Remove legacy AttackTracer repo content
Some checks failed
OfficeCom Sentinel Client / build-client (push) Has been cancelled
Some checks failed
OfficeCom Sentinel Client / build-client (push) Has been cancelled
This commit is contained in:
OfficeCom Codex
@@ -1,16 +0,0 @@
|
||||
<Project Sdk="Microsoft.NET.Sdk">
|
||||
|
||||
<PropertyGroup>
|
||||
<OutputType>Exe</OutputType>
|
||||
<TargetFramework>net10.0-windows</TargetFramework>
|
||||
<ImplicitUsings>enable</ImplicitUsings>
|
||||
<Nullable>enable</Nullable>
|
||||
<UseWindowsForms>false</UseWindowsForms>
|
||||
<Version>1.2.2</Version>
|
||||
</PropertyGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<EmbeddedResource Include="payload.zip" />
|
||||
</ItemGroup>
|
||||
|
||||
</Project>
|
||||
@@ -1,71 +0,0 @@
|
||||
using System.Diagnostics;
|
||||
using System.IO.Compression;
|
||||
using System.Reflection;
|
||||
|
||||
namespace AttackTracerNinjaBootstrapper;
|
||||
|
||||
internal static class Program
|
||||
{
|
||||
private static int Main()
|
||||
{
|
||||
string tempRoot = Path.Combine(Path.GetTempPath(), "AttackTracerNinjaSetup", Guid.NewGuid().ToString("N"));
|
||||
Directory.CreateDirectory(tempRoot);
|
||||
|
||||
try
|
||||
{
|
||||
Assembly assembly = Assembly.GetExecutingAssembly();
|
||||
string resourceName = assembly.GetManifestResourceNames()
|
||||
.First(name => name.EndsWith("payload.zip", StringComparison.OrdinalIgnoreCase));
|
||||
|
||||
string zipPath = Path.Combine(tempRoot, "payload.zip");
|
||||
using (Stream resourceStream = assembly.GetManifestResourceStream(resourceName)
|
||||
?? throw new InvalidOperationException("Embedded payload.zip was not found."))
|
||||
using (FileStream output = File.Create(zipPath))
|
||||
{
|
||||
resourceStream.CopyTo(output);
|
||||
}
|
||||
|
||||
string extractRoot = Path.Combine(tempRoot, "payload");
|
||||
ZipFile.ExtractToDirectory(zipPath, extractRoot);
|
||||
|
||||
string installScript = Path.Combine(extractRoot, "install-attacktracer-ninja.ps1");
|
||||
if (!File.Exists(installScript))
|
||||
{
|
||||
throw new FileNotFoundException("Installer script missing from payload.", installScript);
|
||||
}
|
||||
|
||||
var startInfo = new ProcessStartInfo
|
||||
{
|
||||
FileName = "powershell.exe",
|
||||
Arguments = $"-ExecutionPolicy Bypass -File \"{installScript}\"",
|
||||
WorkingDirectory = extractRoot,
|
||||
UseShellExecute = true
|
||||
};
|
||||
|
||||
using Process process = Process.Start(startInfo)
|
||||
?? throw new InvalidOperationException("Failed to launch installer process.");
|
||||
|
||||
process.WaitForExit();
|
||||
return process.ExitCode;
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
Console.Error.WriteLine($"AttackTracerNinja installer failed: {ex}");
|
||||
return 1;
|
||||
}
|
||||
finally
|
||||
{
|
||||
try
|
||||
{
|
||||
if (Directory.Exists(tempRoot))
|
||||
{
|
||||
Directory.Delete(tempRoot, recursive: true);
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
// Best-effort cleanup; a locked temp folder should not hide the installer result.
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
<Project Sdk="Microsoft.NET.Sdk">
|
||||
|
||||
<PropertyGroup>
|
||||
<OutputType>Exe</OutputType>
|
||||
<TargetFramework>net10.0-windows</TargetFramework>
|
||||
<ImplicitUsings>enable</ImplicitUsings>
|
||||
<Nullable>enable</Nullable>
|
||||
<UseWindowsForms>false</UseWindowsForms>
|
||||
<AssemblyName>AttackTracerNinjaServerBootstrapper</AssemblyName>
|
||||
<RootNamespace>AttackTracerNinjaServerBootstrapper</RootNamespace>
|
||||
<Version>1.0.9</Version>
|
||||
</PropertyGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<EmbeddedResource Include="payload.zip" />
|
||||
</ItemGroup>
|
||||
|
||||
</Project>
|
||||
@@ -1,70 +0,0 @@
|
||||
using System.Diagnostics;
|
||||
using System.IO.Compression;
|
||||
using System.Reflection;
|
||||
|
||||
namespace AttackTracerNinjaServerBootstrapper;
|
||||
|
||||
internal static class Program
|
||||
{
|
||||
private static int Main()
|
||||
{
|
||||
string tempRoot = Path.Combine(Path.GetTempPath(), "AttackTracerNinjaServerSetup", Guid.NewGuid().ToString("N"));
|
||||
Directory.CreateDirectory(tempRoot);
|
||||
|
||||
try
|
||||
{
|
||||
Assembly assembly = Assembly.GetExecutingAssembly();
|
||||
string resourceName = assembly.GetManifestResourceNames()
|
||||
.First(name => name.EndsWith("payload.zip", StringComparison.OrdinalIgnoreCase));
|
||||
|
||||
string zipPath = Path.Combine(tempRoot, "payload.zip");
|
||||
using (Stream resourceStream = assembly.GetManifestResourceStream(resourceName)
|
||||
?? throw new InvalidOperationException("Embedded payload.zip was not found."))
