DEVELOPMENT OVERVIEW / AVAILABILITY VARIES BY BUILD
FIRE SOFTWARE SOLUTIONS / WORK IN PROGRESS
Take command.
Follow the evidence.
Meet Velociraptor Claw Edition. A native macOS command center bringing deployment, endpoint investigations, and forensic workflows into one operator experience.
EVIDENCE FIRSTClarity. Context. Control.
BUILT FOR RESPONDERSFrom signal to understanding.
THE INSTINCT TO INVESTIGATE.
NATIVE macOS EXPERIENCEVELOCIRAPTOR MANAGEMENTDFIR WORKFLOWSHUMAN-LED INVESTIGATIONS
01 / THE PLATFORM
The power of Velociraptor.
A clearer path to action.
Claw Edition helps operators deploy, configure, and manage the official Velociraptor digital forensics and incident response platform.
It brings the surrounding work together: preparing infrastructure, connecting to endpoints, organizing hunts, collecting artifacts, reviewing evidence, and producing reports. The active development focus is a native macOS application.
CLAW EDITION
Deployment · Management · Operator workflows
↕
VELOCIRAPTORCore endpoint collection and DFIR engine
Velociraptor is the underlying platform from Velocidex. Claw Edition is a separate product by Fire Software Solutions; no affiliation or endorsement is implied.
02 / CAPABILITY EXPLORER
Go deeper.
Stay in control.
Explore the product’s documented areas of work. This is a capability overview of an evolving platform, rather than a release guarantee.
03 / THE OPERATOR JOURNEY
From preparation
to a defensible record.
A representative investigation journey. Each stage connects the operator’s decision to the next piece of evidence.
INVESTIGATION FLOWILLUSTRATIVE WORKFLOW
01 / PREPARE
Build your footing.
Choose the deployment context, review configuration, establish connections, and check service health.
Build your footing.
Choose the deployment context, review configuration, establish connections, and check service health.
Find your focus.
Organize endpoints, select relevant artifacts, and define the collection or hunt around the incident question.
Follow the signals.
Review collection results, browse remote files, work through notebooks, and develop the timeline.
Make it reviewable.
Validate evidence, record actions, and prepare exports and reports for the next investigator or stakeholder.
INVESTIGATION CONTEXTS
RansomwareCredential theftLateral movementWeb shellsPersistenceData exfiltration
Documented training and investigation themes. Findings depend on the available evidence, collection scope, and analyst review.
04 / A CONNECTED FORENSIC TOOLKIT
Bring the right tools
to the right question.
Package-management and tool workflows bring familiar forensic utilities into the operator’s reach. Individual tools retain their own licenses and platform requirements.
MEMORY FORENSICSVolatility 3 · WinPmem · MemProcFS
EVENT & LOG ANALYSISChainsaw · Hayabusa · EvtxECmd
DETECTION & MALWAREYARA · Sigma workflows · Capa
NETWORK FORENSICSWireshark · Zeek · tcpdump
ENDPOINT INVESTIGATIONAutoruns · Sysinternals · BloodHound
05 / FIRE CONSULTING SERVICES
Expertise for your systems.
Care for what they hold.
Alongside Claw Edition, Fire Software Solutions offers private consulting across cybersecurity, artificial intelligence, digital forensics, and technology implementation. Every engagement begins with your objectives, authorized scope, and information-handling needs.
AI consulting
& governance
Plan and implement AI systems and services with attention to the information they use, the decisions they influence, and the people responsible for them.
- Use-case planning and service or provider evaluation
- Integration, configuration, and authorized data handling
- Human oversight, output validation, and change governance
Private cybersecurity
consulting
Work through security and confidentiality concerns in the context of your systems, sensitive information, business priorities, and practical constraints.
- Risk-based security review and control recommendations
- Identity, privileged access, and credential protection
- Security planning, incident readiness, and accountable changes
Digital forensics
& incident response
Support authorized investigations with attention to evidence preservation, collection, integrity, and the record of what was done and why.
