Adopt OCSentinel script layout and add Gitea workflow
Some checks failed
OfficeCom Sentinel Client / build-client (push) Has been cancelled
Some checks failed
OfficeCom Sentinel Client / build-client (push) Has been cancelled
This commit is contained in:
OfficeCom Codex
@@ -1,25 +1,15 @@
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[string]$SecretValue,
|
||||
[string]$OutputPath = "C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat"
|
||||
[Parameter(ValueFromRemainingArguments = $true)]
|
||||
[string[]]$RemainingArgs
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
Add-Type -AssemblyName System.Security
|
||||
|
||||
$outputFullPath = [System.IO.Path]::GetFullPath($OutputPath)
|
||||
$outputDirectory = Split-Path -Parent $outputFullPath
|
||||
if (-not [string]::IsNullOrWhiteSpace($outputDirectory)) {
|
||||
New-Item -ItemType Directory -Force -Path $outputDirectory | Out-Null
|
||||
$newScript = Join-Path $PSScriptRoot "protect-ocsentinel-secret.ps1"
|
||||
if (-not (Test-Path $newScript)) {
|
||||
throw "Replacement script not found: $newScript"
|
||||
}
|
||||
|
||||
$secretBytes = [System.Text.Encoding]::UTF8.GetBytes($SecretValue)
|
||||
$protectedBytes = [System.Security.Cryptography.ProtectedData]::Protect(
|
||||
$secretBytes,
|
||||
$null,
|
||||
[System.Security.Cryptography.DataProtectionScope]::LocalMachine
|
||||
)
|
||||
|
||||
[System.IO.File]::WriteAllBytes($outputFullPath, $protectedBytes)
|
||||
Write-Host "Protected secret written to $outputFullPath"
|
||||
Write-Host "Compatibility wrapper: protect-attacktracer-secret.ps1 -> protect-ocsentinel-secret.ps1"
|
||||
& powershell.exe -ExecutionPolicy Bypass -File $newScript @RemainingArgs
|
||||
exit $LASTEXITCODE
|
||||
|
||||
25
scripts/protect-ocsentinel-secret.ps1
Normal file
25
scripts/protect-ocsentinel-secret.ps1
Normal file
@@ -0,0 +1,25 @@
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[string]$SecretValue,
|
||||
[string]$OutputPath = "C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat"
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
Add-Type -AssemblyName System.Security
|
||||
|
||||
$outputFullPath = [System.IO.Path]::GetFullPath($OutputPath)
|
||||
$outputDirectory = Split-Path -Parent $outputFullPath
|
||||
if (-not [string]::IsNullOrWhiteSpace($outputDirectory)) {
|
||||
New-Item -ItemType Directory -Force -Path $outputDirectory | Out-Null
|
||||
}
|
||||
|
||||
$secretBytes = [System.Text.Encoding]::UTF8.GetBytes($SecretValue)
|
||||
$protectedBytes = [System.Security.Cryptography.ProtectedData]::Protect(
|
||||
$secretBytes,
|
||||
$null,
|
||||
[System.Security.Cryptography.DataProtectionScope]::LocalMachine
|
||||
)
|
||||
|
||||
[System.IO.File]::WriteAllBytes($outputFullPath, $protectedBytes)
|
||||
Write-Host "Protected secret written to $outputFullPath"
|
||||
@@ -1,213 +1,15 @@
|
||||
param(
|
||||
[int]$LookbackDays = 7,
|
||||
[int]$TopCount = 10,
|
||||
[string]$OutputPath = ".\reports\attacktracer-summary.json",
|
||||
[string]$ConfigPath = ".\config\attacktracer-settings.example.json",
|
||||
[string]$VulnerabilityCsvPath = "",
|
||||
[string]$MirrorRoot = "",
|
||||
[ValidateSet("status", "attack-only", "cve-critical", "attack-plus-cve")]
|
||||
[string]$Mode = "status"
|
||||
[Parameter(ValueFromRemainingArguments = $true)]
|
||||
[string[]]$RemainingArgs
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$repoRoot = Split-Path -Parent $PSScriptRoot
|
||||
$runnerScript = Join-Path $repoRoot "scripts\run-attacktracer-ninja.ps1"
|
||||
$outputFullPath = [System.IO.Path]::GetFullPath((Join-Path $repoRoot $OutputPath))
|
||||
|
||||
$script:NinjaFieldBackend = $null
|
||||
