invoke-ir/aceAutomated, Collection, and Enrichment Platform
The Automated Collection and Enrichment (ACE) platform is a suite of tools for threat hunters to collect data from many endpoints in a network and automatically enrich the data. The data is collected by running scripts on each computer without installing any software on the target. ACE supports collecting from Windows, macOS, and Linux hosts.
ACE is meant to simplify the process of remotely collecting data across an environment by offering credential management, scheduling, centralized script management, and remote file downloading. ACE is designed to complement a SIEM by collecting data and enriching data; final analysis is best suited for SIEM tools such as Splunk, ELK, or the tools the analyst prefers.
ACE grew out of the need to perform Compromise Assessments in places with common restrictions:
ACE has four components: the ACE Web Service, the ACE Nginx web proxy, the ACE SQL database, and the ACE RabbitMQ message queue. The Web Service is a RESTful API that takes requests from clients to schedule and manage scans. The SQL database stores the configuration and data from scans. The RabbitMQ service handles automated enrichment of data.
The ACE repository includes a collection of PowerShell scripts to interact with the ACE Web Service, including adding users, managing credentials, uploading collection scripts, and scheduling scans.
After deploying the ACE servers, use New-AceUser to create a new ACE user.
Remove the default ôAdminö user with Remove-AceUser.
Use New-AceCredential to enter a set of credentials.
Run Start-AceDiscovery to automatically find computers on the Windows domain.
Run Start-AceSweep to start a sweep to run the selected scripts across the discovered endpoints.
Contributions to ACE are always welcome.
