{"id":153,"date":"2024-11-15T12:25:14","date_gmt":"2024-11-15T11:25:14","guid":{"rendered":"https:\/\/aralez.co\/index.php\/docs\/documentation\/4-configuration-and-customization\/managing-tasks-and-priorities\/"},"modified":"2024-11-17T21:19:45","modified_gmt":"2024-11-17T20:19:45","password":"","slug":"managing-tasks-and-priorities","status":"publish","type":"docs","link":"https:\/\/aralez.co\/index.php\/docs\/managing-tasks-and-priorities\/","title":{"rendered":"Managing Tasks and Priorities"},"content":{"rendered":"\n

Aralez allows users to define and organize tasks within the YAML configuration file. Each task specifies its operations, such as collecting artifacts or executing commands, and includes a priority level that determines the order of execution. This page explains how to manage tasks and priorities to ensure an efficient and logical workflow.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Tasks Overview<\/strong><\/h4>\n\n\n\n

A task<\/strong> is a logical grouping of operations defined in the configuration file. Tasks can perform actions such as collecting specific artifacts, processing drives, or executing external or system commands.<\/p>\n\n\n\n

Tasks are defined under the tasks<\/code> section and have several key components:<\/p>\n\n\n\n

    \n
  • type<\/code><\/strong>: Specifies whether the task involves data collection or command execution.<\/li>\n\n\n\n
  • priority<\/code><\/strong>: Determines the execution order of tasks.<\/li>\n\n\n\n
  • entries<\/code><\/strong>: Defines the specific operations or artifacts for the task.<\/li>\n\n\n\n
  • disabled<\/code><\/strong> (optional): Allows disabling tasks without removing them from the configuration.<\/li>\n<\/ul>\n\n\n\n
    <\/div>\n\n\n\n

    Understanding Task Priority<\/strong><\/h4>\n\n\n\n

    The priority<\/code> field determines the order in which tasks are executed:<\/p>\n\n\n\n

      \n
    • Tasks with lower values<\/strong> are executed first.<\/li>\n\n\n\n
    • Tasks with higher values<\/strong> are executed later.<\/li>\n\n\n\n
    • Tasks with the same priority are executed in the order they appear in the configuration file.<\/li>\n<\/ul>\n\n\n\n
      \n

      Note<\/strong>: it’s important to evaluate task priorities. For example, ephemeral data such as memory extractions must be collected first.<\/em><\/p>\n<\/blockquote>\n\n\n\n