$script:NinjaCliPath = "C:\ProgramData\NinjaRMMAgent\ninjarmm-cli.exe"
|
||||
|
||||
function Resolve-PathLike {
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[string]$PathValue,
|
||||
[Parameter(Mandatory)]
|
||||
[string]$BasePath
|
||||
)
|
||||
|
||||
if ([string]::IsNullOrWhiteSpace($PathValue)) {
|
||||
return $PathValue
|
||||
}
|
||||
|
||||
if ([System.IO.Path]::IsPathRooted($PathValue) -or $PathValue.StartsWith("\\")) {
|
||||
return [System.IO.Path]::GetFullPath($PathValue)
|
||||
}
|
||||
|
||||
return [System.IO.Path]::GetFullPath((Join-Path $BasePath $PathValue))
|
||||
$newScript = Join-Path $PSScriptRoot "run-ocsentinel-monitor.ps1"
|
||||
if (-not (Test-Path $newScript)) {
|
||||
throw "Replacement script not found: $newScript"
|
||||
}
|
||||
|
||||
function Initialize-NinjaFieldWriter {
|
||||
if ($null -ne $script:NinjaFieldBackend) {
|
||||
return
|
||||
}
|
||||
|
||||
if (Get-Command -Name "Ninja-Property-Set" -ErrorAction SilentlyContinue) {
|
||||
$script:NinjaFieldBackend = "powershell"
|
||||
return
|
||||
}
|
||||
|
||||
if (Test-Path $script:NinjaCliPath) {
|
||||
$script:NinjaFieldBackend = "cli"
|
||||
return
|
||||
}
|
||||
|
||||
$script:NinjaFieldBackend = "none"
|
||||
}
|
||||
|
||||
function Set-NinjaCustomFieldValue {
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[string]$Name,
|
||||
[AllowEmptyString()]
|
||||
[string]$Value
|
||||
)
|
||||
|
||||
Initialize-NinjaFieldWriter
|
||||
|
||||
switch ($script:NinjaFieldBackend) {
|
||||
"powershell" {
|
||||
Ninja-Property-Set $Name $Value | Out-Null
|
||||
return $true
|
||||
}
|
||||
"cli" {
|
||||
& $script:NinjaCliPath set $Name $Value | Out-Null
|
||||
return $LASTEXITCODE -eq 0
|
||||
}
|
||||
default {
|
||||
return $false
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function Publish-NinjaCustomFields {
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[pscustomobject]$Report,
|
||||
[Parameter(Mandatory)]
|
||||
[string]$Mode,
|
||||
[Parameter(Mandatory)]
|
||||
[bool]$Triggered,
|
||||
[Parameter(Mandatory)]
|
||||
[string]$Reason
|
||||
)
|
||||
|
||||
Initialize-NinjaFieldWriter
|
||||
if ($script:NinjaFieldBackend -eq "none") {
|
||||
Write-Host "Ninja custom fields: skipped (Ninja field writer not available)."
|
||||
return
|
||||
}
|
||||
|
||||
$generatedAtUtc = ""
|
||||
if ($Report.GeneratedAtLocal) {
|
||||
try {
|
||||
$generatedAtUtc = ([DateTimeOffset]$Report.GeneratedAtLocal).ToUniversalTime().ToString("o")
|
||||
}
|
||||
catch {
|
||||
$generatedAtUtc = [string]$Report.GeneratedAtLocal
|
||||
}
|
||||
}
|
||||
|
||||
$fieldValues = [ordered]@{
|
||||
"attacktracerstatus" = [string]$Report.AlertState
|
||||
"attacktracerreason" = $Reason
|
||||
"attacktracerbasestatus" = [string]$Report.BaseAlertState
|
||||
"attacktracerevents" = [string]([int]$Report.TotalEvents)
|
||||
"attacktraceruniqueips" = [string]([int]$Report.UniqueIpCount)
|
||||
"attacktracercvecritical" = [string]([int]$Report.VulnerabilityCorrelation.CriticalCount)
|
||||
"attacktracercvetotal" = [string]([int]$Report.VulnerabilityCorrelation.TotalCount)
|
||||
"attacktracermode" = $Mode
|
||||
"attacktracertriggered" = $Triggered.ToString().ToLowerInvariant()
|
||||
"attacktracerlastscanutc" = $generatedAtUtc
|
||||
}
|
||||
|
||||
$updated = 0
|
||||
foreach ($entry in $fieldValues.GetEnumerator()) {
|
||||
try {
|
||||
if (Set-NinjaCustomFieldValue -Name $entry.Key -Value $entry.Value) {
|
||||
$updated++
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-Warning "Failed to set Ninja custom field '$($entry.Key)': $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host "Ninja custom fields: updated $updated field(s) via $script:NinjaFieldBackend."
