diff --git a/website/docs/commands/index.ar.md b/website/docs/commands/index.ar.md new file mode 100644 index 00000000..1317862b --- /dev/null +++ b/website/docs/commands/index.ar.md @@ -0,0 +1,5 @@ +# قائمة الأوامر +- `audit-settings`: التحقق من إعدادات سياسة تدقيق سجل أحداث Windows. +- `audit-filesize`: التحقق من حجم ملف سجل أحداث Windows. +- `configure`: تكوين سياسة تدقيق سجل أحداث Windows وحجم الملف الموصى بهما. +- `update-rules`: تحديث ملفات تكوين قواعد Sigma الخاصة بـ WELA. diff --git a/website/docs/commands/index.de.md b/website/docs/commands/index.de.md new file mode 100644 index 00000000..03ecd575 --- /dev/null +++ b/website/docs/commands/index.de.md @@ -0,0 +1,5 @@ +# Befehlsliste +- `audit-settings`: Überprüfen der Überwachungsrichtlinieneinstellungen für das Windows-Ereignisprotokoll. +- `audit-filesize`: Überprüfen der Dateigröße des Windows-Ereignisprotokolls. +- `configure`: Konfigurieren der empfohlenen Überwachungsrichtlinie und Dateigröße für das Windows-Ereignisprotokoll. +- `update-rules`: Aktualisieren der Sigma-Regelkonfigurationsdateien von WELA. diff --git a/website/docs/commands/index.es.md b/website/docs/commands/index.es.md new file mode 100644 index 00000000..7606a1bd --- /dev/null +++ b/website/docs/commands/index.es.md @@ -0,0 +1,5 @@ +# Lista de comandos +- `audit-settings`: Comprobar la configuración de la política de auditoría del registro de eventos de Windows. +- `audit-filesize`: Comprobar el tamaño del archivo del registro de eventos de Windows. +- `configure`: Configurar la política de auditoría y el tamaño de archivo recomendados del registro de eventos de Windows. +- `update-rules`: Actualizar los archivos de configuración de reglas Sigma de WELA. diff --git a/website/docs/commands/index.fr.md b/website/docs/commands/index.fr.md new file mode 100644 index 00000000..779b6a04 --- /dev/null +++ b/website/docs/commands/index.fr.md @@ -0,0 +1,5 @@ +# Liste des commandes +- `audit-settings` : Vérifier les paramètres de la stratégie d'audit du journal d'événements Windows. +- `audit-filesize` : Vérifier la taille du fichier du journal d'événements Windows. +- `configure` : Configurer la stratégie d'audit recommandée du journal d'événements Windows et la taille du fichier. +- `update-rules` : Mettre à jour les fichiers de configuration des règles Sigma de WELA. diff --git a/website/docs/commands/index.hi.md b/website/docs/commands/index.hi.md new file mode 100644 index 00000000..7c6c02b9 --- /dev/null +++ b/website/docs/commands/index.hi.md @@ -0,0 +1,5 @@ +# कमांड सूची +- `audit-settings`: Windows इवेंट लॉग ऑडिट पॉलिसी सेटिंग्स जाँचें। +- `audit-filesize`: Windows इवेंट लॉग फ़ाइल आकार जाँचें। +- `configure`: अनुशंसित Windows इवेंट लॉग ऑडिट पॉलिसी और फ़ाइल आकार कॉन्फ़िगर करें। +- `update-rules`: WELA की Sigma नियम कॉन्फ़िग फ़ाइलें अपडेट करें। diff --git a/website/docs/commands/index.id.md b/website/docs/commands/index.id.md new file mode 100644 index 00000000..7ef344b6 --- /dev/null +++ b/website/docs/commands/index.id.md @@ -0,0 +1,5 @@ +# Daftar Perintah +- `audit-settings`: Memeriksa pengaturan kebijakan audit Windows event log. +- `audit-filesize`: Memeriksa ukuran berkas Windows event log. +- `configure`: Mengonfigurasi kebijakan audit dan ukuran berkas Windows event log yang direkomendasikan. +- `update-rules`: Memperbarui berkas konfigurasi aturan Sigma milik WELA. diff --git a/website/docs/commands/index.ko.md b/website/docs/commands/index.ko.md new file mode 100644 index 00000000..1a8721c8 --- /dev/null +++ b/website/docs/commands/index.ko.md @@ -0,0 +1,5 @@ +# 명령어 목록 +- `audit-settings`: Windows 이벤트 로그 감사 정책 설정을 확인합니다. +- `audit-filesize`: Windows 이벤트 로그 파일 크기를 확인합니다. +- `configure`: 권장되는 Windows 이벤트 로그 감사 정책과 파일 크기를 설정합니다. +- `update-rules`: WELA의 Sigma 규칙 설정 파일을 업데이트합니다. diff --git a/website/docs/commands/index.my.md b/website/docs/commands/index.my.md new file mode 100644 index 00000000..2f503470 --- /dev/null +++ b/website/docs/commands/index.my.md @@ -0,0 +1,5 @@ +# Command List +- `audit-settings`: Windows event log ၏ audit policy ဆက်တင်များကို စစ်ဆေးပါ။ +- `audit-filesize`: Windows event log ဖိုင်အရွယ်အစားကို စစ်ဆေးပါ။ +- `configure`: အကြံပြုထားသော Windows event log audit policy နှင့် ဖိုင်အရွယ်အစားကို ပြင်ဆင်သတ်မှတ်ပါ။ +- `update-rules`: WELA ၏ Sigma rules config ဖိုင်များကို အပ်ဒိတ်လုပ်ပါ။ diff --git a/website/docs/commands/index.pt-BR.md b/website/docs/commands/index.pt-BR.md new file mode 100644 index 00000000..e56589de --- /dev/null +++ b/website/docs/commands/index.pt-BR.md @@ -0,0 +1,5 @@ +# Lista de Comandos +- `audit-settings`: Verifica as configurações de política de auditoria do log de eventos do Windows. +- `audit-filesize`: Verifica o tamanho do arquivo de log de eventos do Windows. +- `configure`: Configura a política de auditoria recomendada e o tamanho do arquivo do log de eventos do Windows. +- `update-rules`: Atualiza os arquivos de configuração das regras Sigma do WELA. diff --git a/website/docs/commands/index.th.md b/website/docs/commands/index.th.md new file mode 100644 index 00000000..32a18180 --- /dev/null +++ b/website/docs/commands/index.th.md @@ -0,0 +1,5 @@ +# รายการคำสั่ง +- `audit-settings`: ตรวจสอบการตั้งค่านโยบายการตรวจสอบ (audit policy) ของ Windows event log +- `audit-filesize`: ตรวจสอบขนาดไฟล์ของ Windows event log +- `configure`: กำหนดค่านโยบายการตรวจสอบ (audit policy) และขนาดไฟล์ของ Windows event log ที่แนะนำ +- `update-rules`: อัปเดตไฟล์การตั้งค่ากฎ Sigma ของ WELA diff --git a/website/docs/commands/index.tr.md b/website/docs/commands/index.tr.md new file mode 100644 index 00000000..13cd9db6 --- /dev/null +++ b/website/docs/commands/index.tr.md @@ -0,0 +1,5 @@ +# Komut Listesi +- `audit-settings`: Windows olay günlüğü denetim politikası ayarlarını kontrol eder. +- `audit-filesize`: Windows olay günlüğü dosya boyutunu kontrol eder. +- `configure`: Önerilen Windows olay günlüğü denetim politikasını ve dosya boyutunu yapılandırır. +- `update-rules`: WELA'nın Sigma kuralları yapılandırma dosyalarını günceller. diff --git a/website/docs/commands/index.uk.md b/website/docs/commands/index.uk.md new file mode 100644 index 00000000..93a809e0 --- /dev/null +++ b/website/docs/commands/index.uk.md @@ -0,0 +1,5 @@ +# Список команд +- `audit-settings`: Перевірка налаштувань політики аудиту журналу подій Windows. +- `audit-filesize`: Перевірка розміру файлу журналу подій Windows. +- `configure`: Налаштування рекомендованої політики аудиту та розміру файлу журналу подій Windows. +- `update-rules`: Оновлення конфігураційних файлів правил Sigma для WELA. diff --git a/website/docs/commands/index.zh-TW.md b/website/docs/commands/index.zh-TW.md new file mode 100644 index 00000000..ecea7c50 --- /dev/null +++ b/website/docs/commands/index.zh-TW.md @@ -0,0 +1,5 @@ +# 命令列表 +- `audit-settings`：檢查 Windows 事件記錄稽核原則設定。 +- `audit-filesize`：檢查 Windows 事件記錄檔案大小。 +- `configure`：設定建議的 Windows 事件記錄稽核原則與檔案大小。 +- `update-rules`：更新 WELA 的 Sigma 規則設定檔。 diff --git a/website/docs/commands/usage.ar.md b/website/docs/commands/usage.ar.md new file mode 100644 index 00000000..29896948 --- /dev/null +++ b/website/docs/commands/usage.ar.md @@ -0,0 +1,55 @@ +# استخدام الأوامر +## audit-settings +يتحقق الأمر `audit-settings` من إعدادات سياسة تدقيق سجل أحداث Windows ويقارنها بالإعدادات الموصى بها من [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings) و[Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) و[Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +يشير `RuleCount` إلى عدد [قواعد Sigma](https://github.com/SigmaHQ/sigma) التي يمكنها اكتشاف الأحداث ضمن تلك الفئة. + +### أمثلة على أمر `audit-settings` +التحقق باستخدام إعدادات Yamato Security الموصى بها الافتراضية وحفظ النتائج إلى CSV: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +التحقق باستخدام إعدادات Australian Signals Directorate الموصى بها وحفظ النتائج إلى CSV: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +التحقق