# Velociraptor Extension **URL:** \ **Category:** Support\ **Created:** [September 24, 2025, 3:13pm UTC](https://community.limacharlie.com/t/velociraptor-extension/483 "2025-09-24T15:13:49Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![cmd1775](https://avatars.discourse-cdn.com/v4/letter/c/a183cd/32.png) [@cmd1775](https://community.limacharlie.com/u/cmd1775)\ **Post date:** [September 24, 2025, 3:13pm UTC](https://community.limacharlie.com/t/velociraptor-extension/483/1 "2025-09-24T15:13:49Z")
Having an issue with the Velociraptor extension and initiating Kape triage collection following this link - [Automating Incident Response Workflows with LimaCharlie | LimaCharlie](https://limacharlie.io/blog/automating-incident-response-workflows) The timeline for the Velociraptor extension shows the job\_created event and nothing else. This has now been running for an hour. There are no errors this time in the Platform logs. Thank you ---
**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\ **Post date:** [September 24, 2025, 3:20pm UTC](https://community.limacharlie.com/t/velociraptor-extension/483/3 "2025-09-24T15:20:39Z")
Hello, we received a report that the latest version of Velociraptor broke backward compatibility by moving several Artifacts that used to be built-in to an external Artifact repo. We’re working on a PR to bring back the capability. In an effort to remain as aligned to the source project it will likely mean that using these external Artifacts will be done slightly differently (like a different field), but we’re trying to make the discovery of those external Artifacts transparent. ---
**Author:** ![cmd1775](https://avatars.discourse-cdn.com/v4/letter/c/a183cd/32.png) [@cmd1775](https://community.limacharlie.com/u/cmd1775)\ **Post date:** [September 24, 2025, 3:30pm UTC](https://community.limacharlie.com/t/velociraptor-extension/483/4 "2025-09-24T15:30:01Z")
Thank you!! Do you have any idea on a timeline? ---
**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\ **Post date:** [September 24, 2025, 3:56pm UTC](https://community.limacharlie.com/t/velociraptor-extension/483/5 "2025-09-24T15:56:00Z")
Not 100%, but I would like to try to get it by EOW. ---
**Author:** ![cmd1775](https://avatars.discourse-cdn.com/v4/letter/c/a183cd/32.png) [@cmd1775](https://community.limacharlie.com/u/cmd1775)\ **Post date:** [September 24, 2025, 8:31pm UTC](https://community.limacharlie.com/t/velociraptor-extension/483/6 "2025-09-24T20:31:21Z")
Thank you very much!! ---
**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\ **Post date:** [September 24, 2025, 10:55pm UTC](https://community.limacharlie.com/t/velociraptor-extension/483/7 "2025-09-24T22:55:22Z")
It went better than expected. We just pushed out the new version. Note that as per their new site: [\ \\ \ Rules | Triage Artifacts](https://triage.velocidex.com/docs/windows.triage.targets/rules/) the name of some of those things has changed, but the new name should be in the list of Artifact. The Kape is now under `Windows.Triage.Targets`. ---
**Author:** ![cmd1775](https://avatars.discourse-cdn.com/v4/letter/c/a183cd/32.png) [@cmd1775](https://community.limacharlie.com/u/cmd1775)\ **Post date:** [September 25, 2025, 2:25am UTC](https://community.limacharlie.com/t/velociraptor-extension/483/8 "2025-09-25T02:25:18Z")
Just tested and this is what I am seeing. job\_created event for the ext-velociraptor sensor shows: ``` { “event”: { “event”: “job\_created”, “external\_artifacts”: [ “Windows.Triage.Targets (from [https://triage.velocidex.com/docs/windows.triage.targets/Windows.Triage.Targets.zip](https://triage.velocidex.com/docs/windows.triage.targets/Windows.Triage.Targets.zip))” ], “inv\_id”: “”, “job\_id”: “b07e8ec4-ce16-4aec-83e8-593f5b410b0b”, “request”: { “args”: “KapeTriage=Y”, “artifact\_list”: [ “Windows.Triage.Targets” ], “collection\_ttl”: 604800, “custom\_artifact”: “”, “ignore\_cert”: false, “retention\_ttl”: 7, “sensor\_selector”: “”, “sid”: “_sid of target Windows device_” ``` upload\_generated, artifact\_generated, artifact\_uploaded, and velociraptor\_collection events all occur within a few seconds. The Velociraptor artifact is 53k. There is a Platform Log error saying no evtx files found ```json ``` ---
**Author:** ![cmd1775](https://avatars.discourse-cdn.com/v4/letter/c/a183cd/32.png) [@cmd1775](https://community.limacharlie.com/u/cmd1775)\ **Post date:** [September 25, 2025, 2:26am UTC](https://community.limacharlie.com/t/velociraptor-extension/483/9 "2025-09-25T02:26:39Z")
Also, when I try to use Show Artifact for Windows.Triage.Targets I receive this error: Request Failed: lc\_error\_code:EXTENSION\_REQUEST\_ERROR - lc\_error\_code:EXTENSION\_ERROR - exit status 1 ---
**Author:** ![ecapuano](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/ecapuano/32/12_2.png) [@ecapuano](https://community.limacharlie.com/u/ecapuano)\ **Post date:** [September 25, 2025, 2:55am UTC](https://community.limacharlie.com/t/velociraptor-extension/483/10 "2025-09-25T02:55:46Z")
Also following 👀 had to make changes to [https://triage.zip](https://triage.zip) as well ---
**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\ **Post date:** [September 25, 2025, 3:28pm UTC](https://community.limacharlie.com/t/velociraptor-extension/483/11 "2025-09-25T15:28:47Z")
Ok we fixed the Listing to handle the new externally-defined Artifacts. Investigating the rest, I also got an error this morning which I didn’t get yesterday. Apologies for the delay, I have no idea what I’m doing Velociraptor-wise 🙂 ---
**Author:** ![cmd1775](https://avatars.discourse-cdn.com/v4/letter/c/a183cd/32.png) [@cmd1775](https://community.limacharlie.com/u/cmd1775)\ **Post date:** [September 26, 2025, 2:28am UTC](https://community.limacharlie.com/t/velociraptor-extension/483/12 "2025-09-26T02:28:25Z")
Appreciate you looking into this! ---
**Author:** ![ecapuano](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/ecapuano/32/12_2.png) [@ecapuano](https://community.limacharlie.com/u/ecapuano)\ **Post date:** [September 26, 2025, 3:02am UTC](https://community.limacharlie.com/t/velociraptor-extension/483/13 "2025-09-26T03:02:06Z")
If you want to collaborate, you know where to reach me 🫡 ---
**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\ **Post date:** [September 26, 2025, 3:10am UTC](https://community.limacharlie.com/t/velociraptor-extension/483/14 "2025-09-26T03:10:29Z")
Thanks. I think I’ve figured out how it works now. The challenge is that it’s not as simple as it used to be where we could execute V by effectively pointing to a file. We have to point to a directory with the file in it. And this adds delays which causes a race condition when we execute V, sometimes the directory and file have not been written yet. So we have to move to shipping bat scripts that will wait and it’s just getting really messy. ☹ ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex033/uploads/limacharlie/original/1X/b2e9829e8e4281f2e5d87b4c4d424583144efe20.svg) [@system](https://community.limacharlie.com/u/system)\ **Post date:** [October 3, 2025, 3:11am UTC](https://community.limacharlie.com/t/velociraptor-extension/483/15 "2025-10-03T03:11:17Z")
Closed on October 3, 2025, 3:11am UTC This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.