Enterprise automation

One binary. Your control plane.

The repository ships deployment assets for direct WinRM/SSH operations, SCCM/Intune, GPO, BITS, Ansible, and Puppet.

Choose a method

Method	Targets	Best fit	Primary dependency
PowerShell	Windows	Domain or managed Windows estates	WinRM, or PsExec + SMB
SCCM / Intune	Windows	Managed enterprise endpoints	Management agent and package
GPO	Windows	Startup-triggered, domain-wide execution	Active Directory
BITS	Windows	Constrained or intermittent links	BITS and internal HTTP source
SSH script	Linux	Fast, direct response from an admin host	Key-based SSH, `xargs`, SCP
Ansible	Windows + Linux	Existing automation inventory	Ansible; pywinrm for Windows
Puppet	Windows + Linux	Configuration-managed fleets	Puppet agent

Windows via WinRM or PsExec

deploy/Deploy-Aralez.ps1 uses PowerShell remoting by default and exposes -UsePsExec for environments without WinRM. The default parallel limit is 50 and the remote directory is C:\Windows\Temp\aralez_deploy.

PowerShell

$cred = Get-Credential

.\deploy\Deploy-Aralez.ps1 `
  -TargetsFile .\targets_windows.txt `
  -Binary aralez_x64_windows.exe `
  -Credential $cred `
  -MaxParallel 100 `
  -AralezArgs "--stream --silent" `
  -OutputDest "\\fileserver\forensics\incoming"

# Legacy connectivity path
.\deploy\Deploy-Aralez.ps1 `
  -TargetsFile .\targets_windows.txt `
  -Binary aralez_x64_windows.exe `
  -UsePsExec -Credential $cred

Parameter	Default	Purpose
`-TargetsFile`	Required	One hostname/IP per line; blank and `#` comment lines are skipped.
`-Binary`	Required	Local Windows executable to copy as `aralez.exe`.
`-Credential`	Current context	Credential for WinRM; for PsExec the username/password is placed in PsExec arguments.
`-MaxParallel`	50	Maximum concurrent background jobs.
`-OutputDest`	Empty	Value appended as Aralez `--output`.
`-CollectDir`	Empty	Controller directory for pulling per-host ZIP results over WinRM.
`-RemoteDir`	`C:\Windows\Temp\aralez_deploy`	Endpoint work directory.
`-UsePsExec`	False	Select PsExec/SYSTEM through `C$` instead of WinRM.
`-AralezArgs`	Empty	Additional collector arguments appended to the command.
`-LogDir`	`.\deploy_logs`	Controller-side per-host deployment logs.
`-DryRun`	False	List resolved targets and exit without connecting.

!

Validate the PowerShell asset before fleet use

The current script-block signatures retain an unused positional ConfigPath parameter, while the caller supplies arguments without that slot. This shifts later values in both WinRM and PsExec paths. Correct the signature/call alignment and test it in a lab. Also note that -CollectDir pulls only *.zip, and the PsExec path does not implement result pullback.

Linux via SSH

deploy/deploy_linux.sh reads one target per line, opens up to 50 parallel jobs by default, creates /tmp/aralez_deploy, uploads the binary, executes it, optionally pulls ZIP results, and writes per-host logs.

bash

# Validate the rollout without connecting
./deploy/deploy_linux.sh \
  -t targets_linux.txt -b aralez_x64_linux -n

# 100 workers; endpoint pushes archive to SFTP
./deploy/deploy_linux.sh \
  -t targets_linux.txt -b aralez_x64_linux -j 100 \
  -a "--stream --silent --output sftp://forensic@collector/incoming"

# Pull local ZIP results by SCP
./deploy/deploy_linux.sh \
  -t targets_linux.txt -b aralez_x64_linux -C ./results

Option	Default	Purpose
`-t FILE`	Required	Target host/IP file; blank/comment lines are skipped.
`-b FILE`	Required	Local Linux binary.
`-u USER`	`root`	SSH user.
`-k FILE`	SSH defaults	Private key passed to SSH/SCP.
`-p PORT`	22	SSH port.
`-j N`	50	Parallel `xargs` jobs.
`-o PATH`	Empty	Endpoint `--output` destination.
`-C DIR`	Empty	Pull endpoint ZIP files into a per-host controller directory.
`-a ARGS`	Empty	Quoted extra Aralez arguments.
`-l DIR`	`./deploy_logs`	Per-host deployment log directory.
`-n` / `-h`	—	Dry-run target listing / help.

