uac - UAC is a powerful and extensible incident response

项目说明

<!-- markdownlint-disable MD033 -->
<!-- markdownlint-disable MD041 -->
<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="logo/uac-light.svg">
<img src="logo/uac-dark.svg" alt="logo" width="120px">
</picture>

<h2 align="center">Unix-like Artifacts Collector (UAC)</h2>

<p align="center">
<a href=" alt="Issues">
<img src=" alt="shellcheck_badge"/></a>
<a href=" alt="CII Best Practices">
<img src=" alt="bestpractices_badge"/></a>
<a href=" alt="GitHub release (latest by date including pre-releases)">
<img src=" alt="release_badge"/></a>
<a href=" alt="License">
<img src=" alt="license_badge"/></a>
</p>

<p align="center">
<a href="#-about-uac">About</a>
•
<a href="#-documentation">Documentation</a>
•
<a href="#-main-features">Main Features</a>
•
<a href="#-supported-operating-systems">Supported Operating Systems</a>
•
<a href="#-usage">Usage</a>
•
<a href="#-contributing">Contributing</a>
•
<a href="#-support">Support</a>
•
<a href="#-license">License</a>
</p>
</p>
<!-- markdownlint-enable MD033 -->
<!-- markdownlint-enable MD041 -->

🔎 About UAC

UAC (Unix-like Artifacts Collector) is a powerful and extensible incident response tool designed for forensic in, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.

Whether you're handling an intrusion, conducting forensic in, or performing compliance checks, UAC simplifies and accelerates data collection while minimizing reliance on external support during critical incidents.

Key Highlights

!UAC in Action

📘 Documentation

Full documentation is a at the project documentation page.

🌟 Main Features

💾 Supported Operating Systems

UAC runs on any Unix-like system, regardless of the processor architecture. All UAC needs is shell :)


*Note: UAC even runs on systems like Network Attached Storage (NAS) devices, Network devices such as OpenWrt, and IoT devices.*

🚀 Usage

UAC does not need to be installed on the target system. Simply download the latest from the releases page, uncompress it, and launch. It's that simple!

🛠 Getting Started

1. Download the latest release from the Releases page.
2. Uncompress the archive.
3. Execute the tool directly from the terminal.

Examples

<!-- markdownlint-disable MD033 -->
<details>
<summary>Click to view usage examples</summary>

Collect all artifacts based on the ir_triage profile:

Collect memory dump and all artifacts based on the full profile:

Collect all artifacts excluding a specific one:

Collect all artifacts based on the ir_triage profile, along with all artifacts located in the /my_custom_artifacts directory:

Collect all artifacts based on a custom profile:

</details>
<!-- markdownlint-enable MD033 -->

💙 Contributing

Contributions make the open-source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.

Have you created any artifacts? Please share them with us!

You can contribute with new artifacts, profiles, bug fixes, or propose new features. Please read our Contributing Guide before submitting a Pull Request to the project.

👨‍💻 Support

For general help using UAC, please refer to the project documentation page. For additional help, you can use one of the following channels:

⭐ Support the Project

If you find UAC helpful, please give us a ⭐ on GitHub! This helps others discover the project and motivates us to improve it further.

📜 License

The UAC project uses the Apache License 2.0 software license.

项目信息

开发语言：Shell

Star 数：1477

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。