blackhillsinfosec / eventlogging Goto Github PK

Your .XML files contain HKCU registry entries. Since the Sysmon service runs under the SYSTEM account, Sysmon would be looking for any HKCU registry items under the SYSTEM account; NOT the logged-on user(s). Several of your .XML files contain HKCU registry entries. Since the Sysmon service runs under the SYSTEM account, Sysmon would be looking for any HKCU registry items under the SYSTEM account; NOT the logged-on user(s).

Reference: olafhartong/sysmon-modular#130

I brought this issue up before as "DC Configuration script runs with errors" . I got errors when I ran the DC-Configurator-NoAudit script. It gave me couple of errors. Your suggestion was to run powershell.exe /c ./DC-Configurator-NoAudit.ps1 and see if I still get the errors. I did and I still got the same errors. (see screenshot). I still don't see any new GPOs.
Sorry to keep bugging you about this, but after attending your BHIS/WWHF webinar a while back and numerous attempts, I still don't have anything working. Btw what are the names of the GPOs that the script is supposed to create?

Tried running the DC Configurator - No Audit on DC. No GPOs are created and I'm getting errors (see attached).

!

I was trying to be clever here and it back fired. These errors dont break the script but it does cause some evil red text that needs to be dealt with.

function get-csvfilepath loads an assembly that is not present on Server Core and will fail.

I committed a change to wrap this in try-catch and use read-host if the load fails (I think), but have no idea how to move this forward...or even if my rough "fix" works properly.

Couple of silly questions:
1- What is the sequence of executing the scripts in each DefCon?
2- Where do I get the certificate - ca.crt (used in DefCon4)?

We'll be using Loggly, which is 3rd party/Cloud-based Logstash/ELK. So, we have no idea how the certificate is setup.
Can we modify the script to install/configure Winlogbeat without a certificate?