|
||||
}
|
||||
|
||||
$runnerArgs = @(
|
||||
"-ExecutionPolicy", "Bypass",
|
||||
"-File", $runnerScript,
|
||||
"-LookbackDays", $LookbackDays,
|
||||
"-TopCount", $TopCount,
|
||||
"-OutputPath", $OutputPath,
|
||||
"-ConfigPath", $ConfigPath
|
||||
)
|
||||
|
||||
if (-not [string]::IsNullOrWhiteSpace($VulnerabilityCsvPath)) {
|
||||
$runnerArgs += @("-VulnerabilityCsvPath", $VulnerabilityCsvPath)
|
||||
}
|
||||
|
||||
if (-not [string]::IsNullOrWhiteSpace($MirrorRoot)) {
|
||||
$runnerArgs += @("-MirrorRoot", (Resolve-PathLike -PathValue $MirrorRoot -BasePath $repoRoot))
|
||||
}
|
||||
|
||||
$null = & powershell @runnerArgs
|
||||
$runnerExitCode = $LASTEXITCODE
|
||||
|
||||
if (-not (Test-Path $outputFullPath)) {
|
||||
throw "Expected report file was not created: $outputFullPath"
|
||||
}
|
||||
|
||||
$report = Get-Content $outputFullPath -Raw | ConvertFrom-Json
|
||||
|
||||
$status = [string]$report.AlertState
|
||||
$baseStatus = [string]$report.BaseAlertState
|
||||
$events = [int]$report.TotalEvents
|
||||
$uniqueIps = [int]$report.UniqueIpCount
|
||||
$criticalCves = [int]$report.VulnerabilityCorrelation.CriticalCount
|
||||
$totalCves = [int]$report.VulnerabilityCorrelation.TotalCount
|
||||
|
||||
$monitorTriggered = $false
|
||||
$monitorReason = ""
|
||||
|
||||
switch ($Mode) {
|
||||
"status" {
|
||||
$monitorTriggered = $status -ne "ok"
|
||||
$monitorReason = "Final status is $status. $($report.AlertReason)"
|
||||
}
|
||||
"attack-only" {
|
||||
$monitorTriggered = $baseStatus -ne "ok"
|
||||
$monitorReason = "Base attack status is $baseStatus. $($report.BaseAlertReason)"
|
||||
}
|
||||
"cve-critical" {
|
||||
$monitorTriggered = $criticalCves -gt 0
|
||||
$monitorReason = "Critical/high CVE count is $criticalCves out of total CVEs $totalCves."
|
||||
}
|
||||
"attack-plus-cve" {
|
||||
$monitorTriggered = ($events -gt 0 -and $criticalCves -gt 0)
|
||||
$monitorReason = "Attack events=$events and critical/high CVEs=$criticalCves."
|
||||
}
|
||||
}
|
||||
|
||||
Publish-NinjaCustomFields -Report $report -Mode $Mode -Triggered $monitorTriggered -Reason $monitorReason
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "AttackTracer Ninja monitor mode: $Mode"
|
||||
Write-Host "Triggered: $monitorTriggered"
|
||||
Write-Host "Reason: $monitorReason"
|
||||
Write-Host "Status: $status"
|
||||
Write-Host "Base status: $baseStatus"
|
||||
Write-Host "Events: $events"
|
||||
Write-Host "Unique IPs: $uniqueIps"
|
||||
Write-Host "Critical/High CVEs: $criticalCves"
|
||||
Write-Host "Total CVEs: $totalCves"
|
||||
Write-Host "Report: $outputFullPath"
|
||||
Write-Host "Runner exit code: $runnerExitCode"
|
||||
|
||||
if ($monitorTriggered) {
|
||||
exit 1
|
||||
}
|
||||
|
||||
exit 0
|
||||
Write-Host "Compatibility wrapper: run-attacktracer-ninja-monitor.ps1 -> run-ocsentinel-monitor.ps1"
|
||||
& powershell.exe -ExecutionPolicy Bypass -File $newScript @RemainingArgs
|
||||
exit $LASTEXITCODE
|
||||
|
||||
@@ -1,144 +1,15 @@
|
||||
param(
|
||||
[int]$LookbackDays = 7,
|
||||
[int]$TopCount = 10,
|
||||
[string]$OutputPath = ".\reports\attacktracer-summary.json",
|
||||
[string]$ConfigPath = ".\config\attacktracer-settings.example.json",
|
||||
[string]$ClientConfigPath = ".\config\attacktracer-client.example.json",
|
||||
[string]$SecretPath = "",
|
||||
[string]$VulnerabilityCsvPath = "",
|
||||
[string]$MirrorRoot = "",
|
||||
[ValidateSet("disabled", "auto", "required")]
|
||||
[string]$UploadMode = "auto",
|
||||
[switch]$FailOnAttacks,
|
||||
[switch]$FailOnThreshold
|
||||
[Parameter(ValueFromRemainingArguments = $true)]
|
||||
