YAML schema

Define exactly what “triage” means.

A configuration contains global resource policy, named tasks, individual collection or execution entries, output naming, and optional delivery destinations.

Minimal profile

config.yml

version: "case-profile-v1"
output_filename: "Aralez_{{hostname}}_{{datetime}}"
max_size: 5000
memory_limit: 512
disk_limit: 8000
stream: true
compression: "tar"

tasks:
  incident_files:
    priority: 1
    type: "collect"
    output_folder: "{{root_output_path}}\\{{drive}}"
    entries:
      event_logs:
        - root_path: "\\Windows\\System32\\winevt\\Logs"
          objects: ["*.evtx"]
          max_size: 100

Global fields

tasksmap · required

Ordered map of named SectionConfig tasks. Runtime order is ascending numeric priority, not YAML position.

output_filenamestring · required

Base output path. Supports {{hostname}} and {{datetime}}; the timestamp format is YYYY-MM-DD_HH-MM-SS.

versionstring · optional

Profile identifier written into logs. Use a stable, case-meaningful version.

max_sizeinteger MB · optional

Global per-file maximum used with narrower section and entry values. Collection readers multiply the selected limit by 1024².

memory_limitinteger MB · optional

Memory gate. Defaults to 1024 MB in code; shipped templates set 512 MB. macOS currently compares against total physical memory rather than available memory.

disk_limitinteger MB · optional

Threshold used by the active disk check; defaults to 8192 MB. See the implementation caveat below.

disk_pathpath · optional

Filesystem used for free-space checks. Defaults to C:\ on Windows and / on Unix.

min_disk_spaceinteger MB · reserved

Present in the deserialized schema but not consulted by should_continue_collection in v0.11.0.

max_disk_usage_pctinteger 0–100 · reserved

Present in the schema but not consulted by the active disk-check function in v0.11.0.

encryptstring · optional

Default ZIP password. CLI --encrypt overrides it. Avoid long-lived secrets in an embedded profile.

streamboolean · optional

Enables direct-to-archive writes. CLI --stream can only enable, not disable, a profile value.

compressionzip | tar · optional

Archive format; defaults to zip.

outputobject · optional

Contains a destinations list for one or more post-collection deliveries.

!

Disk and size semantics need review in custom profiles

Current collection readers interpret max_size as MB, although several shipped entry values look byte-scaled. The active disk function obtains total filesystem capacity, subtracts the current output-folder size, and compares that result with disk_limit; it does not query true free blocks. Stream mode also leaves the output folder absent, so collected size is seen as zero. Treat these as v0.11.0 implementation constraints and monitor real free space independently.

Task fields

Field	Type	Meaning
`type`	`collect` \| `execute`	Selects filesystem acquisition or command/tool execution.
`priority`	u8	Lower values run first; missing priority sorts as 255.
`disabled`	boolean	Skips the entire task when true.
`drive`	string	Overrides the run’s default device. `*` activates all-drive collection on Windows.
`exclude_drives`	string[]	Drive letters excluded from all-drive collection.
`output_folder`	string	Destination prefix; supports `{{root_output_path}}` and `{{drive}}`.
`max_size`	integer MB	Task-level ceiling combined with global and entry ceilings by selecting the smallest.
`memory_limit`	integer MB	Memory limit supplied to supported child execution paths.
`timeout`	integer sec	Default execution timeout for entries in the task.
`entries`	map of lists	Named categories containing collection or execution entries.

Collection entry

YAML

entries:
  browser_history:
    - root_path: "\\Users\\*\\AppData\\Local\\Google\\Chrome"
      objects: ["History"]
      max_size: 100
      encrypt: "infected"

root_path supports environment expansion and glob components. objects accepts file globs including recursive **. The optional entry max_size is interpreted as MB and participates in the smallest-limit rule. Entry-level encrypt produces AES-256-GCM .enc output in the NTFS reader; ext4 and native fallback collectors currently accept the field but do not implement that encryption path.

Execution entry

YAML

tools:
  type: "execute"
  max_size: 100
  entries:
    system:
      - name: "systeminfo.exe"
        args: []
        output_file: "SystemInfo.txt"
        exec_type: "system"

    internal:
      - name: "ProcInfo"
        output_file: "ProcInfo.csv"
        exec_type: "internal"

exec_type accepts internal, system, or external. External executables are Windows embedded resources. The optional link field treats command output as a list of files and feeds those paths into another named collection task. In v0.11.0, execution output limits are taken from the task/global max_size; an individual execution entry’s max_size is not passed to run.

Configured destinations

YAML

output:
  destinations:
    - type: folder
      path: "D:\\Evidence\\Incoming"
    - type: s3
      bucket: "forensic-bucket"
      prefix: "incoming"
      region: "eu-west-1"
    - type: sftp
      host: "collector.internal"
      port: 22
      username: "forensic"
      key_path: "/root/.ssh/forensic"
      remote_path: "/incoming"

Destination types are folder, s3, sftp, and smb. The schema also permits destination credentials, but embedding reusable secrets in a field binary is generally a poor operational choice.

Validate before deployment

PowerShell

# Validate a candidate and create a new executable
aralez.exe --change_config config\case.yml aralez_case.exe

# Verify the embedded profile
aralez_case.exe --check_config
aralez_case.exe --show_config > embedded-case.yml

bash

# Validate a candidate and create a new executable
aralez --change_config config/case.yml aralez_case

# Verify the embedded profile
aralez_case --check_config
aralez_case --show_config > embedded-case.yml

NextTasks & entries→