      Example:<\/p>\n\n\n\n

      <\/path><\/path><\/svg><\/span>
      tasks<\/span>:<\/span><\/span>\n  <\/span>artifacts<\/span>:<\/span><\/span>\n    <\/span>type<\/span>:<\/span> <\/span>"<\/span>collect<\/span>"<\/span><\/span>\n    <\/span>priority<\/span>:<\/span> <\/span>1<\/span><\/span>\n    <\/span>entries<\/span>:<\/span><\/span>\n      <\/span>mft<\/span>:<\/span><\/span>\n        <\/span>-<\/span> <\/span>root_path<\/span>:<\/span> <\/span>"<\/span>\\\\<\/span>"<\/span><\/span>\n          <\/span>objects<\/span>:<\/span> <\/span>[<\/span>"<\/span>$MFT<\/span>"<\/span>]<\/span><\/span>\n  <\/span>tools<\/span>:<\/span><\/span>\n    <\/span>type<\/span>:<\/span> <\/span>"<\/span>execute<\/span>"<\/span><\/span>\n    <\/span>priority<\/span>:<\/span> <\/span>2<\/span><\/span>\n    <\/span>entries<\/span>:<\/span><\/span>\n      <\/span>external<\/span>:<\/span><\/span>\n        <\/span>-<\/span> <\/span>name<\/span>:<\/span> <\/span>"<\/span>autorunsc.exe<\/span>"<\/span><\/span>\n          <\/span>args<\/span>:<\/span> <\/span>[<\/span>"<\/span>-nobanner<\/span>"<\/span>]<\/span><\/span>\n          <\/span>output_file<\/span>:<\/span> <\/span>"<\/span>Autorunsc.txt<\/span>"<\/span><\/span>\n          <\/span>exec_type<\/span>:<\/span> <\/span>"<\/span>external<\/span>"<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
      In this example:<\/p>\n\n\n\n
        \n
      1. The artifacts<\/code> task will execute first (priority 1<\/code>).<\/li>\n\n\n\n
      2. The tools<\/code> task will execute next (priority 2<\/code>).<\/li>\n<\/ol>\n\n\n\n
        <\/div>\n\n\n\n
        Enabling and Disabling Tasks<\/strong><\/h4>\n\n\n\n
        The disabled<\/code> field allows you to exclude specific tasks from execution without removing them from the configuration. This is useful for temporarily skipping tasks while debugging or testing.<\/p>\n\n\n\n
        Example:<\/p>\n\n\n\n
        <\/path><\/path><\/svg><\/span>
        tasks<\/span>:<\/span><\/span>\n  <\/span>unused_task<\/span>:<\/span><\/span>\n    <\/span>type<\/span>:<\/span> <\/span>"<\/span>collect<\/span>"<\/span><\/span>\n    <\/span>priority<\/span>:<\/span> <\/span>100<\/span><\/span>\n    <\/span>disabled<\/span>:<\/span> <\/span>true<\/span><\/span>\n    <\/span>entries<\/span>:<\/span><\/span>\n      <\/span>temp_files<\/span>:<\/span><\/span>\n        <\/span>-<\/span> <\/span>root_path<\/span>:<\/span> <\/span>"<\/span>\\\\<\/span>Temp<\/span>"<\/span><\/span>\n          <\/span>objects<\/span>:<\/span> <\/span>[<\/span>"<\/span>*<\/span>"<\/span>]<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
        <\/p>\n\n\n\n
          \n
        • The unused_task<\/code> is disabled and will not be executed.<\/li>\n\n\n\n
        • To enable the task, remove or set disabled<\/code> to false<\/code>.<\/li>\n<\/ul>\n\n\n\n
          <\/div>\n\n\n\n
          Task Types<\/strong><\/h4>\n\n\n\n
          <\/div>\n\n\n\n
          Data Collection Tasks<\/h5>\n\n\n\n
          Tasks with type: \"collect\"<\/code> specify directories, files, and objects to retrieve. These tasks can target specific drives, directories, or system artifacts.<\/p>\n\n\n\n
          Example:<\/p>\n\n\n\n
          <\/path><\/path><\/svg><\/span>
          tasks<\/span>:<\/span><\/span>\n  <\/span>collect_files<\/span>:<\/span><\/span>\n    <\/span>type<\/span>:<\/span> <\/span>"<\/span>collect<\/span>"<\/span><\/span>\n    <\/span>priority<\/span>:<\/span> <\/span>1<\/span><\/span>\n    <\/span>entries<\/span>:<\/span><\/span>\n      <\/span>event_logs<\/span>:<\/span><\/span>\n        <\/span>-<\/span> <\/span>root_path<\/span>:<\/span> <\/span>"<\/span>\\\\<\/span>Windows<\/span>\\\\<\/span>System32<\/span>\\\\<\/span>winevt<\/span>\\\\<\/span>Logs<\/span>"<\/span><\/span>\n          <\/span>objects<\/span>:<\/span> <\/span>[<\/span>"<\/span>*.evtx<\/span>"<\/span>]<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