[string[]]$RemainingArgs
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$repoRoot = Split-Path -Parent $PSScriptRoot
|
||||
$projectPath = Join-Path $repoRoot "src\AttackTracerNinjaCli\AttackTracerNinjaCli.csproj"
|
||||
$outputFullPath = [System.IO.Path]::GetFullPath((Join-Path $repoRoot $OutputPath))
|
||||
$buildOutputDir = Join-Path $repoRoot "src\AttackTracerNinjaCli\bin\Debug\net10.0"
|
||||
$dllPath = Join-Path $buildOutputDir "AttackTracerNinjaCli.dll"
|
||||
|
||||
function Resolve-PathLike {
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[string]$PathValue,
|
||||
[Parameter(Mandatory)]
|
||||
[string]$BasePath
|
||||
)
|
||||
|
||||
if ([string]::IsNullOrWhiteSpace($PathValue)) {
|
||||
return $PathValue
|
||||
}
|
||||
|
||||
if ([System.IO.Path]::IsPathRooted($PathValue) -or $PathValue.StartsWith("\\")) {
|
||||
return [System.IO.Path]::GetFullPath($PathValue)
|
||||
}
|
||||
|
||||
return [System.IO.Path]::GetFullPath((Join-Path $BasePath $PathValue))
|
||||
$newScript = Join-Path $PSScriptRoot "run-ocsentinel.ps1"
|
||||
if (-not (Test-Path $newScript)) {
|
||||
throw "Replacement script not found: $newScript"
|
||||
}
|
||||
|
||||
$arguments = @(
|
||||
$dllPath
|
||||
)
|
||||
|
||||
$configFullPath = [System.IO.Path]::GetFullPath((Join-Path $repoRoot $ConfigPath))
|
||||
if ($UploadMode -eq "disabled") {
|
||||
$arguments += "scan"
|
||||
}
|
||||
else {
|
||||
$clientConfigFullPath = Resolve-PathLike -PathValue $ClientConfigPath -BasePath $repoRoot
|
||||
$secretFullPath = if ([string]::IsNullOrWhiteSpace($SecretPath)) { "" } else { Resolve-PathLike -PathValue $SecretPath -BasePath $repoRoot }
|
||||
$canUpload = (Test-Path $clientConfigFullPath) -and (-not [string]::IsNullOrWhiteSpace($secretFullPath)) -and (Test-Path $secretFullPath)
|
||||
|
||||
if ($UploadMode -eq "required" -and -not $canUpload) {
|
||||
throw "UploadMode 'required' was set, but client config or protected secret is missing."
|
||||
}
|
||||
|
||||
if ($canUpload) {
|
||||
$arguments += "scan-and-upload"
|
||||
$arguments += @("--client-config", $clientConfigFullPath, "--secret-path", $secretFullPath)
|
||||
}
|
||||
else {
|
||||
$arguments += "scan"
|
||||
}
|
||||
}
|
||||
|
||||
$arguments += @(
|
||||
"--lookback-days", $LookbackDays,
|
||||
"--top", $TopCount,
|
||||
"--output", $outputFullPath,
|
||||
"--ninja-output"
|
||||
)
|
||||
|
||||
if (Test-Path $configFullPath) {
|
||||
$arguments += @("--config", $configFullPath)
|
||||
}
|
||||
|
||||
if (-not [string]::IsNullOrWhiteSpace($VulnerabilityCsvPath)) {
|
||||
$vulnerabilityCsvFullPath = [System.IO.Path]::GetFullPath((Join-Path $repoRoot $VulnerabilityCsvPath))
|
||||
if (Test-Path $vulnerabilityCsvFullPath) {
|
||||
$arguments += @("--vulnerability-csv", $vulnerabilityCsvFullPath)
|
||||
}
|
||||
}
|
||||
|
||||
if ($FailOnAttacks) {
|
||||
$arguments += "--fail-on-attacks"
|
||||
}
|
||||
|
||||
if ($FailOnThreshold) {
|
||||
$arguments += "--fail-on-threshold"
|
||||
}
|
||||
|
||||
$null = & dotnet build $projectPath
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
exit $LASTEXITCODE
|
||||
}
|
||||
|
||||
if (-not (Test-Path $dllPath)) {
|
||||
throw "Expected compiled DLL was not created: $dllPath"
|
||||
}
|
||||
|
||||
& dotnet @arguments
|
||||
$exitCode = $LASTEXITCODE
|
||||
|
||||
if (-not (Test-Path $outputFullPath)) {
|
||||
throw "Expected report file was not created: $outputFullPath"
|
||||
}
|
||||
|
||||
$report = Get-Content $outputFullPath -Raw | ConvertFrom-Json
|
||||
|
||||
if (-not [string]::IsNullOrWhiteSpace($MirrorRoot)) {
|
||||
Write-Host "Legacy mirror mode enabled."
