Profile Definition
Profiles define the list of artifacts to be collected during execution.
Each profile file includes two mandatory fields at the top, followed by a set of artifacts that guide the collection process.
Example:
name: myprofile
description: My profile.
artifacts:
- live_response/process/ps.yaml
- live_response/process/lsof.yaml
- bodyfile/bodyfile.yaml
- hash_executables/hash_executables.yaml
name
Required
The profile name. UAC uses this name to locate and apply the correct profile during script execution.
description
Required
A brief summary describing the overall purpose of the profile. It should specify the type of collection being performed. Line breaks are not supported.
artifacts
Required
The list of artifacts to be collected. All available artifacts are stored in the artifacts
directory.
Artifacts are collected in the order they are listed.
The following example collects live_response/process/ps.yaml
first, then live_response/process/lsof.yaml
:
name: myprofile
description: My profile.
artifacts:
- live_response/process/ps.yaml
- live_response/process/lsof.yaml
Globbing and Wildcards
Wildcards and glob-style patterns are supported. The next example collects all artifacts in the live_response/process
directory and its subdirectories, in alphabetical order:
name: myprofile
description: My profile.
artifacts:
- live_response/process/*
Excluding Artifacts
Artifacts can be excluded using an exclamation mark (!
) prefix. The example below collects everything from files/
, except for files/logs/additional_logs.yaml
and all items in files/applications/
:
name: myprofile
description: My profile.
artifacts:
- files/*
- !files/logs/additional_logs.yaml
- !files/applications/*
Using External Artifacts
Artifacts located outside the default artifacts
directory can also be included by specifying their full path.
Example:
name: myprofile
description: My profile.
artifacts:
- live_response/process/*
- /my_artifacts_dir/my_artifact.yaml
Ensure the full path is used when referencing external artifacts.