- Define investigation scope and collection requirements
- Evidence handling, provenance, and chain-of-custody practices
- Incident assessment, documented response, and reporting
Technology consulting
& implementation
Connect planning to practical configuration, integration, administration, and implementation, with security considered throughout the work.
- Configuration and integration aligned to agreed requirements
- System administration and implementation support
- Change records, validation, and recovery considerations
Proprietary information
& IP stewardship
Develop practical safeguards for source code, research, documentation, configurations, and other valuable information entrusted to your organization.
- Access and confidentiality controls for sensitive work
- Repository protection, backups, and change history
- Ownership, licensing, and provenance recordkeeping
Physical & electronic
records stewardship
Organize how records are identified, handled, accessed, retained, and transferred according to their sensitivity, ownership, and purpose.
- Classification, custody, and handling expectations
- Access, integrity, and secure-transfer requirements
- Retention, return, and authorized destruction planning
HOW WE WORK
Clear scope. Documented decisions.
We define objectives, access, permitted changes, information handling, and acceptance criteria together. Recommendations and implementation each follow the authority agreed for the engagement.
Start a conversation ↗06 / TRUST BY DESIGN
Built around evidence.
Guided by responsibility.
FIRE’s proposed governance baseline puts confidentiality, integrity, availability, authenticity, and accountable human decisions at the center of the work.
EXPLORE THE PRINCIPLES
Confidentiality is a design input.
Limit sensitive information to an authorized purpose. Apply least privilege, need-to-know access, and proportionate handling throughout its lifecycle.
Least privilegeData minimizationIP protection
Governance principles adapted from FIRE’s draft policy. They describe the proposed baseline; they are not a certification or a claim that every product control is complete.
07 / BUILT IN THE OPENING CHAPTER
Ambitious by design.
Honest about progress.
Velociraptor Claw Edition is a work in progress. This showcase reflects documented product direction; it does not announce general availability.
Native macOS
The current development focus: a SwiftUI desktop experience for configuration, deployment, endpoint management, and investigations.
Connected operations
AI assistance, MCP, event intake, SIEM and case-management connections, and orchestrated response workflows are areas of ongoing development and validation.
Mobile companion
QR-assisted mobile workflows for iOS and Android are documented as planned. No mobile availability date is promised here.
Platform context. Earlier Windows, Linux, Electron, and PowerShell work exists in the project’s history. It is not the active desktop development focus.
Quality direction. Unit, integration, UI, and operator-workflow validation are part of development. This site makes no independent certification, vulnerability-free, or performance guarantee.
08 / QUESTIONS, ANSWERED
A closer look.
Can we work with FIRE beyond Claw Edition?+
Yes. Consulting inquiries can cover AI systems and governance, private cybersecurity, digital forensics and incident response, technology implementation, proprietary information, and physical or electronic records. The objectives, deliverables, access, and handling requirements are agreed for each engagement.
Does Claw Edition replace Velociraptor?+
No. It provides a deployment, management, and workflow experience around the official Velociraptor engine. The underlying platform remains distinct.
Who is the platform designed for?+
DFIR practitioners, incident responders, security operations teams, and deployment administrators who need to connect infrastructure management with investigations.
Can it support disconnected collection?+
Offline collector generation and portable package workflows are documented product areas. Discuss your environment with the team to confirm the current build’s capabilities and requirements.
How does AI fit into the experience?+
Documented areas include query assistance, artifact recommendations, incident guidance, and connections to AI tools through MCP. Operators remain responsible for reviewing recommendations and authorizing actions; availability depends on the build and configuration.
Can I see a demonstration or discuss access?+
Email staff@velociraptorclaw.com with your use case and the capabilities you would like to explore. The team can discuss the current development status and next steps.
Is the implementation published on this site?+
This showcase describes capabilities and product direction. Source code, internal architecture, private configuration, credentials, and proprietary implementation material are not distributed through this site.
09 / START A CONVERSATION
Your next challenge.
Our next conversation.
Explore Claw Edition or discuss private cybersecurity, AI, DFIR, technology, or information-stewardship consulting. Tell us what you want to achieve, and we can discuss the scope and next steps.
staff@velociraptorclaw.com ↗Fire Software Solutions LLC