CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-23 01:13:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
fukusuket
2025-03-14 17:52:38 +09:00
parent 2421d81e02
commit 50ba58f5f2
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
WELA.ps1
View File

@@ -43,7 +43,7 @@ foreach ($rule in $jsonContent) {
$rules = $jsonContent $rules = $jsonContent
# Step 4: Count the number of usable and unusable rules for each level # Step 4: Count the number of usable and unusable rules for each level
$usableRules = $rules | Where-Object { $_.applicable -eq $true } $usableSecRules = $rules | Where-Object { $_.applicable -eq $true }
$unusableRules = $rules | Where-Object { $_.applicable -eq $false } $unusableRules = $rules | Where-Object { $_.applicable -eq $false }
$totalCounts = $rules | Group-Object -Property level | ForEach-Object { $totalCounts = $rules | Group-Object -Property level | ForEach-Object {
@@ -53,7 +53,7 @@ $totalCounts = $rules | Group-Object -Property level | ForEach-Object {
} }
} }
$usableCounts = $usableRules | Group-Object -Property level | ForEach-Object { $usableSecCounts = $usableSecRules | Group-Object -Property level | ForEach-Object {
[PSCustomObject]@{ [PSCustomObject]@{
Level = $_.Name Level = $_.Name
Count = $_.Count Count = $_.Count
@@ -61,7 +61,7 @@ $usableCounts = $usableRules | Group-Object -Property level | ForEach-Object {
} }
# Step 5: Calculate the percentages # Step 5: Calculate the percentages
$usablePercentages = $usableCounts | ForEach-Object { $usableSecPercentages = $usableSecCounts | ForEach-Object {
$total = ($totalCounts | Where-Object Level -match $PSItem.Level | Select-Object -ExpandProperty Count)[0] $total = ($totalCounts | Where-Object Level -match $PSItem.Level | Select-Object -ExpandProperty Count)[0]
[PSCustomObject]@{ [PSCustomObject]@{
Level = $PSItem.Level Level = $PSItem.Level
@@ -74,19 +74,20 @@ $usablePercentages = $usableCounts | ForEach-Object {
# Step 6: Generate the required outputtotal # Step 6: Generate the required outputtotal
$customOrder = @("critical", "high", "medium", "low", "informational") $customOrder = @("critical", "high", "medium", "low", "informational")
Write-Output "Detection rules that can be used on this system versus total possible rules:" Write-Output "Detection rules that can be used on this system versus total possible rules:"
$usablePercentages = $usablePercentages | Sort-Object { $customOrder.IndexOf($_.Level) } $usableSecPercentages = $usableSecPercentages | Sort-Object { $customOrder.IndexOf($_.Level) }
$usablePercentages | ForEach-Object { $usableSecPercentages | ForEach-Object {
Write-Output "$($_.Level) rules: $($_.UsableCount) / $($_.TotalCount) ($($_.Percentage)%)" Write-Output "$($_.Level) rules: $($_.UsableCount) / $($_.TotalCount) ($($_.Percentage)%)"
} }
Write-Output "" Write-Output ""
Write-Output "Usable detection rules list saved to: UsableRules.csv" Write-Output "Usable detection rules list saved to: UsableRules.csv"
Write-Output "Unusable detection rules list saved to: UnusableRules.csv" Write-Output "Unusable detection rules list saved to: UnusableRules.csv"
Write-Output "" Write-Output ""
$totalUsable = ($usablePercentages | Measure-Object -Property UsableCount -Sum).Sum $totalUsable = ($usableSecPercentages | Measure-Object -Property UsableCount -Sum).Sum
$totalRulesCount = ($totalCounts | Measure-Object -Property Count -Sum).Sum $totalRulesCount = ($totalCounts | Measure-Object -Property Count -Sum).Sum
$utilizationPercentage = "{0:N2}" -f (($totalUsable / $totalRulesCount) * 100) $utilizationPercentage = "{0:N2}" -f (($totalUsable / $totalRulesCount) * 100)
Write-Output "You can utilize $utilizationPercentage% of your detection rules." Write-Output "You can utilize $utilizationPercentage% of your detection rules."
# Step 7: Save the lists of usable and unusable rules to CSV files # Step 7: Save the lists of usable and unusable rules to CSV files
$usableRules | Select-Object title, level, id | Export-Csv -Path "UsableRules.csv" -NoTypeInformation $usableSecRules | Select-Object title, level, id | Export-Csv -Path "UsableRules.csv" -NoTypeInformation
$unusableRules | Select-Object title, level, id | Export-Csv -Path "UnusableRules.csv" -NoTypeInformation $unusableRules | Select-Object title, level, id | Export-Csv -Path "UnusableRules.csv" -NoTypeInformation