|
||||
using (FileStream output = File.Create(zipPath))
|
||||
{
|
||||
resourceStream.CopyTo(output);
|
||||
}
|
||||
|
||||
string extractRoot = Path.Combine(tempRoot, "payload");
|
||||
ZipFile.ExtractToDirectory(zipPath, extractRoot);
|
||||
|
||||
string installScript = Path.Combine(extractRoot, "install-attacktracer-ninja-server.ps1");
|
||||
if (!File.Exists(installScript))
|
||||
{
|
||||
throw new FileNotFoundException("Installer script missing from payload.", installScript);
|
||||
}
|
||||
|
||||
var startInfo = new ProcessStartInfo
|
||||
{
|
||||
FileName = "powershell.exe",
|
||||
Arguments = $"-ExecutionPolicy Bypass -File \"{installScript}\"",
|
||||
WorkingDirectory = extractRoot,
|
||||
UseShellExecute = true
|
||||
};
|
||||
|
||||
using Process process = Process.Start(startInfo)
|
||||
?? throw new InvalidOperationException("Failed to launch installer process.");
|
||||
|
||||
process.WaitForExit();
|
||||
return process.ExitCode;
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
Console.Error.WriteLine($"AttackTracerNinjaServer installer failed: {ex}");
|
||||
return 1;
|
||||
}
|
||||
finally
|
||||
{
|
||||
try
|
||||
{
|
||||
if (Directory.Exists(tempRoot))
|
||||
{
|
||||
Directory.Delete(tempRoot, recursive: true);
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
param(
|
||||
[Parameter(ValueFromRemainingArguments = $true)]
|
||||
[string[]]$RemainingArgs
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$newScript = Join-Path $PSScriptRoot "install-ocsentinel.ps1"
|
||||
if (-not (Test-Path $newScript)) {
|
||||
throw "Replacement script not found: $newScript"
|
||||
}
|
||||
|
||||
Write-Host "Compatibility wrapper: install-attacktracer-ninja.ps1 -> install-ocsentinel.ps1"
|
||||
& powershell.exe -ExecutionPolicy Bypass -File $newScript @RemainingArgs
|
||||
exit $LASTEXITCODE
|
||||
@@ -35,9 +35,6 @@ if (Test-Path (Join-Path $packageRoot "scripts\protect-ocsentinel-secret.ps1"))
|
||||
if (Test-Path (Join-Path $packageRoot "scripts\update-ocsentinel.ps1")) {
|
||||
Copy-Item -Path (Join-Path $packageRoot "scripts\update-ocsentinel.ps1") -Destination $scriptRoot -Force
|
||||
}
|
||||
if (Test-Path (Join-Path $packageRoot "scripts\build-attacktracer-org-report.ps1")) {
|
||||
Copy-Item -Path (Join-Path $packageRoot "scripts\build-attacktracer-org-report.ps1") -Destination $scriptRoot -Force
|
||||
}
|
||||
Copy-Item -Path (Join-Path $packageRoot "scripts\uninstall-ocsentinel.ps1") -Destination $scriptRoot -Force
|
||||
|
||||
$mainConfig = Join-Path $configRoot "ocsentinel-settings.json"
|
||||
@@ -74,4 +71,3 @@ Write-Host "Main path: $installRoot"
|
||||
Write-Host "Runner: $(Join-Path $scriptRoot 'run-ocsentinel.ps1')"
|
||||
Write-Host "Monitor: $(Join-Path $scriptRoot 'run-ocsentinel-monitor.ps1')"
|
||||
Write-Host "Updater: $(Join-Path $scriptRoot 'update-ocsentinel.ps1')"
|
||||
Write-Host "Org report:$(Join-Path $scriptRoot 'build-attacktracer-org-report.ps1')"
|
||||
|
||||
@@ -1,307 +0,0 @@
|
||||
param(
|
||||
[string]$ReportsRoot = "..\reports",
|
||||
[string]$OutputPath = "..\reports\attacktracer-org-report.html",
|
||||
[int]$MaxAlertRows = 25,
|
||||
[switch]$WriteNinjaOrgSummary,
|
||||
[switch]$EmitHtml
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
function Escape-Html {
|
||||
param([AllowNull()][string]$Value)
|
||||
|
||||
if ($null -eq $Value) {
|
||||
return ""
|
||||
}
|
||||
|
||||
return [System.Net.WebUtility]::HtmlEncode($Value)
|
||||
}
|
||||
|
||||
function Resolve-PathLike {
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[string]$PathValue,
|
||||
[Parameter(Mandatory)]
|
||||
[string]$BasePath
|
||||
)
|
||||
|
||||
if ([string]::IsNullOrWhiteSpace($PathValue)) {
|
||||
return $PathValue
|
||||
}
|
||||
|
||||
if ([System.IO.Path]::IsPathRooted($PathValue) -or $PathValue.StartsWith("\\")) {
|
||||
return [System.IO.Path]::GetFullPath($PathValue)
|
||||
}
|
||||
|
||||
return [System.IO.Path]::GetFullPath((Join-Path $BasePath $PathValue))
|
||||
}
|
||||
|
||||
function Get-IncidentLabel {
|
||||
param([pscustomobject]$Source)
|
||||
|
||||
$target = @($Source.Targets)[0]
|
||||
$origin = @($Source.Sources)[0]
|
||||
|
||||
if ($target -match "Windows login") { return "Win Login-Fail" }
|
||||
if ($target -match "SQL Server") { return "SQL Login-Fail" }
|
||||
if ($target -match "Exchange") { return "Exchange Login-Fail" }
|
||||
if ($target -match "FTP") { return "FTP Login-Fail" }
|
||||
if ($origin) { return [string]$origin }
|
||||
if ($target) { return [string]$target }
|
||||
return "Auffaelligkeit"
|
||||
}
|
||||
|
||||
function Get-AlertRows {
|
||||
param([pscustomobject]$Report)
|
||||
|
||||
$rows = @()
|
||||
|
||||
foreach ($source in @($Report.TopSources)) {
|
||||
$rows += [pscustomobject]@{
|
||||
MachineName = [string]$Report.MachineName
|
||||
Incident = Get-IncidentLabel -Source $source
|
||||
Account = if (@($source.Usernames).Count -gt 0) { [string](@($source.Usernames)[0]) } else { "-" }
|
||||
Timestamp = [string]$source.LastSeenLocal
|
||||
Count = [int]$source.Count
|
||||
Ip = [string]$source.SourceIp
|
||||
Status = [string]$Report.AlertState
|
||||
}
|
||||
}
|
||||
|
||||
if ($rows.Count -eq 0 -and ([string]$Report.AlertState -ne "ok" -or [int]$Report.TotalEvents -gt 0 -or [int]$Report.VulnerabilityCorrelation.CriticalCount -gt 0)) {
|
||||
$rows += [pscustomobject]@{
|
