Velociraptor is an open-source tool developed by Velocidex (now Rapid7) to conduct scalable forensic analyses for large infrastructures. The client-server system allows analysts to distribute forensic queries to many endpoints and provides notebooks for interactive reports. Analysts can use the integrated Velociraptor Query Language to create queries and extend Velociraptor. This workshop provides an introduction to incident response with Velociraptor.