Initial commit

ระบบ SOAR integration ร่วมกับ Wazuh/script.ps1

@@ -0,0 +1,22 @@
+$ErrorActionPreference = 'Stop'
+Write-Host "[*] Searching for Sysmon Service path..."
+$sysmonSvc = Get-CimInstance Win32_Service -Filter "Name like 'Sysmon%'" | Select-Object -First 1
+if (-not $sysmonSvc) { Write-Host "Error: Sysmon service is not installed on this machine!" -ForegroundColor Red; exit 1 }
+$sysmonExe = $sysmonSvc.PathName -replace '"', ''
+Write-Host "[*] Found Sysmon at $sysmonExe"
+Write-Host "[*] Downloading latest SwiftOnSecurity config..."
+$xmlPath = "$env:TEMP\sysmon_soar.xml"
+Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml' -OutFile $xmlPath
+[xml]$xml = Get-Content $xmlPath
+Write-Host "[*] Patching Network & DNS Logging rules..."
+$xml.SelectNodes('//RuleGroup/NetworkConnect') | ForEach-Object { $_.ParentNode.RemoveChild($_) | Out-Null }
+$xml.SelectNodes('//RuleGroup/DnsQuery') | ForEach-Object { $_.ParentNode.RemoveChild($_) | Out-Null }
+$newNet = $xml.CreateElement('NetworkConnect')
+$newNet.SetAttribute('onmatch', 'exclude')
+$xml.SelectSingleNode('//EventFiltering').AppendChild($newNet) | Out-Null
+$newDns = $xml.CreateElement('DnsQuery')
+$newDns.SetAttribute('onmatch', 'exclude')
+$xml.SelectSingleNode('//EventFiltering').AppendChild($newDns) | Out-Null
+$xml.Save($xmlPath)
+Write-Host "[*] Applying configuration to Sysmon..."
+Start-Process -FilePath $sysmonExe -ArgumentList "-c `"$xmlPath`"" -Wait -NoNewWindow