||||
MachineName = [string]$Report.MachineName
|
||||
Incident = if ([int]$Report.VulnerabilityCorrelation.CriticalCount -gt 0) { "CVE Korrelation" } else { "Auffaelligkeit" }
|
||||
Account = "-"
|
||||
Timestamp = [string]$Report.GeneratedAtLocal
|
||||
Count = [Math]::Max([int]$Report.TotalEvents, [int]$Report.VulnerabilityCorrelation.CriticalCount)
|
||||
Ip = "-"
|
||||
Status = [string]$Report.AlertState
|
||||
}
|
||||
}
|
||||
|
||||
return $rows
|
||||
}
|
||||
|
||||
function Build-OrgReportHtml {
|
||||
param(
|
||||
[pscustomobject[]]$Reports,
|
||||
[int]$MaxRows
|
||||
)
|
||||
|
||||
$sortedReports = @($Reports | Sort-Object MachineName)
|
||||
$alertingReports = @($sortedReports | Where-Object { $_.AlertState -ne "ok" -or $_.TotalEvents -gt 0 -or $_.VulnerabilityCorrelation.CriticalCount -gt 0 })
|
||||
$criticalReports = @($sortedReports | Where-Object { $_.AlertState -eq "critical" })
|
||||
$totalEvents = (@($sortedReports | Measure-Object -Property TotalEvents -Sum).Sum)
|
||||
$totalEvents = if ($null -eq $totalEvents) { 0 } else { [int]$totalEvents }
|
||||
|
||||
$allIps = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
|
||||
foreach ($report in $sortedReports) {
|
||||
foreach ($source in @($report.TopSources)) {
|
||||
if (-not [string]::IsNullOrWhiteSpace([string]$source.SourceIp)) {
|
||||
$null = $allIps.Add([string]$source.SourceIp)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$alertRows = foreach ($report in $alertingReports) {
|
||||
Get-AlertRows -Report $report
|
||||
}
|
||||
|
||||
$alertRows = @($alertRows | Sort-Object @{ Expression = { $_.Status -eq "critical" }; Descending = $true }, @{ Expression = { [DateTimeOffset]::Parse($_.Timestamp) }; Descending = $true })
|
||||
if ($alertRows.Count -gt $MaxRows) {
|
||||
$alertRows = @($alertRows | Select-Object -First $MaxRows)
|
||||
}
|
||||
|
||||
$cleanDevices = @($sortedReports | Where-Object { $_.AlertState -eq "ok" -and $_.TotalEvents -eq 0 -and $_.VulnerabilityCorrelation.CriticalCount -eq 0 } | Select-Object -ExpandProperty MachineName -Unique)
|
||||
$generatedAt = (Get-Date).ToString("dd.MM.yyyy HH:mm:ss")
|
||||
|
||||
$sb = [System.Text.StringBuilder]::new()
|
||||
[void]$sb.AppendLine('<div style="font-family: Segoe UI, Tahoma, sans-serif; font-size: 12px; color: #333;">')
|
||||
[void]$sb.AppendLine(" <h3 style=""color: #1e3a8a; margin-bottom: 8px; font-size: 14px;"">AttackTracer Report - $(Escape-Html ((Get-Date).ToString("dd.MM.yyyy")))</h3>")
|
||||
[void]$sb.AppendLine(" <div style=""margin-bottom: 10px; padding: 8px; background-color: #eff6ff; border: 1px solid #bfdbfe; color: #1e3a8a;""><strong>$(Escape-Html ([string]$sortedReports.Count)) Geraete</strong> gescannt | <strong>$(Escape-Html ([string]$alertingReports.Count)) auffaellig</strong> | <strong>$(Escape-Html ([string]$criticalReports.Count)) kritisch</strong> | <strong>$(Escape-Html ([string]$totalEvents)) Events</strong> | <strong>$(Escape-Html ([string]$allIps.Count)) eindeutige IPs</strong></div>")
|
||||
[void]$sb.AppendLine(' <table style="width: 100%; border-collapse: collapse; text-align: left;" border="1" cellpadding="4">')
|
||||
[void]$sb.AppendLine(' <tr style="background-color: #1e3a8a; color: white;">')
|
||||
[void]$sb.AppendLine(' <th>Server</th>')
|
||||
[void]$sb.AppendLine(' <th>Vorfall</th>')
|
||||
[void]$sb.AppendLine(' <th>Konto</th>')
|
||||
[void]$sb.AppendLine(' <th>Zeitpunkt</th>')
|
||||
[void]$sb.AppendLine(' <th>Anzahl</th>')
|
||||
[void]$sb.AppendLine(' <th>IP</th>')
|
||||
[void]$sb.AppendLine(' </tr>')
|
||||
|
||||
if ($alertRows.Count -eq 0) {
|
||||
[void]$sb.AppendLine(' <tr style="background-color: #f0fdf4; color: #166534;">')
|
||||
[void]$sb.AppendLine(' <td colspan="6">Keine Angriffe oder Korrelationen im ausgewerteten Bestand gefunden.</td>')
|
||||
[void]$sb.AppendLine(' </tr>')
|
||||
}
|
||||
else {
|
||||
foreach ($row in $alertRows) {
|
||||
$rowStyle = if ($row.Status -eq "critical") { "background-color: #fee2e2; color: #991b1b;" } else { "background-color: #fff7ed; color: #c2410c;" }
|
||||
$timestampText = $row.Timestamp
|
||||
try {
|
||||
$timestampText = ([DateTimeOffset]::Parse($row.Timestamp)).ToString("dd.MM.yy HH:mm")
|
||||
}
|
||||
catch {
|
||||
}
|
||||
|
||||
[void]$sb.AppendLine(" <tr style=""$rowStyle"">")
|
||||
[void]$sb.AppendLine(" <td>$(Escape-Html $row.MachineName)</td>")
|
||||
[void]$sb.AppendLine(" <td>$(Escape-Html $row.Incident)</td>")
|
||||
[void]$sb.AppendLine(" <td>$(Escape-Html $row.Account)</td>")
|
||||
[void]$sb.AppendLine(" <td>$(Escape-Html $timestampText)</td>")
|
||||
[void]$sb.AppendLine(" <td>$(Escape-Html ([string]$row.Count))</td>")
|
||||
[void]$sb.AppendLine(" <td>$(Escape-Html $row.Ip)</td>")
|
||||
[void]$sb.AppendLine(' </tr>')
|
||||
}
|
||||
}
|
||||
|
||||
[void]$sb.AppendLine(' </table>')
|
||||
|
||||
if ($cleanDevices.Count -gt 0) {
|
||||
[void]$sb.AppendLine(' <div style="margin-top: 10px; font-size: 11px; color: #166534; background-color: #f0fdf4; padding: 6px; border: 1px solid #bbf7d0;">')
|
||||
[void]$sb.AppendLine(" <strong>Log sauber / Keine Angriffe:</strong> $(Escape-Html ($cleanDevices -join ', '))")
|
||||
[void]$sb.AppendLine(' </div>')
|
||||
}
|
||||
|
||||
[void]$sb.AppendLine(" <div style=""margin-top: 5px; font-size: 10px; color: #6b7280; text-align: right;"">Automatisch generiert am $(Escape-Html $generatedAt)</div>")
