UAC and pre-signed URLs

UAC 2.2.0 is currently in pre-release (as of the 25th April 2022) however it should be released shortly.

UAC collects the desired artefacts and stores them in your specified location. For example, the following command executes UAC with root privileges, executes the contents of the ir_triage profile, and stores the output in /destination/folder.

$ sudo ./uac -p ir_triage /destination/folder

The operator has to then collect the output file (.tar.gz and .log) from the destination folder and copy it to either another machine for analysis.

A more streamlined workflow would involve collection your triage data and uploading it to a remote host using a pre-signed URL. If we use the signed URL we generated previously, our command would look like this;

$ sudo ./uac -p ir_triage /destination/folder --s3-presigned-url "https://minio.yourdomain.com.au:9000/my-bucket/my-object?response-content-type=application%2Fjson&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=[snip]"

Note: make sure the URL is encapsulated.

UAC will execute, collect the desired artefacts, store the output in /destination/folder submit a POST request to your signed URL. You'll end up with a file called 'my-object' stored inside 'my-bucket'. You'll need to rename this after downloading it (to the original name like uac-hostname-kernel-YYYYmmddsssssss.tar.gz"

If you want the local files to be deleted after a successful transfer, append the following;

$ sudo ./uac -p ir_triage /destination/folder --delete-local-on-successful-transfer --s3-presigned-url "https://MY-URL"