باستخدام إعدادات Microsoft الموصى بها لنظام تشغيل الخادم وعرض النتائج في واجهة رسومية: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +التحقق باستخدام إعدادات Microsoft الموصى بها لنظام تشغيل العميل وعرض النتائج في صيغة جدول: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +يتحقق الأمر `audit-filesize` من حجم ملفات سجلات أحداث Windows ويقارنها بالإعدادات الموصى بها من توصيات Yamato Security. + +### أمثلة على أمر `audit-filesize` +التحقق من حجم ملف سجل أحداث Windows باستخدام توصيات Yamato Security وحفظ النتائج إلى CSV: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +يضبط الأمر `configure` سياسة تدقيق سجل أحداث Windows الموصى بها وحجم الملف. + +#### أمثلة على أمر `configure` +تطبيق إعدادات Yamato Security الموصى بها (مع مطالبة تأكيد قبل تغيير الإعدادات): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +تطبيق إعدادات Australian Signals Directorate الموصى بها دون مطالبة تأكيد: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### أمثلة على أمر `update-rules` +تحديث ملفات إعدادات قواعد Sigma الخاصة بـ WELA: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.de.md b/website/docs/commands/usage.de.md new file mode 100644 index 00000000..de1e9007 --- /dev/null +++ b/website/docs/commands/usage.de.md @@ -0,0 +1,55 @@ +# Befehlsverwendung +## audit-settings +Der Befehl `audit-settings` überprüft die Einstellungen der Überwachungsrichtlinie des Windows-Ereignisprotokolls und vergleicht sie mit den empfohlenen Einstellungen von [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) und [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +`RuleCount` gibt die Anzahl der [Sigma-Regeln](https://github.com/SigmaHQ/sigma) an, die Ereignisse innerhalb dieser Kategorie erkennen können. + +### `audit-settings`-Befehlsbeispiele +Mit den standardmäßig empfohlenen Einstellungen von Yamato Security überprüfen und Ergebnisse als CSV speichern: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Mit den empfohlenen Einstellungen des Australian Signals Directorate überprüfen und Ergebnisse als CSV speichern: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Mit den von Microsoft empfohlenen Einstellungen für Server-Betriebssysteme überprüfen und Ergebnisse in einer GUI anzeigen: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Mit den von Microsoft empfohlenen Einstellungen für Client-Betriebssysteme überprüfen und Ergebnisse im Tabellenformat anzeigen: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +Der Befehl `audit-filesize` überprüft die Dateigröße der Windows-Ereignisprotokolle und vergleicht sie mit den Empfehlungen von Yamato Security. + +### `audit-filesize`-Befehlsbeispiele +Die Dateigröße des Windows-Ereignisprotokolls mit den Empfehlungen von Yamato Security überprüfen und Ergebnisse als CSV speichern: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +Der Befehl `configure` legt die empfohlene Überwachungsrichtlinie und Dateigröße des Windows-Ereignisprotokolls fest. + +#### `configure`-Befehlsbeispiele +Die von Yamato Security empfohlenen Einstellungen anwenden (mit Bestätigungsaufforderung vor dem Ändern der Einstellungen): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Die vom Australian Signals Directorate empfohlenen Einstellungen ohne Bestätigungsaufforderung anwenden: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules`-Befehlsbeispiele +Die Sigma-Regel-Konfigurationsdateien von WELA aktualisieren: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.es.md b/website/docs/commands/usage.es.md new file mode 100644 index 00000000..c69d4bc6 --- /dev/null +++ b/website/docs/commands/usage.es.md @@ -0,0 +1,55 @@ +# Uso de comandos +## audit-settings +El comando `audit-settings` comprueba la configuración de la política de auditoría del registro de eventos de Windows y la compara con la configuración recomendada de [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) y [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +`RuleCount` indica el número de [reglas Sigma](https://github.com/SigmaHQ/sigma) que pueden detectar eventos dentro de esa categoría. + +### Ejemplos del comando `audit-settings` +Comprobar con la configuración recomendada predeterminada de Yamato Security y guardar los resultados en CSV: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Comprobar con la configuración recomendada de Australian Signals Directorate y guardar los resultados en CSV: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Comprobar con la configuración recomendada de Microsoft para SO de servidor y mostrar los resultados en una GUI: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Comprobar con la configuración recomendada de Microsoft para SO de cliente y mostrar los resultados en formato de tabla: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +El comando `audit-filesize` comprueba el tamaño de archivo de los registros de eventos de Windows y lo compara con la configuración recomendada de las recomendaciones de Yamato Security. + +### Ejemplos del comando `audit-filesize` +Comprobar el tamaño de archivo del registro de eventos de Windows con las recomendaciones de Yamato Security y guardar los resultados en CSV: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +El comando `configure` establece la política de auditoría del registro de eventos de Windows y el tamaño de archivo recomendados. + +#### Ejemplos del comando `configure` +Aplicar la configuración recomendada de Yamato Security (con solicitud de confirmación antes de cambiar la configuración): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Aplicar la configuración recomendada de Australian Signals Directorate sin solicitud de confirmación: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### Ejemplos del comando `update-rules` +Actualizar los archivos de configuración de reglas Sigma de WELA: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.fr.md b/website/docs/commands/usage.fr.md new file mode 100644 index 00000000..c432a83a --- /dev/null +++ b/website/docs/commands/usage.fr.md @@ -0,0 +1,55 @@ +# Utilisation des commandes +## audit-settings +La commande `audit-settings` vérifie les paramètres de la stratégie d'audit du journal d'événements Windows et les compare aux paramètres recommandés par [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) et l'[Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +`RuleCount` indique le nombre de [règles Sigma](https://github.com/SigmaHQ/sigma) capables de détecter des événements dans cette catégorie. + +### Exemples de la commande `audit-settings` +Vérifier avec les paramètres recommandés par défaut de Yamato Security et enregistrer les résultats au format CSV : +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Vérifier avec les paramètres recommandés par l'Australian Signals Directorate et enregistrer les résultats au format CSV : +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Vérifier avec les paramètres recommandés par Microsoft pour les systèmes d'exploitation Server et afficher les résultats dans une interface graphique : +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Vérifier avec les paramètres recommandés par Microsoft pour les systèmes d'exploitation Client et afficher les résultats sous forme de tableau : +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +La commande `audit-filesize` vérifie la taille des fichiers des journaux d'événements Windows et la compare aux paramètres recommandés par Yamato Security. + +### Exemples de la commande `audit-filesize` +Vérifier la taille des fichiers du journal d'événements Windows avec les recommandations de Yamato Security et enregistrer les résultats au format CSV : +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +La commande `configure` définit la stratégie d'audit du journal d'événements Windows et la taille des fichiers