|
||||
[void]$sb.AppendLine('</div>')
|
||||
|
||||
return $sb.ToString()
|
||||
}
|
||||
|
||||
function Get-OrganizationStatus {
|
||||
param([pscustomobject[]]$Reports)
|
||||
|
||||
if (@($Reports | Where-Object { $_.AlertState -eq "critical" }).Count -gt 0) {
|
||||
return "critical"
|
||||
}
|
||||
|
||||
if (@($Reports | Where-Object { $_.AlertState -eq "warning" -or $_.TotalEvents -gt 0 -or $_.VulnerabilityCorrelation.CriticalCount -gt 0 }).Count -gt 0) {
|
||||
return "warning"
|
||||
}
|
||||
|
||||
return "ok"
|
||||
}
|
||||
|
||||
function Build-OrganizationSummaryText {
|
||||
param([pscustomobject[]]$Reports)
|
||||
|
||||
$deviceCount = @($Reports).Count
|
||||
$alertingCount = @($Reports | Where-Object { $_.AlertState -ne "ok" -or $_.TotalEvents -gt 0 -or $_.VulnerabilityCorrelation.CriticalCount -gt 0 }).Count
|
||||
$criticalCount = @($Reports | Where-Object { $_.AlertState -eq "critical" }).Count
|
||||
$totalEvents = (@($Reports | Measure-Object -Property TotalEvents -Sum).Sum)
|
||||
$totalEvents = if ($null -eq $totalEvents) { 0 } else { [int]$totalEvents }
|
||||
|
||||
$topSystems = @(
|
||||
$Reports |
|
||||
Where-Object { $_.AlertState -ne "ok" -or $_.TotalEvents -gt 0 -or $_.VulnerabilityCorrelation.CriticalCount -gt 0 } |
|
||||
Sort-Object @{ Expression = { $_.AlertState -eq "critical" }; Descending = $true }, @{ Expression = { [int]$_.TotalEvents }; Descending = $true } |
|
||||
Select-Object -ExpandProperty MachineName -First 5
|
||||
)
|
||||
|
||||
$summary = "$deviceCount Geraete gescannt, $alertingCount auffaellig, $criticalCount kritisch, $totalEvents Events."
|
||||
if ($topSystems.Count -gt 0) {
|
||||
$summary += " Top-Systeme: $($topSystems -join ', ')."
|
||||
}
|
||||
|
||||
return $summary
|
||||
}
|
||||
|
||||
function Set-NinjaOrganizationFieldValue {
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[string]$Name,
|
||||
[AllowEmptyString()]
|
||||
[string]$Value
|
||||
)
|
||||
|
||||
if (Get-Command -Name "Set-NinjaOrganizationProperty" -ErrorAction SilentlyContinue) {
|
||||
Set-NinjaOrganizationProperty -Name $Name -Value $Value | Out-Null
|
||||
return "Set-NinjaOrganizationProperty"
|
||||
}
|
||||
|
||||
if (Get-Command -Name "Ninja-Organization-Property-Set" -ErrorAction SilentlyContinue) {
|
||||
Ninja-Organization-Property-Set $Name $Value | Out-Null
|
||||
return "Ninja-Organization-Property-Set"
|
||||
}
|
||||
|
||||
throw "No supported NinjaOne organization custom field writer was available."
|
||||
}
|
||||
|
||||
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
|
||||
$installRoot = Split-Path -Parent $scriptDir
|
||||
$reportsRootPath = Resolve-PathLike -PathValue $ReportsRoot -BasePath $installRoot
|
||||
$outputPathFull = Resolve-PathLike -PathValue $OutputPath -BasePath $installRoot
|
||||
|
||||
$reportFiles = @()
|
||||
if (Test-Path $reportsRootPath -PathType Leaf) {
|
||||
$reportFiles = @($reportsRootPath)
|
||||
}
|
||||
elseif (Test-Path $reportsRootPath -PathType Container) {
|
||||
$reportFiles = @(Get-ChildItem -Path $reportsRootPath -Recurse -Filter *.json | Select-Object -ExpandProperty FullName)
|
||||
}
|
||||
|
||||
if ($reportFiles.Count -eq 0) {
|
||||
throw "No report JSON files found under $reportsRootPath"
|
||||
}
|
||||
|
||||
$reports = foreach ($file in $reportFiles) {
|
||||
try {
|
||||
$report = Get-Content $file -Raw | ConvertFrom-Json
|
||||
if ($report.MachineName) {
|
||||
$report
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-Warning "Skipping invalid report file ${file}: $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
|
||||
if (@($reports).Count -eq 0) {
|
||||
throw "No valid AttackTracer report files were parsed."
|
||||
}
|
||||
|
||||
$latestReports = @(
|
||||
$reports |
|
||||
Group-Object MachineName |
|
||||
ForEach-Object {
|
||||
$_.Group |
|
||||
Sort-Object {
|
||||
try {
|
||||
[DateTimeOffset]::Parse([string]$_.GeneratedAtLocal)
|
||||
}
|
||||
catch {
|
||||
[DateTimeOffset]::MinValue
|
||||
}
|
||||
} -Descending |
|
||||
Select-Object -First 1
|
||||
}
|
||||
)
|
||||
|
||||
$html = Build-OrgReportHtml -Reports $latestReports -MaxRows $MaxAlertRows
|
||||
$orgStatus = Get-OrganizationStatus -Reports $latestReports
|
||||
$orgSummary = Build-OrganizationSummaryText -Reports $latestReports
|
||||
$orgLastUpdate = (Get-Date).ToString("o")
|
||||
|
||||
$outputDirectory = Split-Path -Parent $outputPathFull
|
||||
if (-not [string]::IsNullOrWhiteSpace($outputDirectory)) {
|
||||
if (-not (Test-Path $outputDirectory)) {
|
||||
New-Item -ItemType Directory -Force -Path $outputDirectory | Out-Null
|
||||
}
|
||||
}
|
||||
|
||||
Set-Content -Path $outputPathFull -Value $html -Encoding UTF8
|
||||
Write-Host "Organization HTML report written to $outputPathFull"
|
||||
|
||||
if ($WriteNinjaOrgSummary) {
|
||||
$writer = Set-NinjaOrganizationFieldValue -Name "attacktracerorgstatus" -Value $orgStatus
|
||||
Set-NinjaOrganizationFieldValue -Name "attacktracerorgsummary" -Value $orgSummary | Out-Null
|
||||
Set-NinjaOrganizationFieldValue -Name "attacktracerorglastupdate" -Value $orgLastUpdate | Out-Null
|
||||
Write-Host "Organization summary fields updated via $writer"
|
||||
}
|
||||
|
||||
if ($EmitHtml) {
|
||||
Write-Output $html
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
param(
|
||||
[Parameter(ValueFromRemainingArguments = $true)]
