Use Github Actions to generate config

[j91321]

Hello,

I created a very basic PoC how could Github Actions workflow be used in order to have a reliable way to always have the latest config available as an artifact instead of having the generated config in repository.

There are a few advantages/disadvantages to this approach.
Advantages:

• syntax testing on pull requests to master
• less error prone (currently there is a typo on line 487 in sysmonconfig.xml dbgore.dll instead of correct dbgcore.dll, even though this is fixed in 10_process_access/include_debugging.xml)
• possible to create workflows for different branches/older versions of sysmon
• maybe possible to automate ATT&CK Navigator json file generation

Disadvantages:

• currently artifacts download is allowed only for registered users upload-artifacts issue #51
• As far as I know there is not one predictable artifact URL with latest attribute, user has to list artifacts through API and then pick the latest.

Hopefully these disadvantages will be fixed in foreseeable future (other platforms e.g. GitLab CI/CD support these use-cases). There is a workaround by using eine/tip, which creates one static pre-release and modifies the files for it on successful build, although I haven't tested it.

Example of passing build
Example of failing build (due to missing ending tag)

Not sure if this is necessary or if it will actually help in maintaining the repository, but I think it may open some interesting possibilities, I'm sure there are other ways to extend/improve the pipeline I haven't thought of.

[olafhartong]

Hey Ján, this looks pretty cool, thanks for this!

As I understand it, merging would let it generate the sysmonconfig.xml on each push but will also require people to log in to GitHub in order to download it ?

[j91321]

Yes, that is the case. (for now at least)

I guess you could keep the manually generated sysmonconfig.xml in the repository, for those that don't have github account. It depends on how people use the repo.

[olafhartong]

Oh nice, I've seen the result in your fork, pretty cool.
Technically it should also be possible then to spawn a windows box and validate it loads as a next step

[j91321]

Thanks for the merge,

Yes, that is probably possible, but it needs to be a full VM not just a Windows container, since there is currently no way on how to load drivers in Windows containers. It can be probably done with actions/azure and Action runner.