recommandées. + +#### Exemples de la commande `configure` +Appliquer les paramètres recommandés par Yamato Security (avec une invite de confirmation avant de modifier les paramètres) : +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Appliquer les paramètres recommandés par l'Australian Signals Directorate sans invite de confirmation : +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### Exemples de la commande `update-rules` +Mettre à jour les fichiers de configuration des règles Sigma de WELA : +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.hi.md b/website/docs/commands/usage.hi.md new file mode 100644 index 00000000..f5e6cb5e --- /dev/null +++ b/website/docs/commands/usage.hi.md @@ -0,0 +1,55 @@ +# कमांड उपयोग +## audit-settings +`audit-settings` कमांड Windows इवेंट लॉग ऑडिट पॉलिसी सेटिंग्स की जाँच करता है और उनकी तुलना [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations), और [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) की अनुशंसित सेटिंग्स से करता है। +`RuleCount` उस श्रेणी के भीतर की घटनाओं का पता लगाने में सक्षम [Sigma rules](https://github.com/SigmaHQ/sigma) की संख्या को दर्शाता है। + +### `audit-settings` कमांड के उदाहरण +डिफ़ॉल्ट Yamato Security की अनुशंसित सेटिंग्स के साथ जाँचें और परिणामों को CSV में सहेजें: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Australian Signals Directorate की अनुशंसित सेटिंग्स के साथ जाँचें और परिणामों को CSV में सहेजें: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Microsoft की अनुशंसित Server OS सेटिंग्स के साथ जाँचें और परिणामों को GUI में प्रदर्शित करें: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Microsoft की अनुशंसित Client OS सेटिंग्स के साथ जाँचें और परिणामों को तालिका प्रारूप में प्रदर्शित करें: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +`audit-filesize` कमांड Windows इवेंट लॉग्स के फ़ाइल आकार की जाँच करता है और उनकी तुलना Yamato Security की अनुशंसाओं से करता है। + +### `audit-filesize` कमांड के उदाहरण +Windows इवेंट लॉग फ़ाइल आकार को Yamato Security की अनुशंसाओं के साथ जाँचें और परिणामों को CSV में सहेजें: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +`configure` कमांड अनुशंसित Windows इवेंट लॉग ऑडिट पॉलिसी और फ़ाइल आकार सेट करता है। + +#### `configure` कमांड के उदाहरण +Yamato Security की अनुशंसित सेटिंग्स लागू करें (सेटिंग्स बदलने से पहले पुष्टिकरण प्रॉम्प्ट के साथ): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Australian Signals Directorate की अनुशंसित सेटिंग्स बिना पुष्टिकरण प्रॉम्प्ट के लागू करें: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules` कमांड के उदाहरण +WELA की Sigma rules कॉन्फ़िग फ़ाइलों को अपडेट करें: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.id.md b/website/docs/commands/usage.id.md new file mode 100644 index 00000000..9c593dc1 --- /dev/null +++ b/website/docs/commands/usage.id.md @@ -0,0 +1,55 @@ +# Penggunaan Perintah +## audit-settings +Perintah `audit-settings` memeriksa pengaturan kebijakan audit log peristiwa Windows dan membandingkannya dengan pengaturan yang direkomendasikan dari [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations), dan [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +`RuleCount` menunjukkan jumlah [aturan Sigma](https://github.com/SigmaHQ/sigma) yang dapat mendeteksi peristiwa dalam kategori tersebut. + +### Contoh perintah `audit-settings` +Periksa dengan pengaturan rekomendasi default Yamato Security dan simpan hasilnya ke CSV: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Periksa dengan pengaturan rekomendasi Australian Signals Directorate dan simpan hasilnya ke CSV: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Periksa dengan pengaturan rekomendasi Server OS dari Microsoft dan tampilkan hasilnya dalam GUI: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Periksa dengan pengaturan rekomendasi Client OS dari Microsoft dan tampilkan hasilnya dalam format tabel: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +Perintah `audit-filesize` memeriksa