|
||||
$mirrorRootPath = Resolve-PathLike -PathValue $MirrorRoot -BasePath $repoRoot
|
||||
if (-not (Test-Path $mirrorRootPath)) {
|
||||
New-Item -ItemType Directory -Force -Path $mirrorRootPath | Out-Null
|
||||
}
|
||||
$mirrorPath = Join-Path $mirrorRootPath "$($report.MachineName).json"
|
||||
Copy-Item -Path $outputFullPath -Destination $mirrorPath -Force
|
||||
Write-Host "Mirrored report: $mirrorPath"
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "Ninja wrapper summary"
|
||||
Write-Host "Machine: $($report.MachineName)"
|
||||
Write-Host "Events: $($report.TotalEvents)"
|
||||
Write-Host "Unique IPs: $($report.UniqueIpCount)"
|
||||
Write-Host "Status: $($report.AlertState)"
|
||||
Write-Host "Reason: $($report.AlertReason)"
|
||||
Write-Host "Base status: $($report.BaseAlertState)"
|
||||
Write-Host "CVE findings: $($report.VulnerabilityCorrelation.TotalCount)"
|
||||
Write-Host "Critical/High CVEs: $($report.VulnerabilityCorrelation.CriticalCount)"
|
||||
Write-Host "Upload mode: $UploadMode"
|
||||
Write-Host "Report: $outputFullPath"
|
||||
|
||||
if ($report.Errors.Count -gt 0) {
|
||||
Write-Host "Warnings:"
|
||||
foreach ($warningEntry in $report.Errors) {
|
||||
Write-Host "- $warningEntry"
|
||||
}
|
||||
}
|
||||
|
||||
exit $exitCode
|
||||
Write-Host "Compatibility wrapper: run-attacktracer-ninja.ps1 -> run-ocsentinel.ps1"
|
||||
& powershell.exe -ExecutionPolicy Bypass -File $newScript @RemainingArgs
|
||||
exit $LASTEXITCODE
|
||||
|
||||
213
scripts/run-ocsentinel-monitor.ps1
Normal file
213
scripts/run-ocsentinel-monitor.ps1
Normal file
@@ -0,0 +1,213 @@
|
||||
param(
|
||||
[int]$LookbackDays = 7,
|
||||
[int]$TopCount = 10,
|
||||
[string]$OutputPath = ".\reports\ocsentinel-summary.json",
|
||||
[string]$ConfigPath = ".\config\ocsentinel-settings.example.json",
|
||||
[string]$VulnerabilityCsvPath = "",
|
||||
[string]$MirrorRoot = "",
|
||||
[ValidateSet("status", "attack-only", "cve-critical", "attack-plus-cve")]
|
||||
[string]$Mode = "status"
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$repoRoot = Split-Path -Parent $PSScriptRoot
|
||||
$runnerScript = Join-Path $repoRoot "scripts\run-ocsentinel.ps1"
|
||||
$outputFullPath = [System.IO.Path]::GetFullPath((Join-Path $repoRoot $OutputPath))
|
||||
|
||||
$script:NinjaFieldBackend = $null
|
||||
$script:NinjaCliPath = "C:\ProgramData\NinjaRMMAgent\ninjarmm-cli.exe"
|
||||
|
||||
function Resolve-PathLike {
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[string]$PathValue,
|
||||
[Parameter(Mandatory)]
|
||||
[string]$BasePath
|
||||
)
|
||||
|
||||
if ([string]::IsNullOrWhiteSpace($PathValue)) {
|
||||
return $PathValue
|
||||
}
|
||||
|
||||
if ([System.IO.Path]::IsPathRooted($PathValue) -or $PathValue.StartsWith("\\")) {
|
||||
return [System.IO.Path]::GetFullPath($PathValue)
|
||||
}
|
||||
|
||||
return [System.IO.Path]::GetFullPath((Join-Path $BasePath $PathValue))
|
||||
}
|
||||
|
||||
function Initialize-NinjaFieldWriter {
|
||||
if ($null -ne $script:NinjaFieldBackend) {
|
||||
return
|
||||
}
|
||||
|
||||
if (Get-Command -Name "Ninja-Property-Set" -ErrorAction SilentlyContinue) {
|
||||
$script:NinjaFieldBackend = "powershell"
|
||||
return
|
||||
}
|
||||
|
||||
if (Test-Path $script:NinjaCliPath) {
|
||||
$script:NinjaFieldBackend = "cli"
|
||||
return
|
||||
}
|
||||
|
||||
$script:NinjaFieldBackend = "none"
|
||||
}
|
||||
|
||||
function Set-NinjaCustomFieldValue {
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[string]$Name,
|
||||
[AllowEmptyString()]
|
||||
[string]$Value
|
||||
)
|
||||
|
||||
Initialize-NinjaFieldWriter
|
||||
|
||||
switch ($script:NinjaFieldBackend) {
|
||||
"powershell" {
|
||||
Ninja-Property-Set $Name $Value | Out-Null
|
||||
return $true
|
||||
}
|
||||
"cli" {
|
||||
& $script:NinjaCliPath set $Name $Value | Out-Null
|
||||
return $LASTEXITCODE -eq 0
|
||||
}
|
||||
default {
|
||||
return $false
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function Publish-NinjaCustomFields {
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[pscustomobject]$Report,
|
||||
[Parameter(Mandatory)]
|
||||
[string]$Mode,
|
||||
[Parameter(Mandatory)]
|
||||
[bool]$Triggered,
|
||||
[Parameter(Mandatory)]
|
||||
[string]$Reason
|
||||
)
|
||||
|
||||
Initialize-NinjaFieldWriter
|
||||
if ($script:NinjaFieldBackend -eq "none") {
|
||||
Write-Host "Ninja custom fields: skipped (Ninja field writer not available)."
