Scoping profiles 1.0

Scoping profiles

Last updated 10 Nov 2026
On this page

A scoping profile says what a run looks for: the time window, each module's parameters, the rules to withhold, your approved baseline and the incident's pivot points.

The command line says how to run (which modules, where the output goes). The profile says what to look for. One profile can be given to every host in a case, so every run is scoped the same way - and every run records which profile it was given.

A profile

JSON case42.json 
{
  "profile": 1,
  "name": "Case 42 - finance share",
  "version": "3",
  "author": "j.doe",
  "created": "2026-10-19",
  "window": "2026-10-01T08:00:00Z",
  "pivots": [
    {"type": "address", "value": "203.0.113.9", "context": "the staging server"}
  ],
  "modules": {
    "Logons": {"max_rows": 2000},
    "RemoteAccess": {"approved_tools": ["TeamViewer@[email protected]"]}
  },
  "suppress": [
    {"rule": "EXEC-SUSPICIOUS-LOCATION", "reason": "the build team's tools run from ProgramData"}
  ],
  "baseline": [
    {"type": "service", "value": "BackupAgent", "context": "the backup product"}
  ]
}

Key

Required

Meaning

profile

yes

The format version: 1.

name

yes

Carried in the run with the profile's SHA-256, so every finding says which scope produced it.

version, author, created

no

Free text, carried in the run.

window

no

Where the investigation's focus starts: a time (2026-10-01T08:00:00Z) or a duration back from the run (7d, 72h).

modules

no

Each module's parameters. signal list names them.

suppress

no

Rules withheld from the run, each with a reason. See Baselines and suppressions.

baseline

no

What your organisation runs on purpose. Signals about it are kept, marked approved.

pivots

no

The incident's pivot points. See Pivot points.

The window

The modules read their event logs from the window's start. What the host holds now - services, tasks, auto-starts, applications, files - is read whatever the window, and what appeared after its start is flagged by the "in period" columns.

Module parameters

PowerShell List every module's parameters 
signal list

Parameter

Meaning

LogIntegrity.max_rows, Logons.max_rows

The most rows of each of the module's tables (default 10000).

Persistence.all

true lists Windows' own entries too (default: left out, counted).

RemoteAccess.approved_tools

The approved remote access products: a name, or name@tenant to approve only instances enrolled to that account, tenant or server. Without it, authorization is unknown and RA-NOT-ALLOWED is not run.

Give a profile to a run

PowerShell As a file, or inline 
signal live -all -profile case42.json
signal live -all -profile H4sIAAAAAAAA...
PowerShell Check it, and make the inline form 
signal profile -check case42.json
signal profile -encode case42.json

Next

Pivot points: how Signal finds where an incident's indicators appear.