# DFIR Tools Intro

> Master the modern DFIR stack. Deploy Velociraptor for deep endpoint forensics at scale and orchestrate the entire incident response lifecycle within TheHive.

Canonical: https://codelivly.com/rooms/dfir-tools-intro
Last updated: 2026-07-07

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 200 |

When a breach goes deep, basic SIEM alerts aren't enough. You need to hunt across 10,000 endpoints for a specific memory artifact, and you need a centralized war room to manage the chaos. In this final module of the SOC Tools path, we introduce the heavy artillery of Digital Forensics and Incident Response (DFIR).

You will learn how to deploy and utilize Velociraptor, the ultimate endpoint visibility and digital forensics tool that lets you query the state of your entire fleet using a SQL-like language (VQL). Then, we will integrate it with TheHive, the industry-standard open-source Incident Response Platform (IRP), to manage cases, track observables, and orchestrate the response. Stop using spreadsheets to manage breaches. Build a scalable, enterprise-grade DFIR command center.

## Lessons

1. Introduction to Velociraptor (30 min)
2. Introduction to TheHive & Cortex (30 min)
3. Case Management Workflow Walkthrough (30 min)
4. Putting It Together (30 min)

## Related

- [Learning path: SOC Tools: Hands-On Practicals](https://codelivly.com/learning-paths/soc-tools-hands-on-practicals)
- [All rooms](https://codelivly.com/rooms)