|
||||
return
|
||||
}
|
||||
|
||||
$generatedAtUtc = ""
|
||||
if ($Report.GeneratedAtLocal) {
|
||||
try {
|
||||
$generatedAtUtc = ([DateTimeOffset]$Report.GeneratedAtLocal).ToUniversalTime().ToString("o")
|
||||
}
|
||||
catch {
|
||||
$generatedAtUtc = [string]$Report.GeneratedAtLocal
|
||||
}
|
||||
}
|
||||
|
||||
$fieldValues = [ordered]@{
|
||||
"ocsentinelstatus" = [string]$Report.AlertState
|
||||
"ocsentinelreason" = $Reason
|
||||
"ocsentinelbasestatus" = [string]$Report.BaseAlertState
|
||||
"ocsentinelevents" = [string]([int]$Report.TotalEvents)
|
||||
"ocsentineluniqueips" = [string]([int]$Report.UniqueIpCount)
|
||||
"ocsentinelcvecritical" = [string]([int]$Report.VulnerabilityCorrelation.CriticalCount)
|
||||
"ocsentinelcvetotal" = [string]([int]$Report.VulnerabilityCorrelation.TotalCount)
|
||||
"ocsentinelmode" = $Mode
|
||||
"ocsentineltriggered" = $Triggered.ToString().ToLowerInvariant()
|
||||
"ocsentinellastscanutc" = $generatedAtUtc
|
||||
}
|
||||
|
||||
$updated = 0
|
||||
foreach ($entry in $fieldValues.GetEnumerator()) {
|
||||
try {
|
||||
if (Set-NinjaCustomFieldValue -Name $entry.Key -Value $entry.Value) {
|
||||
$updated++
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-Warning "Failed to set Ninja custom field '$($entry.Key)': $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host "Ninja custom fields: updated $updated field(s) via $script:NinjaFieldBackend."
|
||||
}
|
||||
|
||||
$runnerArgs = @(
|
||||
"-ExecutionPolicy", "Bypass",
|
||||
"-File", $runnerScript,
|
||||
"-LookbackDays", $LookbackDays,
|
||||
"-TopCount", $TopCount,
|
||||
"-OutputPath", $OutputPath,
|
||||
"-ConfigPath", $ConfigPath
|
||||
)
|
||||
|
||||
if (-not [string]::IsNullOrWhiteSpace($VulnerabilityCsvPath)) {
|
||||
$runnerArgs += @("-VulnerabilityCsvPath", $VulnerabilityCsvPath)
|
||||
}
|
||||
|
||||
if (-not [string]::IsNullOrWhiteSpace($MirrorRoot)) {
|
||||
$runnerArgs += @("-MirrorRoot", (Resolve-PathLike -PathValue $MirrorRoot -BasePath $repoRoot))
|
||||
}
|
||||
|
||||
$null = & powershell @runnerArgs
|
||||
$runnerExitCode = $LASTEXITCODE
|
||||
|
||||
if (-not (Test-Path $outputFullPath)) {
|
||||
throw "Expected report file was not created: $outputFullPath"
|
||||
}
|
||||
|
||||
$report = Get-Content $outputFullPath -Raw | ConvertFrom-Json
|
||||
|
||||
$status = [string]$report.AlertState
|
||||
$baseStatus = [string]$report.BaseAlertState
|
||||
$events = [int]$report.TotalEvents
|
||||
$uniqueIps = [int]$report.UniqueIpCount
|
||||
$criticalCves = [int]$report.VulnerabilityCorrelation.CriticalCount
|
||||
$totalCves = [int]$report.VulnerabilityCorrelation.TotalCount
|
||||
|
||||
$monitorTriggered = $false
|
||||
$monitorReason = ""
|
||||
|
||||
switch ($Mode) {
|
||||
"status" {
|
||||
$monitorTriggered = $status -ne "ok"
|
||||
$monitorReason = "Final status is $status. $($report.AlertReason)"
|
||||
}
|
||||
"attack-only" {
|
||||
$monitorTriggered = $baseStatus -ne "ok"
|
||||
$monitorReason = "Base attack status is $baseStatus. $($report.BaseAlertReason)"
|
||||
}
|
||||
"cve-critical" {
|
||||
$monitorTriggered = $criticalCves -gt 0
|
||||
$monitorReason = "Critical/high CVE count is $criticalCves out of total CVEs $totalCves."
