From fd990b698f82c92172b3bb52567c30e46daff6ef Mon Sep 17 00:00:00 2001 From: OfficeCom Codex Date: Sat, 1 Aug 2026 01:35:58 +0200 Subject: [PATCH] Enable passive ransomware detection by default for beta --- config/ocsentinel-settings.example.json | 2 +- docs/beta-deployment.md | 13 +++++---- scripts/bootstrap-ocsentinel-ninja.ps1 | 29 +++++++++++++++++++ src/OCSentinelCli/Configuration.cs | 2 +- src/OCSentinelCli/OCSentinelCli.csproj | 4 +-- .../RansomwareBetaTests.cs | 7 +++++ 6 files changed, 47 insertions(+), 10 deletions(-) diff --git a/config/ocsentinel-settings.example.json b/config/ocsentinel-settings.example.json index b4ca39a..c2c8d97 100644 --- a/config/ocsentinel-settings.example.json +++ b/config/ocsentinel-settings.example.json @@ -10,7 +10,7 @@ "criticalSprayAccountCount": 10, "correlationWarningCveThreshold": 1, "correlationCriticalCveThreshold": 1, - "ransomwareBetaEnabled": false, + "ransomwareBetaEnabled": true, "ransomwareBetaAlertingEnabled": false, "ransomwareLookbackMinutes": 15, "ransomwareWarningSignalCount": 2, diff --git a/docs/beta-deployment.md b/docs/beta-deployment.md index 924986a..46a1f32 100644 --- a/docs/beta-deployment.md +++ b/docs/beta-deployment.md @@ -19,12 +19,13 @@ Die Stable-Aufgabe verwendet keinen Kanalwert oder den Wert `stable`. ## Passive Ransomware-Beta -Die Beta ist nach der Installation weiterhin deaktiviert. Auf einem -Pilotgeraet wird in `C:\Program Files\OCSentinel\config\ocsentinel-settings.json` -der Wert `ransomwareBetaEnabled` auf `true` gesetzt. Die Auswertung bleibt -passiv, solange `ransomwareBetaAlertingEnabled` auf `false` steht: Hinweise, -Warnungen und kritische Beta-Signale erscheinen im JSON-Report und Dashboard, -veraendern aber keine NinjaOne-Alarmfelder. +Die Ransomware-Beta ist im Beta-Kanal standardmaessig aktiviert. Die Auswertung +bleibt passiv, solange `ransomwareBetaAlertingEnabled` auf `false` steht: +Hinweise, Warnungen und kritische Beta-Signale erscheinen im JSON-Report und +Dashboard, veraendern aber keine NinjaOne-Alarmfelder. Fuer eine lokale +Ausnahme kann `ransomwareBetaEnabled` in +`C:\Program Files\OCSentinel\config\ocsentinel-settings.json` auf `false` +gesetzt werden. Der optionale Datei-Churn-Sensor wird nur mit `ransomwareFileChurnEnabled: true` aktiviert. Er wertet ausschliesslich bereits diff --git a/scripts/bootstrap-ocsentinel-ninja.ps1 b/scripts/bootstrap-ocsentinel-ninja.ps1 index 1327430..6012645 100644 --- a/scripts/bootstrap-ocsentinel-ninja.ps1 +++ b/scripts/bootstrap-ocsentinel-ninja.ps1 @@ -112,6 +112,30 @@ function Get-OCSentinelArtifact { } } +function Enable-OCSentinelBetaDefaults { + param([Parameter(Mandatory)][string]$SettingsPath) + + if (-not (Test-Path -LiteralPath $SettingsPath)) { + return + } + + $settings = Get-Content -LiteralPath $SettingsPath -Raw | ConvertFrom-Json + if ($null -ne $settings.PSObject.Properties["ransomwareBetaDefaultApplied"]) { + return + } + + if ($null -eq $settings.PSObject.Properties["ransomwareBetaEnabled"]) { + $settings | Add-Member -NotePropertyName "ransomwareBetaEnabled" -NotePropertyValue $true + } + else { + $settings.ransomwareBetaEnabled = $true + } + + $settings | Add-Member -NotePropertyName "ransomwareBetaDefaultApplied" -NotePropertyValue "1.5.0-beta.4" + $settings | ConvertTo-Json -Depth 10 | Set-Content -LiteralPath $SettingsPath -Encoding UTF8 + Write-Host "Enabled passive ransomware beta defaults." +} + Initialize-OCSentinelTls if ($ReleaseChannel -eq "stable" -and -not [string]::IsNullOrWhiteSpace($env:ReleaseChannel)) { @@ -133,6 +157,7 @@ $updaterPath = Join-Path $installRoot "scripts\update-ocsentinel.ps1" $monitorPath = Join-Path $installRoot "scripts\run-ocsentinel-monitor.ps1" $appPath = Join-Path $installRoot "app\OCSentinelCli.exe" $clientConfigPath = Join-Path $installRoot "config\ocsentinel-client.json" +$settingsPath = Join-Path $installRoot "config\ocsentinel-settings.json" $secretScriptPath = Join-Path $installRoot "scripts\protect-ocsentinel-secret.ps1" $secretPath = "C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat" @@ -214,6 +239,10 @@ if (-not (Test-Path -LiteralPath $appPath)) { throw "OCSentinel installation completed, but the client executable was not found." } +if ($ReleaseChannel -eq "beta") { + Enable-OCSentinelBetaDefaults -SettingsPath $settingsPath +} + if (-not [string]::IsNullOrWhiteSpace($WebhookUrl)) { if (-not (Test-Path -LiteralPath $clientConfigPath)) { throw "OCSentinel client configuration was not found: $clientConfigPath" diff --git a/src/OCSentinelCli/Configuration.cs b/src/OCSentinelCli/Configuration.cs index aeb6d19..f55c193 100644 --- a/src/OCSentinelCli/Configuration.cs +++ b/src/OCSentinelCli/Configuration.cs @@ -26,7 +26,7 @@ internal sealed record ScannerConfiguration public int CorrelationCriticalCveThreshold { get; init; } = 1; - public bool RansomwareBetaEnabled { get; init; } + public bool RansomwareBetaEnabled { get; init; } = true; public bool RansomwareBetaAlertingEnabled { get; init; } diff --git a/src/OCSentinelCli/OCSentinelCli.csproj b/src/OCSentinelCli/OCSentinelCli.csproj index 73a00e2..98134af 100644 --- a/src/OCSentinelCli/OCSentinelCli.csproj +++ b/src/OCSentinelCli/OCSentinelCli.csproj @@ -9,10 +9,10 @@ OCSentinelCli OfficeCom Sentinel OfficeCom - 1.5.0-beta.3 + 1.5.0-beta.4 1.5.0.0 1.5.0.0 - 1.5.0-beta.3 + 1.5.0-beta.4 diff --git a/tests/OCSentinelCli.Tests/RansomwareBetaTests.cs b/tests/OCSentinelCli.Tests/RansomwareBetaTests.cs index 1764a8a..3b16112 100644 --- a/tests/OCSentinelCli.Tests/RansomwareBetaTests.cs +++ b/tests/OCSentinelCli.Tests/RansomwareBetaTests.cs @@ -6,6 +6,13 @@ namespace OCSentinelCli.Tests; [SupportedOSPlatform("windows")] public sealed class RansomwareBetaTests { + [Fact] + public void RansomwareBetaIsEnabledByDefault() + { + Assert.True(new ScannerConfiguration().RansomwareBetaEnabled); + Assert.False(new ScannerConfiguration().RansomwareBetaAlertingEnabled); + } + [Fact] public void FileChurnBelowBothThresholdsDoesNotCreateSignal() {