          <\/div>\n\n\n\n
          Command Execution Tasks<\/h5>\n\n\n\n
          Tasks with type: \"execute\"<\/code> run system or external commands. These tasks are often used for collecting system state information or running custom scripts.<\/p>\n\n\n\n
          Example:<\/p>\n\n\n\n
          <\/path><\/path><\/svg><\/span>
          tasks<\/span>:<\/span><\/span>\n  <\/span>system_info<\/span>:<\/span><\/span>\n    <\/span>type<\/span>:<\/span> <\/span>"<\/span>execute<\/span>"<\/span><\/span>\n    <\/span>priority<\/span>:<\/span> <\/span>2<\/span><\/span>\n    <\/span>entries<\/span>:<\/span><\/span>\n      <\/span>system<\/span>:<\/span><\/span>\n        <\/span>-<\/span> <\/span>name<\/span>:<\/span> <\/span>"<\/span>systeminfo.exe<\/span>"<\/span><\/span>\n          <\/span>args<\/span>:<\/span> <\/span>[]<\/span><\/span>\n          <\/span>output_file<\/span>:<\/span> <\/span>"<\/span>SystemInfo.txt<\/span>"<\/span><\/span>\n          <\/span>exec_type<\/span>:<\/span> <\/span>"<\/span>system<\/span>"<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
          This task runs the systeminfo.exe<\/code> command and saves the output to SystemInfo.txt<\/code>.<\/p>\n\n\n\n
          <\/div>\n\n\n\n
          Task Entries<\/strong><\/h4>\n\n\n\n
          The entries<\/code> field within each task defines the specific operations or artifacts associated with that task. Entries can include:<\/p>\n\n\n\n
          File Collection<\/strong>:<\/h6>\n\n\n\n
            \n
          • Specify root_path<\/code> for the directory and objects<\/code> for the files or patterns to match.<\/li>\n\n\n\n
          • Optional fields like max_size<\/code> and encrypt<\/code> can refine collection behavior.<\/li>\n<\/ul>\n\n\n\n
            Command Execution:<\/h6>\n\n\n\n
              \n
            • Define the name<\/code> of the executable or command, args<\/code> for its parameters, and output_file<\/code> for the results.<\/li>\n\n\n\n
            • Use exec_type<\/code> to specify the type of command (external<\/code>, system<\/code>, or internal<\/code>).<\/li>\n<\/ul>\n\n\n\n
              <\/div>\n\n\n\n
              Best Practices for Managing Tasks and Priorities<\/strong><\/h4>\n\n\n\n
              <\/div>\n\n\n\n
              Organize Tasks by Priority<\/h6>\n\n\n\n
                \n
              • Assign lower values to tasks critical for initial data collection (e.g., retrieving MFT, event logs).<\/li>\n\n\n\n
              • Use higher values for less critical or optional tasks (e.g., running external tools).<\/li>\n<\/ul>\n\n\n\n
                Group Similar Tasks Together<\/h6>\n\n\n\n
                  \n
                • Group related data collection or command execution tasks into separate logical units for better readability and management.<\/li>\n<\/ul>\n\n\n\n
                  Disable Unnecessary Tasks<\/h6>\n\n\n\n
                    \n
                  • Use the disabled<\/code> field to temporarily exclude tasks without deleting them, allowing easy re-enablement when needed.<\/li>\n<\/ul>\n\n\n\n
                    Review Task Dependencies<\/h6>\n\n\n\n
                      \n
                    • Ensure that tasks are ordered logically if certain tasks depend on the results of others.<\/li>\n<\/ul>\n\n\n\n
                      <\/div>\n\n\n\n
                      Example Configuration<\/h4>\n\n\n\n
                      <\/path><\/path><\/svg><\/span>