|
||||
}
|
||||
"attack-plus-cve" {
|
||||
$monitorTriggered = ($events -gt 0 -and $criticalCves -gt 0)
|
||||
$monitorReason = "Attack events=$events and critical/high CVEs=$criticalCves."
|
||||
}
|
||||
}
|
||||
|
||||
Publish-NinjaCustomFields -Report $report -Mode $Mode -Triggered $monitorTriggered -Reason $monitorReason
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "OfficeCom Sentinel monitor mode: $Mode"
|
||||
Write-Host "Triggered: $monitorTriggered"
|
||||
Write-Host "Reason: $monitorReason"
|
||||
Write-Host "Status: $status"
|
||||
Write-Host "Base status: $baseStatus"
|
||||
Write-Host "Events: $events"
|
||||
Write-Host "Unique IPs: $uniqueIps"
|
||||
Write-Host "Critical/High CVEs: $criticalCves"
|
||||
Write-Host "Total CVEs: $totalCves"
|
||||
Write-Host "Report: $outputFullPath"
|
||||
Write-Host "Runner exit code: $runnerExitCode"
|
||||
|
||||
if ($monitorTriggered) {
|
||||
exit 1
|
||||
}
|
||||
|
||||
exit 0
|
||||
144
scripts/run-ocsentinel.ps1
Normal file
144
scripts/run-ocsentinel.ps1
Normal file
@@ -0,0 +1,144 @@
|
||||
param(
|
||||
[int]$LookbackDays = 7,
|
||||
[int]$TopCount = 10,
|
||||
[string]$OutputPath = ".\reports\ocsentinel-summary.json",
|
||||
[string]$ConfigPath = ".\config\ocsentinel-settings.example.json",
|
||||
[string]$ClientConfigPath = ".\config\ocsentinel-client.example.json",
|
||||
[string]$SecretPath = "",
|
||||
[string]$VulnerabilityCsvPath = "",
|
||||
[string]$MirrorRoot = "",
|
||||
[ValidateSet("disabled", "auto", "required")]
|
||||
[string]$UploadMode = "auto",
|
||||
[switch]$FailOnAttacks,
|
||||
[switch]$FailOnThreshold
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$repoRoot = Split-Path -Parent $PSScriptRoot
|
||||
$projectPath = Join-Path $repoRoot "src\AttackTracerNinjaCli\AttackTracerNinjaCli.csproj"
|
||||
$outputFullPath = [System.IO.Path]::GetFullPath((Join-Path $repoRoot $OutputPath))
|
||||
$buildOutputDir = Join-Path $repoRoot "src\AttackTracerNinjaCli\bin\Debug\net10.0"
|
||||
$dllPath = Join-Path $buildOutputDir "OCSentinelCli.dll"
|
||||
|
||||
function Resolve-PathLike {
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[string]$PathValue,
|
||||
[Parameter(Mandatory)]
|
||||
[string]$BasePath
|
||||
)
|
||||
|
||||
if ([string]::IsNullOrWhiteSpace($PathValue)) {
|
||||
return $PathValue
|
||||
}
|
||||
|
||||
if ([System.IO.Path]::IsPathRooted($PathValue) -or $PathValue.StartsWith("\\")) {
|
||||
return [System.IO.Path]::GetFullPath($PathValue)
|
||||
}
|
||||
|
||||
return [System.IO.Path]::GetFullPath((Join-Path $BasePath $PathValue))
|
||||
}
|
||||
|
||||
$arguments = @(
|
||||
$dllPath
|
||||
)
|
||||
|
||||
$configFullPath = [System.IO.Path]::GetFullPath((Join-Path $repoRoot $ConfigPath))
|
||||
if ($UploadMode -eq "disabled") {
|
||||
$arguments += "scan"
|
||||
}
|
||||
else {
|
||||
$clientConfigFullPath = Resolve-PathLike -PathValue $ClientConfigPath -BasePath $repoRoot
|
||||
$secretFullPath = if ([string]::IsNullOrWhiteSpace($SecretPath)) { "" } else { Resolve-PathLike -PathValue $SecretPath -BasePath $repoRoot }
|
||||
$canUpload = (Test-Path $clientConfigFullPath) -and (-not [string]::IsNullOrWhiteSpace($secretFullPath)) -and (Test-Path $secretFullPath)
|
||||
|
||||
if ($UploadMode -eq "required" -and -not $canUpload) {
|
||||
throw "UploadMode 'required' was set, but client config or protected secret is missing."