|
||||
[string[]]$RemainingArgs
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$newScript = Join-Path $PSScriptRoot "runtime-run-ocsentinel-monitor.ps1"
|
||||
if (-not (Test-Path $newScript)) {
|
||||
throw "Replacement script not found: $newScript"
|
||||
}
|
||||
|
||||
Write-Host "Compatibility wrapper: runtime-run-attacktracer-ninja-monitor.ps1 -> runtime-run-ocsentinel-monitor.ps1"
|
||||
& powershell.exe -ExecutionPolicy Bypass -File $newScript @RemainingArgs
|
||||
exit $LASTEXITCODE
|
||||
@@ -1,308 +0,0 @@
|
||||
param(
|
||||
[string]$ConfigPath = "..\config\attacktracer-server-settings.json"
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
function Resolve-PathLike {
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[string]$PathValue,
|
||||
[Parameter(Mandatory)]
|
||||
[string]$BasePath
|
||||
)
|
||||
|
||||
if ([string]::IsNullOrWhiteSpace($PathValue)) {
|
||||
return $PathValue
|
||||
}
|
||||
|
||||
if ([System.IO.Path]::IsPathRooted($PathValue) -or $PathValue.StartsWith("\\")) {
|
||||
return [System.IO.Path]::GetFullPath($PathValue)
|
||||
}
|
||||
|
||||
return [System.IO.Path]::GetFullPath((Join-Path $BasePath $PathValue))
|
||||
}
|
||||
|
||||
function Join-Url {
|
||||
param(
|
||||
[Parameter(Mandatory)][string]$BaseUrl,
|
||||
[Parameter(Mandatory)][string]$RelativePath
|
||||
)
|
||||
|
||||
$base = $BaseUrl.TrimEnd('/')
|
||||
$relative = $RelativePath.TrimStart('/')
|
||||
return "$base/$relative"
|
||||
}
|
||||
|
||||
function ConvertTo-PlainText {
|
||||
param([Parameter(Mandatory)][string]$EncryptedValue)
|
||||
|
||||
$secure = ConvertTo-SecureString $EncryptedValue
|
||||
$credential = New-Object System.Management.Automation.PSCredential("ignored", $secure)
|
||||
return $credential.GetNetworkCredential().Password
|
||||
}
|
||||
|
||||
function Normalize-NinjaScope {
|
||||
param([AllowEmptyString()][string]$Scope)
|
||||
|
||||
if ([string]::IsNullOrWhiteSpace($Scope)) {
|
||||
return ""
|
||||
}
|
||||
|
||||
$tokens = @(
|
||||
$Scope -split '[,\s;]+' |
|
||||
Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
|
||||
ForEach-Object {
|
||||
switch ($_.Trim().ToLowerInvariant()) {
|
||||
"monitoring" { "monitoring"; break }
|
||||
"uberwachen" { "monitoring"; break }
|
||||
"ueberwachen" { "monitoring"; break }
|
||||
"management" { "management"; break }
|
||||
"verwalten" { "management"; break }
|
||||
"control" { "control"; break }
|
||||
"steuerung" { "control"; break }
|
||||
"offline_access" { "offline_access"; break }
|
||||
default { $_.Trim().ToLowerInvariant() }
|
||||
}
|
||||
}
|
||||
)
|
||||
|
||||
return ($tokens | Select-Object -Unique) -join " "
|
||||
}
|
||||
|
||||
function Get-OrganizationStatus {
|
||||
param([pscustomobject[]]$Reports)
|
||||
|
||||
if (@($Reports | Where-Object { $_.AlertState -eq "critical" }).Count -gt 0) {
|
||||
return "critical"
|
||||
}
|
||||
|
||||
if (@($Reports | Where-Object { $_.AlertState -eq "warning" -or $_.TotalEvents -gt 0 -or $_.VulnerabilityCorrelation.CriticalCount -gt 0 }).Count -gt 0) {
|
||||
return "warning"
|
||||
}
|
||||
|
||||
return "ok"
|
||||
}
|
||||
|
||||
function Build-OrganizationSummaryText {
|
||||
param([pscustomobject[]]$Reports)
|
||||
|
||||
$deviceCount = @($Reports).Count
|
||||
$alertingCount = @($Reports | Where-Object { $_.AlertState -ne "ok" -or $_.TotalEvents -gt 0 -or $_.VulnerabilityCorrelation.CriticalCount -gt 0 }).Count
|
||||
$criticalCount = @($Reports | Where-Object { $_.AlertState -eq "critical" }).Count
|
||||
$totalEvents = (@($Reports | Measure-Object -Property TotalEvents -Sum).Sum)
|
||||
$totalEvents = if ($null -eq $totalEvents) { 0 } else { [int]$totalEvents }
|
||||
|
||||
$topSystems = @(
|
||||
$Reports |
|
||||
Where-Object { $_.AlertState -ne "ok" -or $_.TotalEvents -gt 0 -or $_.VulnerabilityCorrelation.CriticalCount -gt 0 } |
|
||||
Sort-Object @{ Expression = { $_.AlertState -eq "critical" }; Descending = $true }, @{ Expression = { [int]$_.TotalEvents }; Descending = $true } |
|
||||
Select-Object -ExpandProperty MachineName -First 5
|
||||
)
|
||||
|
||||
$summary = "$deviceCount Geraete gescannt, $alertingCount auffaellig, $criticalCount kritisch, $totalEvents Events."
|
||||
if ($topSystems.Count -gt 0) {
|
||||
$summary += " Top-Systeme: $($topSystems -join ', ')."
|
||||
}
|
||||
|
||||
return $summary
|
||||
}
|
||||
|
||||
function Get-LatestReports {
|
||||
param([Parameter(Mandatory)][string]$ReportsRootPath)
|
||||
|
||||
$reportFiles = @()
|
||||
if (Test-Path $ReportsRootPath -PathType Leaf) {
|
||||
$reportFiles = @($ReportsRootPath)
|
||||
}
|
||||
elseif (Test-Path $ReportsRootPath -PathType Container) {
|
||||
$reportFiles = @(Get-ChildItem -Path $ReportsRootPath -Recurse -Filter *.json | Select-Object -ExpandProperty FullName)
|
||||
}
|
||||
|
||||
if ($reportFiles.Count -eq 0) {
|
||||
throw "No report JSON files found under $ReportsRootPath"
|
||||
}
|
||||
|
||||
$reports = foreach ($file in $reportFiles) {
|
||||
try {
|
||||
$report = Get-Content $file -Raw | ConvertFrom-Json
|
||||
if ($report.MachineName) {
|
||||
$report
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-Warning "Skipping invalid report file ${file}: $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
|
||||
if (@($reports).Count -eq 0) {
|
||||
throw "No valid AttackTracer report files were parsed."