!

Review SSH defaults

The shipped script sets StrictHostKeyChecking=no. For forensic operations, pre-provision known host keys or modify this behavior so the deployment channel authenticates the endpoint.

The SSH script’s fixed endpoint directory is /tmp/aralez_deploy. Pullback matches only *.zip, not TAR.ZST, and the script does not remove the endpoint directory after completion. If you choose --compression tar, use endpoint push or extend the pull pattern and cleanup logic.

Ansible

The playbook contains separate windows_targets and linux_targets plays, runs in serial batches of 50 by default, and can fetch archives back to the controller.

shell

# Windows group first
ansible-playbook -i inventory.ini deploy/deploy_aralez.yml \
  --limit windows_targets

# Linux group
ansible-playbook -i inventory.ini deploy/deploy_aralez.yml \
  --limit linux_targets

# Central push destination and larger batch
ansible-playbook -i inventory.ini deploy/deploy_aralez.yml \
  -e "parallel=100 output=s3://forensic-bucket/incoming \
      extra_args='--stream --silent'"

Extra variable	Default	Purpose
`parallel`	50	Serial batch size for each platform play.
`binary`	`./aralez_x64_linux`	Linux controller-side source binary.
`binary_win`	`./aralez_x64_windows.exe`	Windows controller-side source binary.
`output`	Empty	Shared endpoint `--output` destination.
`extra_args`	Empty	Additional Aralez options.
`collect`	False	Enable controller pullback.
`collect_dir`	`./results`	Per-host controller result root.

Both plays use a 3600-second task timeout, ignore the execution error long enough to report its return code, fetch only *.zip, and remove the remote directory only when Aralez returns zero. Adjust patterns for TAR.ZST and preserve failed work directories for recovery.

SCCM, Intune, GPO, BITS, and Puppet

Managed Windows

SCCM / Intune

Install-AralezSccm.ps1 accepts -OutputDest, expects aralez_x64_windows.exe beside the script, runs in C:\Windows\Temp\AralezExecution, and writes Aralez_SCCM_Install.log. A zero exit records HKLM\SOFTWARE\AralezForensics values LastRun and Version, then the work directory is removed.

Domain startup

Group Policy

Edit DEPLOY_SHARE, OUTPUT_DEST, WORK_DIR, and LOG_FILE in Deploy-AralezGpo.bat. It copies the binary, runs as the startup/SYSTEM context, returns the Aralez exit code, and removes the work directory. An optional daily marker is present but commented out.

Constrained links

BITS

Deploy-AralezBits.ps1 accepts -SourceUri, -OutputDest, and -WorkDir. It downloads aralez_x64_windows.exe at low BITS priority, logs to C:\Windows\Temp\Aralez_BITS.log, runs it, and removes the work directory.

Infrastructure as code

Puppet

The class parameters are binary_source, output_dest, work_dir (default /opt/aralez), and run_once. It runs as root with a 3600-second timeout and uses .aralez_ran for idempotency when run_once is true.

Safe rollout pattern

1
Lab
Validate each target OS, profile, archive, upload, and cleanup behavior.
2
Canary
Run on a small, representative endpoint set and measure collection volume and host impact.
3
Stage
Segment by site or criticality; cap parallelism to protect management and evidence infrastructure.
4
Observe
Track endpoint result, archive arrival, hash, object size, and expected host coverage.

NextSecurity & evidence→