Shipped templates

Coverage you can inspect and change.

The platform templates are plain YAML. This matrix summarizes their default intent; always inspect the exact profile embedded in the binary used for a case.

⊞

Windows

Filesystem & execution evidence

NTFS core$MFT, $Boot, $Extend, Recycle Bin

RegistrySAM, SYSTEM, SOFTWARE, SECURITY, DEFAULT, user NTUSER.DAT-style hives

ExecutionPrefetch, Amcache, scheduled tasks, WER, startup files, recent shortcuts

LoggingEVTX, firewall logs, WMI traces, ETL traces, PowerShell history

Network & processPorts, process inventory/details, Netstat, DNS cache, IP configuration

Persistence & toolingAutoruns, handles, DLLs, services, named pipes, suspicious user-writable files

BrowsersLegacy cache/history plus Edge and Chrome history locations

Optional memoryWinPmem task present but disabled by default; requires extended build capability

⌁

Linux

Host, account & service evidence

Shell & accessRoot/user Bash history, SSH keys and config, profiles, aliases, login state

AuthenticationPAM, login definitions, auth logs, users, groups, last, who, w

Persistencesystemd user units, autostart, rc.local, cron/system paths, suspicious /etc and /var locations

Services & websystemd state, Nginx, Apache, package inventory, mounted filesystems

Volatile state/proc, processes, memory summary, sockets, routes, interfaces, firewall rules

Containers & cloudDocker/container artifacts, Kubernetes, AWS, Azure, and related user configuration

Desktop & mailDconf, GNOME sessions, mail spool, user profile traces

Threat-focused filesTemporary locations, suspicious executables/scripts, security product events

◉

macOS 12–15 profile

Activity, persistence & platform security

TimelineUnified Logs, FSEvents, KnowledgeC, Biome, Spotlight, recent items

Trust & privacyQuarantine events, TCC databases, authorization database, Gatekeeper, SIP state

PersistenceLaunchAgents/Daemons, login and startup items, cron, periodic scripts, shell profiles, /opt

Identity & accessUsers, groups, login history, SSH, shell history, keychains

Application activitySafari, Chrome, Firefox, Edge, installed applications and packages

Platform protectionXProtect/MRT, FileVault state, profiles/MDM, firewall, system extensions, kext inventory

Volatile stateProcesses, network connections, routes, ARP, mounts, APFS snapshots, environment

Threat-focused filesSuspicious downloads/temp files/dylibs, core dumps, swap, crash reports, cloud credentials

Complete shipped profile manifest

These are every named collection entry group in the three shipped profiles. A group can contain several roots and glob patterns; use --show_config to export the literal profile embedded in the executable before a collection.

⊞ Windows20 primary groups + linked/other-volume tasks

Primary system drive · priority 1

mftextendrecycleevent_logshive_filesuser_hive_fileswer_filesprefetchscheduled_tasksfirewall_logsamcachestartup_fileswindows_shortcutspowershell_historywmiwmi_tracebmcbitsbrowser_historysuspicious_files

Additional volumes and linked collection

all_drives__artifacts.mft acquires $MFT from every volume except C at priority 2. The services task receives executable paths produced by the Windows service-event command and collects matching .exe, .dll, and .sys files into suspicious/. The optional memory execution task is disabled.

Important literal roots

\Windows\System32\winevt\Logs, \Windows\System32\config, \Windows\Prefetch, \Windows\System32\Tasks, \ProgramData\Microsoft\Network\Downloader, per-user Registry/browser/history/startup roots, and suspicious-file searches in AppData, Temp, Downloads, and Desktop.

⌁ Linux29 collection groups

File collection · priority 1

root_bashroot_sshusers_bashusers_profilespam_configslogin_defsautostartsystemd_user_autostartrc_localpersistence_etcpersistence_varauditd_rulesssh_confignginx_configapache_configapache_httpdsystem_infologsproc_statemail_spooldconf_datagnome_sessionsssh_datapersistencetmp_datanetworkcontainer_artifactscloud_configssuspicious_files

Important literal roots

/root, /home/*, /etc, /var/log, /var/spool, /proc, /tmp, /var/tmp, /dev/shm, systemd/init/cron paths, web-server configuration, Docker/containerd, AWS, Kubernetes, and Docker client configuration.

◉ macOS43 collection groups

File collection · priority 1

unified_logsfseventsdknowledgecbiomequarantinespotlighttccauthorization_dblaunch_agents_systemlaunch_agents_userlogin_itemsstartup_itemscrontabsperiodicshell_profilesssh_rootssh_usersshell_rootshell_userssystem_configsystem_logsaudit_logsinstall_historyapp_bundle_infosafarichromefirefoxedgerecent_itemskeychainscloud_configscore_dumpsswap_filessuspicious_downloadssuspicious_desktopsuspicious_tmpsuspicious_dylibsopt_persistencekextxprotectprivate_etccrash_reportsfilevault_config

Coverage roots

/var/db, /Library, /System/Library, /Users/*/Library, /private/etc, /private/var, /cores, /opt, browser profiles, keychains, launch services, privacy databases, XProtect, crash reports, swap, and cloud client configuration.

The profile contains 43 named file-entry keys in its artifacts.entries map. Priority-0 live-state commands are documented separately on the Execution & tools page.

!

Sensitive material

Default templates can collect credentials-adjacent data, browser history, shell history, keychain files, cloud configuration, memory, and suspicious user files. Establish lawful authority, data-minimization rules, secure transport, retention, and access controls before use.

Windows embedded tools

The build script downloads the Sysinternals suite when needed and embeds architecture-matched copies of Autorunsc, Handle, TCPVCon, PsList, ListDLLs, PsService, and PipeList. WinPmem is added only for extended-tools or memdump builds. Review the licenses and provenance of all bundled third-party tools in your distribution process.

NTFS side-artifacts

On Windows, three kinds of entry appear in the archive that you did not ask for by name. They are produced automatically by the NTFS reader alongside the file they belong to.

<file>.FileSlackslack space

The bytes between a file’s Valid Data Length and the end of its allocated clusters. Aralez decodes the VDL from the raw $DATA attribute header, writes the slack to its own entry, and zero-pads the main file — so the recovered file stays byte-accurate while the residue of whatever previously occupied those clusters is preserved. Useful for recovering fragments of deleted files and for spotting payloads hidden in slack.

<file>_<attr>.idxindex allocation

The $INDEX_ALLOCATION attribute of a directory — the B-tree NTFS uses to store directory entries once a directory outgrows its resident index. It retains names, timestamps and attributes for entries that have since been deleted or hidden, which makes it valuable for timeline reconstruction and for detecting files removed from a directory listing.

<file>_<stream>alternate data stream

An NTFS alternate data stream, requested with a colon in the objects pattern. The colon is not legal in an archive path, so it is replaced with an underscore on write: $UsnJrnl:$J is stored as $UsnJrnl_$J. All-zero chunks are skipped.

Requesting an alternate data stream

entries:
  usn_journal:
    - root_path: "\\$Extend"
      objects: ["$UsnJrnl:$J"]     # filename : stream name

Collected as $UsnJrnl_$J. Slack and index entries need no configuration — they are emitted automatically for the files and directories a task already matches.

Priority strategy

The macOS template explicitly runs live system tools at priority 0 and file artifacts at priority 1. The default Linux profile collects files at priority 1 and execution results at priority 2. Windows places the optional memory task at priority 0, artifacts at priority 1, other drives at priority 2, and tools at priority 3.

NextExecution & tools→