|
||||
}
|
||||
|
||||
return @(
|
||||
$reports |
|
||||
Group-Object MachineName |
|
||||
ForEach-Object {
|
||||
$_.Group |
|
||||
Sort-Object {
|
||||
try {
|
||||
[DateTimeOffset]::Parse([string]$_.GeneratedAtLocal)
|
||||
}
|
||||
catch {
|
||||
[DateTimeOffset]::MinValue
|
||||
}
|
||||
} -Descending |
|
||||
Select-Object -First 1
|
||||
}
|
||||
)
|
||||
}
|
||||
|
||||
function Get-NinjaAccessToken {
|
||||
param(
|
||||
[Parameter(Mandatory)][string]$BaseUrl,
|
||||
[Parameter(Mandatory)][string]$ClientId,
|
||||
[Parameter(Mandatory)][string]$ClientSecret,
|
||||
[string]$Scope = ""
|
||||
)
|
||||
|
||||
$body = @{
|
||||
grant_type = "client_credentials"
|
||||
client_id = $ClientId
|
||||
client_secret = $ClientSecret
|
||||
}
|
||||
|
||||
$normalizedScope = Normalize-NinjaScope -Scope $Scope
|
||||
if (-not [string]::IsNullOrWhiteSpace($normalizedScope)) {
|
||||
$body.scope = $normalizedScope
|
||||
}
|
||||
|
||||
$tokenEndpoints = @(
|
||||
(Join-Url -BaseUrl $BaseUrl -RelativePath "ws/oauth/token"),
|
||||
(Join-Url -BaseUrl $BaseUrl -RelativePath "oauth/token")
|
||||
)
|
||||
|
||||
$failures = New-Object System.Collections.Generic.List[string]
|
||||
|
||||
foreach ($tokenEndpoint in $tokenEndpoints) {
|
||||
try {
|
||||
Write-Host "Requesting NinjaOne OAuth token from $tokenEndpoint"
|
||||
$response = Invoke-RestMethod -Method Post -Uri $tokenEndpoint -Body $body -ContentType "application/x-www-form-urlencoded" -TimeoutSec 60
|
||||
if (-not $response.access_token) {
|
||||
throw "OAuth token response did not contain an access_token."
|
||||
}
|
||||
|
||||
Write-Host "NinjaOne OAuth token acquired successfully"
|
||||
return [string]$response.access_token
|
||||
}
|
||||
catch {
|
||||
$message = "Token endpoint $tokenEndpoint failed: " + $_.Exception.Message
|
||||
if ($_.ErrorDetails.Message) {
|
||||
$message += " | " + $_.ErrorDetails.Message
|
||||
}
|
||||
|
||||
$failures.Add($message)
|
||||
}
|
||||
}
|
||||
|
||||
throw "Failed to obtain NinjaOne OAuth token. " + ($failures -join " || ")
|
||||
}
|
||||
|
||||
function Invoke-NinjaOrganizationFieldPatch {
|
||||
param(
|
||||
[Parameter(Mandatory)][string]$BaseUrl,
|
||||
[Parameter(Mandatory)][int]$OrganizationId,
|
||||
[Parameter(Mandatory)][string]$AccessToken,
|
||||
[Parameter(Mandatory)][hashtable]$FieldValues
|
||||
)
|
||||
|
||||
$endpoint = (Join-Url -BaseUrl $BaseUrl -RelativePath "v2/organization/$OrganizationId/custom-fields")
|
||||
$headers = @{
|
||||
Authorization = "Bearer $AccessToken"
|
||||
Accept = "application/json"
|
||||
}
|
||||
|
||||
$payloadCandidates = @(
|
||||
$FieldValues,
|
||||
@{ customFields = $FieldValues },
|
||||
@{ fields = @($FieldValues.GetEnumerator() | ForEach-Object { @{ name = $_.Key; value = $_.Value } }) }
|
||||
)
|
||||
|
||||
$failures = New-Object System.Collections.Generic.List[string]
|
||||
|
||||
foreach ($payload in $payloadCandidates) {
|
||||
try {
|
||||
$json = $payload | ConvertTo-Json -Depth 8
|
||||
$fieldNames = @($FieldValues.Keys) -join ", "
|
||||
Write-Host "Organization custom fields endpoint: $endpoint"
|
||||
Write-Host "Updating NinjaOne organization custom fields: $fieldNames"
|
||||
Write-Host "PATCH payload size: $($json.Length) characters"
|
||||
Invoke-RestMethod -Method Patch -Uri $endpoint -Headers $headers -ContentType "application/json" -Body $json -TimeoutSec 60 | Out-Null
|
||||
Write-Host "NinjaOne organization custom fields updated successfully"
|
||||
return
|
||||
}
|
||||
catch {
|
||||
$message = $_.Exception.Message
|
||||
if ($_.ErrorDetails.Message) {
|
||||
$message += " | " + $_.ErrorDetails.Message
|
||||
}
|
||||
|
||||
$failures.Add($message)
|
||||
}
|
||||
}
|
||||
|
||||
throw "Failed to update NinjaOne organization custom fields. " + ($failures -join " || ")
|
||||
}
|
||||
|
||||
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
|
||||
$installRoot = Split-Path -Parent $scriptDir
|
||||
$configBasePath = $scriptDir
|
||||
$configFullPath = Resolve-PathLike -PathValue $ConfigPath -BasePath $configBasePath
|
||||
if (-not (Test-Path $configFullPath)) {
|
||||
throw "Server config file not found: $configFullPath"
|
||||
}
|
||||
|
||||
$config = Get-Content $configFullPath -Raw | ConvertFrom-Json
|
||||
$reportsRootPath = Resolve-PathLike -PathValue $config.reportsRoot -BasePath $installRoot
|
||||
$htmlOutputPath = Resolve-PathLike -PathValue $config.htmlOutputPath -BasePath $installRoot
|
||||
$orgReportsScript = Join-Path $scriptDir "build-attacktracer-org-report.ps1"
|
||||
|
||||
& powershell -ExecutionPolicy Bypass -File $orgReportsScript -ReportsRoot $reportsRootPath -OutputPath $htmlOutputPath -MaxAlertRows $config.maxAlertRows
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
exit $LASTEXITCODE
|
||||
}
|
||||
|
||||
$latestReports = Get-LatestReports -ReportsRootPath $reportsRootPath
|
||||
$orgStatus = Get-OrganizationStatus -Reports $latestReports
|
||||
$orgSummary = Build-OrganizationSummaryText -Reports $latestReports
|
||||
$orgLastUpdate = (Get-Date).ToString("o")
|
||||
$htmlContent = Get-Content $htmlOutputPath -Raw
