Initial commit

ระบบ SOAR integration ร่วมกับ Wazuh/test_xml.ps1

@@ -0,0 +1,23 @@
+[xml]$xml = Get-Content "sysmonconfig.xml"
+
+# Remove all existing NetworkConnect and DnsQuery
+$xml.SelectNodes("//NetworkConnect") | ForEach-Object { [void]$_.ParentNode.RemoveChild($_) }
+$xml.SelectNodes("//DnsQuery") | ForEach-Object { [void]$_.ParentNode.RemoveChild($_) }
+
+# Create a new RuleGroup
+$ruleGroup = $xml.CreateElement("RuleGroup")
+$ruleGroup.SetAttribute("name", "AggressiveNetwork")
+$ruleGroup.SetAttribute("groupRelation", "or")
+
+$netNode = $xml.CreateElement("NetworkConnect")
+$netNode.SetAttribute("onmatch", "exclude")
+$netNode.InnerXml = "<DestinationIp condition='is'>127.0.0.1</DestinationIp><SourceIp condition='is'>127.0.0.1</SourceIp><DestinationIp condition='begin with'>192.168.</DestinationIp><DestinationIp condition='begin with'>10.</DestinationIp>"
+[void]$ruleGroup.AppendChild($netNode)
+
+$dnsNode = $xml.CreateElement("DnsQuery")
+$dnsNode.SetAttribute("onmatch", "exclude")
+$dnsNode.InnerXml = "<QueryName condition='end with'>.arpa</QueryName><QueryName condition='end with'>.local</QueryName>"
+[void]$ruleGroup.AppendChild($dnsNode)
+
+[void]$xml.Sysmon.EventFiltering.AppendChild($ruleGroup)
+$xml.Save("sysmon_tuned.xml")