Description

n8n-nodes-velociraptor

> ⚠️ WARNING: AI-GENERATED CODE — NOT PRODUCTION-READY
> This package was generated with AI assistance and is known to contain bugs. It is provided as-is for experimental and testing purposes only. Do NOT use in production environments. No support or warranty is provided.

An n8n community node for interacting with the Velociraptor DFIR platform via its gRPC API.

Features

• Execute VQL — Run any Velociraptor Query Language (VQL) query against your server
• List Clients — Retrieve enrolled clients, optionally filtered by OS, hostname, label, or last-seen time
• Collect Artifact — Trigger an artifact collection on a client with optional JSON parameters
• Collect VFS File — Trigger collection of a specific file path from a client via the VFS
• Get Flow Status — Poll the status of a collection flow until it completes or errors
• Get Flow Results — Retrieve results of a completed flow; returns one item per artifact source with shape { artifact, source, result_count, rows }
• List Flow Uploads — List files uploaded by a VFS collection flow
• Download Flow File — Download an uploaded file from a flow as binary data, optionally filtered by path

Prerequisites

• A running Velociraptor server with the API enabled
• An apiclient.yaml generated from your Velociraptor server (contains mTLS certificates)
• n8n >= 1.0.0
• Node.js >= 18.0.0

Generate an API client certificate

On your Velociraptor server:

velociraptor --config /etc/velociraptor/server.config.yaml config api_client 
  --name n8n-automation 
  --role administrator 
  api_client.yaml

Keep this file secure — it grants API access to your Velociraptor server.

Installation

Via n8n Community Nodes UI (recommended)

1. Open your n8n instance
2. Go to Settings → Community Nodes
3. Click Install a community node
4. Enter: n8n-nodes-velociraptor
5. Click Install

Via npm (self-hosted n8n)

npm install n8n-nodes-velociraptor

Then restart your n8n instance.

Credentials Setup

After installation, add a Velociraptor API credential in n8n:

Option A — YAML Content (recommended)

Paste the full contents of your apiclient.yaml file into the credential. This is the easiest method.

Option B — Manual Configuration

Enter the following fields individually:

| Field | Description |
|—|—|
| API URL | e.g. dns:///your-server:8001 |
| CA Certificate | PEM-encoded CA cert from apiclient.yaml |
| Client Certificate | PEM-encoded client cert |
| Client Private Key | PEM-encoded client private key |

Example Workflows

The workflows/ directory contains four importable n8n workflows demonstrating the main features. See workflows/README.md for import instructions and descriptions.

Usage

Execute VQL

Run arbitrary VQL queries. Returns all result rows as n8n items.

SELECT clientid, osinfo.hostname AS hostname, lastseenat
FROM clients()
LIMIT 10

List Clients

Lists all enrolled clients. Optionally filter by clients seen within a time window.

Collect Artifact

Trigger an artifact collection (e.g. Generic.Client.Info) on a specific client. Returns a flow_id to use with the flow status and results operations.

Optional JSON parameters override artifact defaults:

{ "Glob": "/home/*/.bash_history" }

Collect VFS File

Collect a specific file from a client by absolute path (e.g. /etc/hostname). Returns a flow_id pointing to the upload.

Get Flow Status / Get Flow Results

Check on a collection flow or retrieve its results using a flow_id (e.g. F.ABC123).

getFlowResults returns one n8n item per artifact source with the shape:

{
  "artifact": "Generic.Client.Info",
  "source": "Generic.Client.Info/BasicInformation",
  "result_count": 1,
  "rows": [{ "... row fields ..." }]
}

Optionally filter by artifactSource — pass Artifact/Source for a single source, or just Artifact to get all sources under that artifact.

List Flow Uploads / Download Flow File

After a VFS collection completes, listFlowUploads returns the uploaded file paths. downloadFlowFile downloads the binary content of an uploaded file and outputs it as a binary item in n8n (ready for the Write Binary File node or HTTP Response). An optional path filter restricts downloads to matching file paths.

Compatibility

| Component | Version |
|—|—|
| n8n | >= 1.0.0 |
| Node.js | >= 18.0.0 |
| Velociraptor server | >= 0.7.0 |

License

MIT