|
||||
Write-Host "Organization summary prepared"
|
||||
Write-Host "HTML report size: $($htmlContent.Length) characters"
|
||||
$clientSecret = ConvertTo-PlainText -EncryptedValue ([string]$config.clientSecretEncrypted)
|
||||
$accessToken = Get-NinjaAccessToken -BaseUrl ([string]$config.ninjaBaseUrl) -ClientId ([string]$config.clientId) -ClientSecret $clientSecret -Scope ([string]$config.oauthScope)
|
||||
|
||||
$fieldValues = @{
|
||||
([string]$config.statusFieldName) = $orgStatus
|
||||
([string]$config.summaryFieldName) = $orgSummary
|
||||
([string]$config.lastUpdateFieldName) = $orgLastUpdate
|
||||
}
|
||||
|
||||
Invoke-NinjaOrganizationFieldPatch -BaseUrl ([string]$config.ninjaBaseUrl) -OrganizationId ([int]$config.organizationId) -AccessToken $accessToken -FieldValues $fieldValues
|
||||
|
||||
if ($config.updateHtmlField -and -not [string]::IsNullOrWhiteSpace([string]$config.htmlFieldName)) {
|
||||
$htmlFieldName = [string]$config.htmlFieldName
|
||||
Write-Host "Attempting separate HTML organization field update for '$htmlFieldName'"
|
||||
|
||||
try {
|
||||
Invoke-NinjaOrganizationFieldPatch -BaseUrl ([string]$config.ninjaBaseUrl) -OrganizationId ([int]$config.organizationId) -AccessToken $accessToken -FieldValues @{
|
||||
$htmlFieldName = $htmlContent
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-Warning "HTML organization field update failed for '$htmlFieldName'. Keeping local HTML report only. $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host "Organization HTML report written to $htmlOutputPath"
|
||||
Write-Host "Organization custom fields updated via NinjaOne API"
|
||||
Write-Host "Status field: $($config.statusFieldName)=$orgStatus"
|
||||
@@ -1,15 +0,0 @@
|
||||
param(
|
||||
[Parameter(ValueFromRemainingArguments = $true)]
|
||||
[string[]]$RemainingArgs
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$newScript = Join-Path $PSScriptRoot "runtime-run-ocsentinel.ps1"
|
||||
if (-not (Test-Path $newScript)) {
|
||||
throw "Replacement script not found: $newScript"
|
||||
}
|
||||
|
||||
Write-Host "Compatibility wrapper: runtime-run-attacktracer-ninja.ps1 -> runtime-run-ocsentinel.ps1"
|
||||
& powershell.exe -ExecutionPolicy Bypass -File $newScript @RemainingArgs
|
||||
exit $LASTEXITCODE
|
||||
@@ -1,113 +0,0 @@
|
||||
param()
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
function Read-DefaultValue {
|
||||
param(
|
||||
[Parameter(Mandatory)][string]$Prompt,
|
||||
[string]$DefaultValue = ""
|
||||
)
|
||||
|
||||
$suffix = if ([string]::IsNullOrWhiteSpace($DefaultValue)) { "" } else { " [$DefaultValue]" }
|
||||
$value = Read-Host "$Prompt$suffix"
|
||||
if ([string]::IsNullOrWhiteSpace($value)) {
|
||||
return $DefaultValue
|
||||
}
|
||||
|
||||
return $value
|
||||
}
|
||||
|
||||
function Read-YesNo {
|
||||
param(
|
||||
[Parameter(Mandatory)][string]$Prompt,
|
||||
[bool]$DefaultValue = $false
|
||||
)
|
||||
|
||||
$defaultText = if ($DefaultValue) { "Y/n" } else { "y/N" }
|
||||
$value = Read-Host "$Prompt [$defaultText]"
|
||||
if ([string]::IsNullOrWhiteSpace($value)) {
|
||||
return $DefaultValue
|
||||
}
|
||||
|
||||
return $value.Trim().StartsWith("y", [System.StringComparison]::OrdinalIgnoreCase)
|
||||
}
|
||||
|
||||
$packageRoot = Split-Path -Parent $MyInvocation.MyCommand.Path
|
||||
$installRoot = Join-Path ${env:ProgramFiles} "AttackTracerNinjaServer"
|
||||
$configRoot = Join-Path $installRoot "config"
|
||||
$scriptRoot = Join-Path $installRoot "scripts"
|
||||
$versionFile = Join-Path $packageRoot "VERSION.txt"
|
||||
$version = if (Test-Path $versionFile) { (Get-Content $versionFile -Raw).Trim() } else { "1.0.0" }
|
||||
|
||||
Write-Host "Installing AttackTracerNinjaServer $version to $installRoot"
|
||||
|
||||
New-Item -ItemType Directory -Force -Path $configRoot, $scriptRoot | Out-Null
|
||||
|
||||
Copy-Item -Path (Join-Path $packageRoot "build-attacktracer-org-report.ps1") -Destination $scriptRoot -Force
|
||||
Copy-Item -Path (Join-Path $packageRoot "run-attacktracer-ninja-server.ps1") -Destination $scriptRoot -Force
|
||||
Copy-Item -Path (Join-Path $packageRoot "uninstall-attacktracer-ninja-server.ps1") -Destination $scriptRoot -Force
|
||||
Copy-Item -Path (Join-Path $packageRoot "attacktracer-server-settings.example.json") -Destination (Join-Path $configRoot "attacktracer-server-settings.example.json") -Force
|
||||
|
||||
$configPath = Join-Path $configRoot "attacktracer-server-settings.json"
|
||||
$examplePath = Join-Path $configRoot "attacktracer-server-settings.example.json"
|
||||
$existing = if (Test-Path $configPath) { Get-Content $configPath -Raw | ConvertFrom-Json } else { Get-Content $examplePath -Raw | ConvertFrom-Json }
|
||||
|
||||
$reportsRoot = Read-DefaultValue -Prompt "ReportsRoot share path" -DefaultValue ([string]$existing.reportsRoot)
|
||||
$htmlOutputPath = Read-DefaultValue -Prompt "HTML output path" -DefaultValue ([string]$existing.htmlOutputPath)
|
||||
$ninjaBaseUrl = Read-DefaultValue -Prompt "Ninja base URL" -DefaultValue ([string]$existing.ninjaBaseUrl)
|
||||
