blackhillsinfosec / eventlogging Goto Github PK
View Code? Open in Web Editor NEWAutomation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
License: GNU General Public License v3.0
Automation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
License: GNU General Public License v3.0
Your .XML files contain HKCU registry entries. Since the Sysmon service runs under the SYSTEM account, Sysmon would be looking for any HKCU registry items under the SYSTEM account; NOT the logged-on user(s). Several of your .XML files contain HKCU registry entries. Since the Sysmon service runs under the SYSTEM account, Sysmon would be looking for any HKCU registry items under the SYSTEM account; NOT the logged-on user(s).
Reference: olafhartong/sysmon-modular#130
I brought this issue up before as "DC Configuration script runs with errors" . I got errors when I ran the DC-Configurator-NoAudit script. It gave me couple of errors. Your suggestion was to run powershell.exe /c ./DC-Configurator-NoAudit.ps1 and see if I still get the errors. I did and I still got the same errors. (see screenshot). I still don't see any new GPOs.
Sorry to keep bugging you about this, but after attending your BHIS/WWHF webinar a while back and numerous attempts, I still don't have anything working. Btw what are the names of the GPOs that the script is supposed to create?
function get-csvfilepath loads an assembly that is not present on Server Core and will fail.
I committed a change to wrap this in try-catch and use read-host if the load fails (I think), but have no idea how to move this forward...or even if my rough "fix" works properly.
Couple of silly questions:
1- What is the sequence of executing the scripts in each DefCon?
2- Where do I get the certificate - ca.crt (used in DefCon4)?
We'll be using Loggly, which is 3rd party/Cloud-based Logstash/ELK. So, we have no idea how the certificate is setup.
Can we modify the script to install/configure Winlogbeat without a certificate?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.