Turn a profile into deterministic work.

How tasks are scheduled

Tasks are sorted by ascending priority with a stable sort over an order-preserving map, so tasks sharing a priority run in the order they appear in the YAML. A task with no priority is treated as 255 and runs last.

1. 01

   Parse and validate

   The embedded YAML is decoded, deserialized, and normalized before any resource gate or task starts.

2. 02

   Sort by priority

   Tasks are sorted numerically from 0 through 255. Missing priority is treated as 255; disabled tasks are skipped.

3. 03

   Run task groups

   Top-level tasks run sequentially. Execute entries inside a task use parallel iterators and can overlap.

4. 04

   Check boundaries

   Disk policy and the graceful-interrupt flag are checked between top-level tasks, not between every collected file.

Every task field

Every entry field

Complete collection task

tasks:
  priority_windows_evidence:
    type: collect
    priority: 1
    drive: "C"
    output_folder: "{{root_output_path}}\\{{drive}}\\priority"
    max_size: 250
    entries:
      event_logs:
        - root_path: "\\Windows\\System32\\winevt\\Logs"
          objects: ["Security.evtx", "System.evtx", "PowerShell*.evtx"]
          type: glob
      user_persistence:
        - root_path: "\\Users\\*\\AppData\\Roaming"
          objects: ["Microsoft/Windows/Start Menu/Programs/Startup/**"]
          max_size: 50

tasks:
  priority_unix_evidence:
    type: collect
    priority: 1
    output_folder: "{{root_output_path}}/priority"
    max_size: 250
    entries:
      access_history:
        - root_path: "/home/*"
          objects: [".bash_history", ".ssh/authorized_keys"]
      persistence:
        - root_path: "/etc"
          objects: ["systemd/system/**", "cron.d/*"]

Complete execution task

tasks:
  live_state:
    type: execute
    priority: 0
    output_folder: "{{root_output_path}}\\tools"
    memory_limit: 512
    timeout: 90
    max_size: 100
    entries:
      operating_system:
        - name: "systeminfo.exe"
          args: []
          output_file: "SystemInfo.txt"
          exec_type: system
      aralez_internal:
        - name: "ProcInfo"
          output_file: "ProcInfo.csv"
          exec_type: internal
      embedded_tool:
        - name: "autorunsc.exe"
          args: ["-nobanner", "-c", "/accepteula"]
          output_file: "Autoruns.csv"
          exec_type: external

Path expansion and glob rules

• %NAME% environment variables are expanded in root_path. An unresolved variable remains unchanged.
• A leading Windows drive prefix is removed from expanded collection roots because the selected task drive controls the device.
• If glob syntax appears inside root_path, the non-glob prefix becomes the traversal root and the remaining pattern is prepended to every object.
• ** activates recursive traversal. Native/ext4 paths skip symbolic links; NTFS can collect alternate data streams through filename:stream patterns.
• Archive entry paths are normalized to forward slashes and made relative to the root output directory.

Link command output to file acquisition

A linked execution entry interprets each non-empty stdout line as a candidate path. Aralez trims quotes, extracts leading .exe, .dll, or .sys paths when arguments follow, rejects paths without a file extension, removes a Windows drive prefix, deduplicates the set, and invokes the named collection task with those paths.

tasks:
  service_binaries:
    type: collect
    priority: 3
    output_folder: "{{root_output_path}}\\linked-services"

  discover_services:
    type: execute
    priority: 2
    entries:
      paths:
        - name: "powershell"
          args: ["-NoProfile", "-Command", "Get-CimInstance Win32_Service | Select-Object -ExpandProperty PathName"]
          output_file: "ServicePaths.txt"
          exec_type: system
          link: "service_binaries"

Validation rules and practical checks

• Duplicate entry-group names inside one entries map are rejected.
• An explicit max_size: 0 and an empty entry-level encrypt string are rejected.
• External execution is rejected when a Linux or macOS binary parses the profile.
• The configuration loader accepts UTF-8, UTF-16LE/BE with a BOM, and BOM-less UTF-16LE detected by alternating NUL bytes.
• Use --change_config to validate a candidate file, then run --check_config and --show_config on the resulting executable.