$organizationId = Read-DefaultValue -Prompt "Ninja organization ID" -DefaultValue ([string]$existing.organizationId)
|
||||
$clientId = Read-DefaultValue -Prompt "Ninja OAuth Client ID" -DefaultValue ([string]$existing.clientId)
|
||||
$oauthScope = Read-DefaultValue -Prompt "Ninja OAuth scope" -DefaultValue ([string]$existing.oauthScope)
|
||||
$secretPrompt = Read-Host "Ninja OAuth Client Secret (leave empty to keep existing)" -AsSecureString
|
||||
|
||||
$clientSecretEncrypted = [string]$existing.clientSecretEncrypted
|
||||
if ($secretPrompt.Length -gt 0) {
|
||||
$clientSecretEncrypted = ConvertFrom-SecureString $secretPrompt
|
||||
}
|
||||
|
||||
$updateHtmlField = Read-YesNo -Prompt "Also update attacktracerorgreport via API" -DefaultValue ([bool]$existing.updateHtmlField)
|
||||
$htmlFieldName = Read-DefaultValue -Prompt "HTML field name" -DefaultValue ([string]$existing.htmlFieldName)
|
||||
$statusFieldName = Read-DefaultValue -Prompt "Status field name" -DefaultValue ([string]$existing.statusFieldName)
|
||||
$summaryFieldName = Read-DefaultValue -Prompt "Summary field name" -DefaultValue ([string]$existing.summaryFieldName)
|
||||
$lastUpdateFieldName = Read-DefaultValue -Prompt "Last update field name" -DefaultValue ([string]$existing.lastUpdateFieldName)
|
||||
$maxAlertRows = [int](Read-DefaultValue -Prompt "Max alert rows in HTML" -DefaultValue ([string]$existing.maxAlertRows))
|
||||
|
||||
$config = [ordered]@{
|
||||
ninjaBaseUrl = $ninjaBaseUrl
|
||||
organizationId = [int]$organizationId
|
||||
clientId = $clientId
|
||||
clientSecretEncrypted = $clientSecretEncrypted
|
||||
oauthScope = $oauthScope
|
||||
reportsRoot = $reportsRoot
|
||||
htmlOutputPath = $htmlOutputPath
|
||||
statusFieldName = $statusFieldName
|
||||
summaryFieldName = $summaryFieldName
|
||||
lastUpdateFieldName = $lastUpdateFieldName
|
||||
htmlFieldName = $htmlFieldName
|
||||
updateHtmlField = $updateHtmlField
|
||||
maxAlertRows = $maxAlertRows
|
||||
}
|
||||
|
||||
$config | ConvertTo-Json -Depth 6 | Set-Content -Path $configPath -Encoding UTF8
|
||||
|
||||
$uninstallScript = Join-Path $scriptRoot "uninstall-attacktracer-ninja-server.ps1"
|
||||
$uninstallCommand = "powershell.exe -ExecutionPolicy Bypass -File `"$uninstallScript`""
|
||||
$uninstallKey = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\AttackTracerNinjaServer"
|
||||
|
||||
if (-not (Test-Path $uninstallKey)) {
|
||||
New-Item -Path $uninstallKey -Force | Out-Null
|
||||
}
|
||||
|
||||
Set-ItemProperty -Path $uninstallKey -Name "DisplayName" -Value "AttackTracerNinjaServer"
|
||||
Set-ItemProperty -Path $uninstallKey -Name "DisplayVersion" -Value $version
|
||||
Set-ItemProperty -Path $uninstallKey -Name "Publisher" -Value "AttackTracerNinja"
|
||||
Set-ItemProperty -Path $uninstallKey -Name "InstallLocation" -Value $installRoot
|
||||
Set-ItemProperty -Path $uninstallKey -Name "UninstallString" -Value $uninstallCommand
|
||||
Set-ItemProperty -Path $uninstallKey -Name "QuietUninstallString" -Value $uninstallCommand
|
||||
Set-ItemProperty -Path $uninstallKey -Name "NoModify" -Value 1 -Type DWord
|
||||
Set-ItemProperty -Path $uninstallKey -Name "NoRepair" -Value 1 -Type DWord
|
||||
|
||||
Write-Host "Installation complete."
|
||||
Write-Host "Main path: $installRoot"
|
||||
Write-Host "Server config:$configPath"
|
||||
Write-Host "Server runner:$(Join-Path $scriptRoot 'run-attacktracer-ninja-server.ps1')"
|
||||
@@ -1,16 +0,0 @@
|
||||
param()
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$installRoot = Join-Path ${env:ProgramFiles} "AttackTracerNinjaServer"
|
||||
$uninstallKey = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\AttackTracerNinjaServer"
|
||||
|
||||
if (Test-Path $uninstallKey) {
|
||||
Remove-Item -Path $uninstallKey -Force -Recurse
|
||||
}
|
||||
|
||||
if (Test-Path $installRoot) {
|
||||
Remove-Item -LiteralPath $installRoot -Force -Recurse
|
||||
}
|
||||
|
||||
Write-Host "AttackTracerNinjaServer removed from $installRoot"
|
||||
@@ -1,15 +0,0 @@
|
||||
param(
|
||||
[Parameter(ValueFromRemainingArguments = $true)]
|
||||
[string[]]$RemainingArgs
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$newScript = Join-Path $PSScriptRoot "uninstall-ocsentinel.ps1"
|
||||
if (-not (Test-Path $newScript)) {
|
||||
throw "Replacement script not found: $newScript"
|
||||
}
|
||||
|
||||
Write-Host "Compatibility wrapper: uninstall-attacktracer-ninja.ps1 -> uninstall-ocsentinel.ps1"
|
||||
& powershell.exe -ExecutionPolicy Bypass -File $newScript @RemainingArgs
|
||||
exit $LASTEXITCODE
|
||||
@@ -1,15 +0,0 @@
|
||||
param(
|
||||
[Parameter(ValueFromRemainingArguments = $true)]
|
||||
[string[]]$RemainingArgs
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$newScript = Join-Path $PSScriptRoot "update-ocsentinel.ps1"
|
||||
if (-not (Test-Path $newScript)) {
|
||||
throw "Replacement script not found: $newScript"
|
||||
}
|
||||
|
||||
Write-Host "Compatibility wrapper: update-attacktracer-ninja.ps1 -> update-ocsentinel.ps1"
|
||||
& powershell.exe -ExecutionPolicy Bypass -File $newScript @RemainingArgs
|
||||
exit $LASTEXITCODE
|
||||
Reference in New Issue
Block a user