ukuran file log peristiwa Windows dan membandingkannya dengan pengaturan yang direkomendasikan dari rekomendasi Yamato Security. + +### Contoh perintah `audit-filesize` +Periksa ukuran file log peristiwa Windows dengan rekomendasi Yamato Security dan simpan hasilnya ke CSV: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +Perintah `configure` menetapkan kebijakan audit log peristiwa Windows dan ukuran file yang direkomendasikan. + +#### Contoh perintah `configure` +Terapkan pengaturan rekomendasi Yamato Security (dengan prompt konfirmasi sebelum mengubah pengaturan): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Terapkan pengaturan rekomendasi Australian Signals Directorate tanpa prompt konfirmasi: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### Contoh perintah `update-rules` +Perbarui file konfigurasi aturan Sigma WELA: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.ko.md b/website/docs/commands/usage.ko.md new file mode 100644 index 00000000..1b358be4 --- /dev/null +++ b/website/docs/commands/usage.ko.md @@ -0,0 +1,55 @@ +# 명령어 사용법 +## audit-settings +`audit-settings` 명령어는 Windows 이벤트 로그 감사 정책 설정을 확인하고 이를 [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations), [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding)의 권장 설정과 비교합니다. +`RuleCount`는 해당 카테고리 내의 이벤트를 탐지할 수 있는 [Sigma 규칙](https://github.com/SigmaHQ/sigma)의 개수를 나타냅니다. + +### `audit-settings` 명령어 예시 +기본 Yamato Security의 권장 설정으로 확인하고 결과를 CSV로 저장: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Australian Signals Directorate의 권장 설정으로 확인하고 결과를 CSV로 저장: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Microsoft의 권장 Server OS 설정으로 확인하고 결과를 GUI로 표시: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Microsoft의 권장 Client OS 설정으로 확인하고 결과를 테이블 형식으로 표시: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +`audit-filesize` 명령어는 Windows 이벤트 로그의 파일 크기를 확인하고 이를 Yamato Security의 권장 설정과 비교합니다. + +### `audit-filesize` 명령어 예시 +Yamato Security의 권장 설정으로 Windows 이벤트 로그 파일 크기를 확인하고 결과를 CSV로 저장: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +`configure` 명령어는 권장되는 Windows 이벤트 로그 감사 정책과 파일 크기를 설정합니다. + +#### `configure` 명령어 예시 +Yamato Security의 권장 설정 적용(설정 변경 전 확인 프롬프트 포함): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Australian Signals Directorate의 권장 설정을 확인 프롬프트 없이 적용: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules` 명령어 예시 +WELA의 Sigma 규칙 구성 파일 업데이트: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.my.md b/website/docs/commands/usage.my.md new file mode 100644 index 00000000..1c6e0812 --- /dev/null +++ b/website/docs/commands/usage.my.md @@ -0,0 +1,55 @@ +# Command အသုံးပြုပုံ +## audit-settings +`audit-settings` command သည် Windows event log audit policy settings များကို စစ်ဆေးပြီး [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings)၊ [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) နှင့် [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) တို့မှ အကြံပြုထားသော settings များနှင့် နှိုင်းယှဉ်ပေးပါသည်။ +`RuleCount` သည် ထို category အတွင်းရှိ events များကို ရှာဖွေတွေ့ရှိနိုင်သော [Sigma rules](https://github.com/SigmaHQ/sigma) အရေအတွက်ကို ဖော်ပြသည်။ + +### `audit-settings` command နမူနာများ +ပုံသေ Yamato Security ၏ အကြံပြုထားသော settings များဖြင့် စစ်ဆေးပြီး ရလဒ်များကို CSV သို့ သိမ်းဆည်းရန်- +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Australian Signals Directorate ၏ အကြံပြုထားသော settings များဖြင့် စစ်ဆေးပြီး ရလဒ်များကို CSV သို့ သိမ်းဆည်းရန်- +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Microsoft ၏ အကြံပြုထားသော Server OS settings များဖြင့် စစ်ဆေးပြီး ရလဒ်များကို GUI တွင် ပြသရန်- +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Microsoft ၏ အကြံပြုထားသော Client OS settings များဖြင့် စစ်ဆေးပြီး ရလဒ်များကို table format ဖြင့် ပြသရန်- +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +`audit-filesize` command သည် Windows event logs များ၏ file size ကို စစ်ဆေးပြီး Yamato Security ၏ အကြံပြုချက်များမှ အကြံပြုထားသော