Set execution policy winlogbeat #38
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
llwaterhouse
approved these changes
Nov 17, 2023
mitchelbaker-cisa
approved these changes
Nov 17, 2023
mitchelbaker-cisa
pushed a commit
that referenced
this pull request
Nov 17, 2023
Co-authored-by: Clint Baxley <[email protected]>
llwaterhouse
added a commit
that referenced
this pull request
Nov 21, 2023
* Adding updates to troubleshooting to address the latest issues. * Added Filtering.md to documents to discuss how to filter out unnessecary logs * Change "activate selected" to "Enable" * Changed "New - User Security" to "User Security" to reflect current dashboard name * Updated dashboard count and location * Adds a script to export dashboards * Adding Compute Software Overview dashboard * User HR Dashboard Ready for Review and Release * Bump Elasticsearch Version * Bump version in readme * adding alert dashboard (#46) Co-authored-by: Diabe <[email protected]> Co-authored-by: Michael Reeves <[email protected]> * Add a command to allow the execution of the winlogbeat.exe file (#38) Co-authored-by: Clint Baxley <[email protected]> * add process_explorer.ndjson file (#37) Co-authored-by: root <[email protected]> Co-authored-by: Connor <[email protected]> * Creating Initial Draft of issue templates (#34) * Creating Initial Draft of issue templates Issue Templates to aid with docs_update * Update bug-or-error-report.md * Update bug-or-error-report.md Minor typos * Proofread bug-or-error-report.md, updated phrasing in some places --------- Co-authored-by: Chad Poland <[email protected]> Co-authored-by: Linda Waterhouse <[email protected]> Co-authored-by: mitchelbaker-cisa <[email protected]> * remove input controls and update filtering with Kibana Control filters for (hostname, process exe, process pid) * Alert Dashboard review (#49) * adding alert dashboard * Create Alerting_dashboard.ndjson * Rename Alerting_dasboard.ndjson to Alerting_dashboard.ndjson * Rename Alerting_dashboard.ndjson to alert_dashboard.ndjson * Delete dasboards directory --------- Co-authored-by: Diabe <[email protected]> Co-authored-by: Michael Reeves <[email protected]> * Delete dasboards directory (#50) * Update deploy.sh to debug issue #33 Add logging to indicate the script's progress and where it might be failing + introduce a maximum number of 60 attempts to check for Elasticsearch readiness, preventing the script from hanging indefinitely. * Updates the dashboard menu and all of the dashboards that use it. (#53) * Change the navigation menu to exclude the old home page and include the new dashboards. * Delete the security dashboard home --------- Co-authored-by: Clint Baxley <[email protected]> * Lme update functionality (#30) * adding updates to chapter3 for deploy.sh changes * adding updates to dashboard and lme_update to log and run as better cron jobs * adding in more notes to chapter3 on update functionality * Added the following features to deploy.sh: - update function to add lme_upadte.sh and dashboard_update.sh to root's crontab - fixed final permissions so that /opt/lme is readable by `sudo` group - y/n on the uninstall options fixed - upgrade function updated to check for 1.0 version and only remove crontab in upgrading from 0.5.1 - usage function to print the usage * fixing read/write on the files_for_windows.zip * fixing backups permissions * Update chapter3.md (#29) * Update chapter3.md Changed winlogbeat 8.5.0 link to one, that allows user to download not only zip, but also sha512 control sum and also choose between zip and MSI. * Update chapter3.md Changed Winlogbeat to 8.11.1 * Update the readmes to delete old dashboards and import new ones. (#54) Co-authored-by: Clint Baxley <[email protected]> * Update Uninstall_Sysmon64.ps1 (#27) Check if Sysmon is installed, run the uninstall command with elevated privileges, and handle potential errors. Remove the Sysmon executable if the uninstallation is successful. * Deploy upgrade 1.1.0 (#58) * adding in upgrade command to go from 1.0 -> 1.1.0 * pushing upgrade notes * adding updates to deploy.sh for upgrading 1.0 -> 1.1.0 * adding CONTRIBUTING.md,RELEASES.md, and Custom PR-Template (#41) * adding Contribution and release documentation to help standardize these processes * Update CONTRIBUTING.md fixed typos. * documenting PR template to standardize and streamline Pull Requests * adding a few more changes * adding formatting changes * Rename pull_request_template.md to pull_request_template.md Actually renamed directory PULL_REUQEST_TEMPLATE to PULL_REQUEST_TEMPLATE --------- Co-authored-by: Linda Waterhouse <[email protected]> * remove updates that break the installation process, need more refactoring/testing before we can push these changes * Release 1.1.0 small updates (#61) * updating deploy.sh with fixes that solve permissions issues and still provide security for files with plaintext passwords * updating docs to state more accurate required disk sizes --------- Co-authored-by: Alden Hilton <[email protected]> Co-authored-by: Clint Baxley <[email protected]> Co-authored-by: Connor Aubry <[email protected]> Co-authored-by: Grant (SNL) <[email protected]> Co-authored-by: Clint Baxley <[email protected]> Co-authored-by: ddiabe <[email protected]> Co-authored-by: Diabe <[email protected]> Co-authored-by: mitchelbaker-cisa <[email protected]> Co-authored-by: root <[email protected]> Co-authored-by: Connor <[email protected]> Co-authored-by: Chad Poland <[email protected]> Co-authored-by: Linda Waterhouse <[email protected]> Co-authored-by: mitchelbaker-cisa <[email protected]> Co-authored-by: Dmytro Korzhevin <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🗣 Add instructions to set execution policy for winlogbeat
Add the instructions to allow powershell to run programs from the internet.
💭 Motivation and context
Programs from the internet sometimes won't run depending on the policy of the server.
🧪 Testing
I had to run this command each time I installed winlogbeat.
✅ Pre-approval checklist
✅ Pre-merge checklist
✅ Post-merge checklist