5 minute setup

Collect your first endpoint.

Choose the correct target binary, run it with elevated privileges, and preserve the resulting archive. The embedded profile defines what is collected.

Before you run

1
Use a trusted build.
Download Windows x64 directly and rename it to aralez.exe, choose another published binary below, or build it yourself from source.
2
Verify the embedded profile.
Run --show_config and retain the output with your case notes.
3
Prepare enough disk.
The shipped profile sets a 512 MB memory gate and an 8 GB disk threshold. Actual collection size depends on configured artifacts; see the configuration caveat on disk-check semantics.

Run Aralez

PowerShell · Run as Administrator

# Inspect the embedded profile
aralez.exe --show_config

# Stream directly into a ZIP archive
aralez.exe --stream

bash

# Make executable and inspect the embedded profile
chmod +x aralez
sudo aralez --show_config

# Recommended resilient collection
sudo aralez --stream --compression tar

zsh

chmod +x aralez
sudo aralez --show_config

# Resilient TAR + Zstandard archive
sudo aralez --stream --compression tar

!

Elevation is required

Linux and macOS builds explicitly exit when not run as root. Windows collection should run in an elevated Administrator context to access protected artifacts and devices.

Locate and inspect the result

The default profile names output with hostname and local collection time:

result

Aralez_WORKSTATION-07_2026-08-14_16-22-09.zip
# or
Aralez_WORKSTATION-07_2026-08-14_16-22-09.tar.zst

Every completed archive contains the collected artifact tree, the exact config.yml used for the run, and the Aralez log. In non-stream mode, the temporary collection folder is removed after successful compression.

Useful first-run recipes

Low disk footprint · Windows

aralez.exe --stream

Silent automation · Windows

aralez.exe --stream --silent

Alternate work disk · Windows

aralez.exe -w D:\Triage

Evidence share · Windows

aralez.exe -o \\server\evidence

✓

Preserve before parsing

Record the binary hash, archive hash, execution time, target identity, operator, profile version, and transfer destination in your chain-of-custody process.

NextInstall & build→