenticating Users"
menutitle: Authenticating Users
title: Authenticating Users
date: 2025-01-29
draft: true
weight: 5
weight: 10
---

https://github.com/Velocidex/velociraptor/tree/master/api/authenticators
69 changes: 49 additions & 20 deletions content/docs/gui/customizing/_index.md
Original file line number Diff line number Diff line change
@@ -1,16 +1,36 @@
---
title: Customizing the GUI
menutitle: Customization
menutitle: GUI Customization
date: 2025-09-26
last_reviewed: 2025-09-29
last_reviewed: 2026-03-10
draft: false
weight: 100
summary: "Customize your GUI experience."
weight: 40
summary: Customize the GUI experience
---

Several aspects of the GUI can be customized to suit your
organizational needs:

* [Certain pages in the GUI can be customized](#custom-gui-pages).
* [Custom sidebar links and context menus items can be created](#create-sidebar-links-and-context-menus-for-external-resources).
This can be done globally (for all users) or on a per-user basis.
* [Custom themes can be added](#developing-custom-themes).
* [Additional language translations can be added](#developing-custom-translations).

The last two items require code-level changes and are therefore only
recommended for developers, however Velociraptor is designed so that
these can be done in a relatively easy modular way. For more
information, see the relevant section below. If you do decide to
develop new themes or language translations for the GUI, then we hope
you'll consider contributing these back to the project for the benefit
of the Velociraptor community!

## Custom GUI pages

Certain pages in the GUI allow for customization. The layout and content of
these pages are defined in corresponding Velociraptor
[artifacts]({{< ref "/docs/artifacts/" >}}).

These artifacts contain templates written in
[Go's templating language](https://pkg.go.dev/text/template)
that then produce the HTML that the user ultimately sees and interacts with.
Expand All @@ -20,29 +40,38 @@ the Go Template Language. This allows you to also include VQL queries
(server-side only, since this is where the templates are run!) in your template,
and display the results in tabular or various graphical formats.

{{% notice info "Some web development experience is required" %}}

Customizing GUI content does require a reasonable degree of understanding of
HTML as well as of Go's templating language. Typically customization amounts to
small tweaks where you might make a change to the layout or customize specific
elements that you don't like, although extensive customization can be done if
you really need to.
Customization of these artifacts and the corresponding pages they
produce are global changes. That is, the customizations are visible to
all users on the server, unlike
[user preferences]({{< ref "/docs/gui/user_preferences/" >}})
which are per-user.

There are many excellent guides to templating and HTML available on the internet
and for that reason this is not intended to be a tutorial on those topics.
{{% notice info "Some web development experience is required" %}}

If this is all new to you, you can still experiment by changing one small thing
at a time. Because the customization is done via a custom artifact, if you mess
it up you can always delete the custom artifact and Velociraptor will then
revert to using the default built-in one!
Customizing GUI content does require a reasonable degree of
understanding of HTML as well as of Go's templating language. Typical
customization usually amounts to small tweaks where you might make a
change to the layout or customize certain elements to suit your needs.
However, extensive customization can be done if you really need to.

There are many excellent guides to templating and HTML available on
the internet and for that reason this is not intended to be a tutorial
on those topics.

If this is all new to you, you can still experiment by changing one
small thing at a time. The customizations are implemented as custom
artifacts, so if you mess it up you can always delete the custom
artifact and Velociraptor will then revert to using the default
built-in one. For obvious reasons, we recommend that all
customizations be developed and tested on a non-production server. You
can easily transfer your custom artifacts to a different server once
you are happy with them.

{{% /notice %}}

## Which pages can be customized?

Currently there are 3 pages in the GUI that support full customization.

These, and their corresponding artifacts, are:
These pages and their corresponding artifacts, are:

- `Server.Internal.Welcome` - The Welcome page
![](welcome.png)
Expand Down
2 changes: 1 addition & 1 deletion content/docs/gui/keyboard_shortcuts/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ date: 2025-05-16
last_reviewed: 2025-09-04
draft: false
weight: 80
summary: "Learn about keyboard shortcuts in the GUI"
summary: Learn about keyboard shortcuts in the GUI
---

The Velociraptor GUI supports many keyboard shortcuts to navigate around
Expand Down
Loading
Loading