Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ability to configure audit policies from WHIDS #34

Closed
qjerome opened this issue May 21, 2021 · 0 comments
Closed

Ability to configure audit policies from WHIDS #34

qjerome opened this issue May 21, 2021 · 0 comments
Labels
enhancement New feature or request next-release feature available in next release

Comments

@qjerome
Copy link
Contributor

qjerome commented May 21, 2021

Make it possible to configure Windows audit policy from configuration file.
@qjerome qjerome added enhancement New feature or request next-release feature available in next release labels May 21, 2021
qjerome added a commit that referenced this issue Jun 22, 2021
@qjerome
Fixed issues:
26f3610 
    - Implement actionnable rules (#28)
    - Implement event count (#29)
    - Enrich events with signature information (#32)
    - Automatic canary folder management (#33)
    - Ability to configure audit policies from WHIDS (#34)
    - Set File System Audit ACLs from config (#35)
qjerome added a commit that referenced this issue Jun 22, 2021
@qjerome
Refactoring:
9e12a1a 
    - hids package
    - hook functions taking hids as first parameter to easily access config from hooks
    - removed global variables shared between hooks and HIDS
    - manager command handler moved from api package to hids to easily access hids config

Fixed issues:
    - Implement actionnable rules: #28
    - Implement event count: #29
    - Enrich events with signature information: #32
    - Automatic canary folder management: #33
    - Ability to configure audit policies from WHIDS config: #34
    - Set File System Audit ACLs from config: #35
    - Generate IR ready reports on detections: #36
    - Dump process tree: #38
    - Enrich event with Gene process scoring: #40
    - Add Admin API to list and download artifacts dumped: #42
    - Directory listing command: #44
    - Implement hash command: #45
    - Implement osquery command: #46
    - Implement terminate command: #47
    - Implement stat command: #48
    - Implement walk command: #49
    - Implement find command: #50
    - Implement report command: #51
    - Implement processes command: #52
    - Implement drivers command: #53
@qjerome qjerome closed this as completed Sep 21, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request next-release feature available in next release
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@qjerome