                      tasks<\/span>:<\/span><\/span>\n  <\/span>artifacts<\/span>:<\/span><\/span>\n    <\/span>type<\/span>:<\/span> <\/span>"<\/span>collect<\/span>"<\/span><\/span>\n    <\/span>priority<\/span>:<\/span> <\/span>1<\/span><\/span>\n    <\/span>entries<\/span>:<\/span><\/span>\n      <\/span>mft<\/span>:<\/span><\/span>\n        <\/span>-<\/span> <\/span>root_path<\/span>:<\/span> <\/span>"<\/span>\\\\<\/span>"<\/span><\/span>\n          <\/span>objects<\/span>:<\/span> <\/span>[<\/span>"<\/span>$MFT<\/span>"<\/span>]<\/span><\/span>\n<\/span>\n  <\/span>tools<\/span>:<\/span><\/span>\n    <\/span>type<\/span>:<\/span> <\/span>"<\/span>execute<\/span>"<\/span><\/span>\n    <\/span>priority<\/span>:<\/span> <\/span>2<\/span><\/span>\n    <\/span>entries<\/span>:<\/span><\/span>\n      <\/span>external<\/span>:<\/span><\/span>\n        <\/span>-<\/span> <\/span>name<\/span>:<\/span> <\/span>"<\/span>autorunsc.exe<\/span>"<\/span><\/span>\n          <\/span>args<\/span>:<\/span> <\/span>[<\/span>"<\/span>-nobanner<\/span>"<\/span>]<\/span><\/span>\n          <\/span>output_file<\/span>:<\/span> <\/span>"<\/span>Autorunsc.txt<\/span>"<\/span><\/span>\n          <\/span>exec_type<\/span>:<\/span> <\/span>"<\/span>external<\/span>"<\/span><\/span>\n<\/span>\n  <\/span>debug_logs<\/span>:<\/span><\/span>\n    <\/span>type<\/span>:<\/span> <\/span>"<\/span>collect<\/span>"<\/span><\/span>\n    <\/span>priority<\/span>:<\/span> <\/span>3<\/span><\/span>\n    <\/span>disabled<\/span>:<\/span> <\/span>false<\/span><\/span>\n    <\/span>entries<\/span>:<\/span><\/span>\n      <\/span>logs<\/span>:<\/span><\/span>\n        <\/span>-<\/span> <\/span>root_path<\/span>:<\/span> <\/span>"<\/span>\\\\<\/span>Windows<\/span>\\\\<\/span>Logs<\/span>"<\/span><\/span>\n          <\/span>objects<\/span>:<\/span> <\/span>[<\/span>"<\/span>*.log<\/span>"<\/span>]<\/span><\/span>\n          <\/span>max_size<\/span>:<\/span> <\/span>1048576<\/span><\/span><\/code><\/pre><\/div>\n","protected":false},"excerpt":{"rendered":"
                      Aralez allows users to define and organize tasks within the YAML configuration file. Each task specifies its operations, such as collecting artifacts or executing commands, and includes a priority level that determines the order of execution. This page explains how to manage tasks and priorities to ensure an efficient and logical workflow. Tasks Overview A […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"doc_category":[9],"doc_tag":[],"class_list":["post-153","docs","type-docs","status-publish","hentry","doc_category-4-configuration-and-customization"],"blocksy_meta":[],"aioseo_notices":[],"year_month":"2026-04","word_count":712,"total_views":0,"reactions":{"happy":0,"normal":0,"sad":0},"author_info":{"name":"ab","author_nicename":"admin5116","author_url":"https:\/\/aralez.co\/index.php\/author\/admin5116\/"},"doc_category_info":[{"term_name":"4. Configuration and Customization","term_url":"https:\/\/aralez.co\/index.php\/docs-category\/4-configuration-and-customization\/"}],"doc_tag_info":[],"_links":{"self":[{"href":"https:\/\/aralez.co\/index.php\/wp-json\/wp\/v2\/docs\/153","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aralez.co\/index.php\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/aralez.co\/index.php\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/aralez.co\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aralez.co\/index.php\/wp-json\/wp\/v2\/comments?post=153"}],"version-history":[{"count":16,"href":"https:\/\/aralez.co\/index.php\/wp-json\/wp\/v2\/docs\/153\/revisions"}],"predecessor-version":[{"id":489,"href":"https:\/\/aralez.co\/index.php\/wp-json\/wp\/v2\/docs\/153\/revisions\/489"}],"wp:attachment":[{"href":"https:\/\/aralez.co\/index.php\/wp-json\/wp\/v2\/media?parent=153"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/aralez.co\/index.php\/wp-json\/wp\/v2\/doc_category?post=153"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/aralez.co\/index.php\/wp-json\/wp\/v2\/doc_tag?post=153"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}