Manual
Search…
⌃K

Example Template

#####aid_begin
#description:
#id: aid<xxxxxxxxx>
#processtype:
#category:
#sourcelink: <na>
#tacticidlist: <na>
#techniqueidlist: <na>
#compatibleos: |-
# windows 7
# windows 8.*
# windows 10
# windows 11
# windows server 2008 r2
# windows server 2012
# windows server 2012 r2
# windows server 2016
# windows server 2019
#compatibleengine: |-
# powershell 2
# powershell 3
# powershell 4
# powershell 5.*
# powershell 7.*
#bgcommandlist: |-
# <BGCommand>
#notes: |-
# <BGNotes>
#####aid_end
# Stay in the Console after executing an automated Job or command from the CLI.
noexit: False
# Show more detailed loading information to the console
verbose: False
# Run PowerShell's transcript process to capture more output
debug: False
# Use an IP Range instead of System names
# Example: '10.10.22.0-10.10.25.254'
# This will give us a count of Addresses for 1023 IPs
range: []
# Select the amount of cores you want this job to use. Default is (ALL).
# Core information is pulled from the ($env:NUMBER_OF_PROCESSORS) variable.
cores:
# Set the Job ID
jobid: ""
# Send the artifact to the remote machine to be run by the BluGenie Service.
servicejob: False
# Do not display the BluGenie Welcome Screen.
nobanner: False
# Trap information is captured to both a file and the Event Log.
# o FilePath = <$env:SystemDrive>\Windows\Temp\BG<$JobID>-<$PID>-<10_Digit_GUID>.log
# o Event Info:
# ~ EventLogName = 'Application'
# ~ Source = 'BluGenie'
# ~ EntryType = 'Information'
# ~ EventID = 7114
# o Data captured using Posh 2
# ~ Data will be logged using ConvertTo-Xml -as String
# o Data captured using Posh 3 and Above
# ~ Data will be logged using ConvertTo-JSON
#
# Information Trapped:
# o JobID
# o Hostname
# o Commands
# o ParallelCommands
# o PostCommands
# o FullDumpPath
trap: False
# Parallel Commands can be BluGenie Functions or any command Posh can run.
# Note: The Parallel Command section will run all items at the same time.
#
# o 1st - Command section will run in synchronous order
# o 2nd - Parallel Command section will run all items at the same time.
# - Parallel Commands run after all Commands in the Command section finish
# o 3rd - Post Command section will run in synchronous order
# - Post Commands run after all the Parallel Commands have finished
parallelcommands: []
# Being able to invoke multiple runspaces at once allows BluGenie the ability to run code inside of each runspace independent of the others.
# This option will set the timeout value for each job. If that time value is ever reached, the job will exit and return a timeout error.
jobtimeout: 120
# Commands can be BluGenie Functions or any command Posh can run.
# Note: The Commands action is a specific order.
#
# o 1st - Command section will run in synchronous order
# o 2nd - Parallel Command section will run all items at the same time.
# - Parallel Commands run after all Commands in the Command section finish
# o 3rd - Post Command section will run in synchronous order
# - Post Commands run after all the Parallel Commands have finished
commands: []
# Post Commands can be BluGenie Functions or any command Posh can run.
# Note: Post Command section will run in synchronous order
# Post Commands run after all the Parallel Commands have finished
#
# o 1st - Command section will run in synchronous order
# o 2nd - Parallel Command section will run all items at the same time.
# - Parallel Commands run after all Commands in the Command section finish
# o 3rd - Post Command section will run in synchronous order
# - Post Commands run after all the Parallel Commands have finished
postcommands: []
# Do not update the frame of the Console. Use the OS's default command prompt size.
nosetres: False
# Force all managed BluGenie files and folders to be updated on the remote machine
updatemods: False
# Select the priority level of the cuurent job.
# Default is (Normal)
# 0 = Low
# 1 = Below Normal
# 2 = Normal
# 3 = Above Normal
# 4 = High
# 5 = Realtime
priority:
# We use PowerShell Runspace Pools for Multithreading. ThreadCount is used to define the maximum number of threads we wish to run at
one time.
threadcount: 50
# Select the memory threshold for the current job. Default is (512) MB.
# Note: <int> must be in MB format. So 1GB is 1024, and so on.
memory: 512
# Identify what systems to process an Artifact lookup on
# To parse a file for a list of computers use the "File:" prefix
# o Example: file:.\collections\systems.txt
# To parse a domain group for a list of computers use the "Group:" prefix
# o Example: group:S_Wrk_Posh3Systems
# To parse a domain group with a specific domain name, append to the end of the Group name ":Domain.com"
# o Example: group:S_Wrk_Posh3Systems:TestLab.com
# o Note: The domain needs to be a trusted domain
systems: []