|
||||
}
|
||||
|
||||
if ($canUpload) {
|
||||
$arguments += "scan-and-upload"
|
||||
$arguments += @("--client-config", $clientConfigFullPath, "--secret-path", $secretFullPath)
|
||||
}
|
||||
else {
|
||||
$arguments += "scan"
|
||||
}
|
||||
}
|
||||
|
||||
$arguments += @(
|
||||
"--lookback-days", $LookbackDays,
|
||||
"--top", $TopCount,
|
||||
"--output", $outputFullPath,
|
||||
"--ninja-output"
|
||||
)
|
||||
|
||||
if (Test-Path $configFullPath) {
|
||||
$arguments += @("--config", $configFullPath)
|
||||
}
|
||||
|
||||
if (-not [string]::IsNullOrWhiteSpace($VulnerabilityCsvPath)) {
|
||||
$vulnerabilityCsvFullPath = [System.IO.Path]::GetFullPath((Join-Path $repoRoot $VulnerabilityCsvPath))
|
||||
if (Test-Path $vulnerabilityCsvFullPath) {
|
||||
$arguments += @("--vulnerability-csv", $vulnerabilityCsvFullPath)
|
||||
}
|
||||
}
|
||||
|
||||
if ($FailOnAttacks) {
|
||||
$arguments += "--fail-on-attacks"
|
||||
}
|
||||
|
||||
if ($FailOnThreshold) {
|
||||
$arguments += "--fail-on-threshold"
|
||||
}
|
||||
|
||||
$null = & dotnet build $projectPath
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
exit $LASTEXITCODE
|
||||
}
|
||||
|
||||
if (-not (Test-Path $dllPath)) {
|
||||
throw "Expected compiled DLL was not created: $dllPath"
|
||||
}
|
||||
|
||||
& dotnet @arguments
|
||||
$exitCode = $LASTEXITCODE
|
||||
|
||||
if (-not (Test-Path $outputFullPath)) {
|
||||
throw "Expected report file was not created: $outputFullPath"
|
||||
}
|
||||
|
||||
$report = Get-Content $outputFullPath -Raw | ConvertFrom-Json
|
||||
|
||||
if (-not [string]::IsNullOrWhiteSpace($MirrorRoot)) {
|
||||
Write-Host "Legacy mirror mode enabled."
|
||||
$mirrorRootPath = Resolve-PathLike -PathValue $MirrorRoot -BasePath $repoRoot
|
||||
if (-not (Test-Path $mirrorRootPath)) {
|
||||
New-Item -ItemType Directory -Force -Path $mirrorRootPath | Out-Null
|
||||
}
|
||||
$mirrorPath = Join-Path $mirrorRootPath "$($report.MachineName).json"
|
||||
Copy-Item -Path $outputFullPath -Destination $mirrorPath -Force
|
||||
Write-Host "Mirrored report: $mirrorPath"
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "OfficeCom Sentinel wrapper summary"
|
||||
Write-Host "Machine: $($report.MachineName)"
|
||||
Write-Host "Events: $($report.TotalEvents)"
|
||||
Write-Host "Unique IPs: $($report.UniqueIpCount)"
|
||||
Write-Host "Status: $($report.AlertState)"
|
||||
Write-Host "Reason: $($report.AlertReason)"
|
||||
Write-Host "Base status: $($report.BaseAlertState)"
|
||||
Write-Host "CVE findings: $($report.VulnerabilityCorrelation.TotalCount)"
|
||||
Write-Host "Critical/High CVEs: $($report.VulnerabilityCorrelation.CriticalCount)"
|
||||
Write-Host "Upload mode: $UploadMode"
|
||||
Write-Host "Report: $outputFullPath"
|
||||
|
||||
if ($report.Errors.Count -gt 0) {
|
||||
Write-Host "Warnings:"
|
||||
foreach ($warningEntry in $report.Errors) {
|
||||
Write-Host "- $warningEntry"
|
||||
}
|
||||
}
|
||||
|
||||
exit $exitCode
|
||||
Reference in New Issue
Block a user