settings များနှင့် နှိုင်းယှဉ်ပေးပါသည်။ + +### `audit-filesize` command နမူနာများ +Windows event log file size ကို Yamato Security ၏ အကြံပြုချက်များဖြင့် စစ်ဆေးပြီး ရလဒ်များကို CSV သို့ သိမ်းဆည်းရန်- +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +`configure` command သည် အကြံပြုထားသော Windows event log audit policy နှင့် file size ကို သတ်မှတ်ပေးပါသည်။ + +#### `configure` command နမူနာများ +Yamato Security ၏ အကြံပြုထားသော settings များကို အသုံးချရန် (settings များ ပြောင်းလဲမည့်အကြိုတွင် အတည်ပြုချက် prompt ဖြင့်)- +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Australian Signals Directorate ၏ အကြံပြုထားသော settings များကို အတည်ပြုချက် prompt မပါဘဲ အသုံးချရန်- +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules` command နမူနာများ +WELA ၏ Sigma rules config files များကို update လုပ်ရန်- +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.pt-BR.md b/website/docs/commands/usage.pt-BR.md new file mode 100644 index 00000000..73c41475 --- /dev/null +++ b/website/docs/commands/usage.pt-BR.md @@ -0,0 +1,55 @@ +# Uso de Comandos +## audit-settings +O comando `audit-settings` verifica as configurações da política de auditoria do log de eventos do Windows e as compara com as configurações recomendadas da [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), da [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) e da [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +`RuleCount` indica o número de [regras Sigma](https://github.com/SigmaHQ/sigma) que podem detectar eventos dentro daquela categoria. + +### exemplos do comando `audit-settings` +Verifique com as configurações recomendadas padrão da Yamato Security e salve os resultados em CSV: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Verifique com as configurações recomendadas da Australian Signals Directorate e salve os resultados em CSV: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Verifique com as configurações recomendadas da Microsoft para SO Server e exiba os resultados em uma GUI: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Verifique com as configurações recomendadas da Microsoft para SO Client e exiba os resultados em formato de tabela: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +O comando `audit-filesize` verifica o tamanho dos arquivos dos logs de eventos do Windows e os compara com as configurações recomendadas pela Yamato Security. + +### exemplos do comando `audit-filesize` +Verifique o tamanho do arquivo do log de eventos do Windows com as recomendações da Yamato Security e salve os resultados em CSV: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +O comando `configure` define a política de auditoria recomendada do log de eventos do Windows e o tamanho do arquivo. + +#### exemplos do comando `configure` +Aplique as configurações recomendadas da Yamato Security (com prompt de confirmação antes de alterar as configurações): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Aplique as configurações recomendadas da Australian Signals Directorate sem prompt de confirmação: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### exemplos do comando `update-rules` +Atualize os arquivos de configuração das regras Sigma do WELA: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.th.md b/website/docs/commands/usage.th.md new file mode 100644 index 00000000..14601929 --- /dev/null +++ b/website/docs/commands/usage.th.md @@ -0,0 +1,55 @@ +# การใช้งานคำสั่ง +## audit-settings +คำสั่ง `audit-settings` จะตรวจสอบการตั้งค่านโยบายการตรวจสอบ (audit policy) ของ Windows event log และเปรียบเทียบกับการตั้งค่าที่แนะนำจาก [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations), และ [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +`RuleCount` แสดงจำนวน [Sigma rules](https://github.com/SigmaHQ/sigma) ที่สามารถตรวจจับเหตุการณ์ภายในหมวดหมู่นั้นได้ + +### ตัวอย่างคำสั่ง `audit-settings` +ตรวจสอบด้วยการตั้งค่าที่แนะนำของ Yamato Security ซึ่งเป็นค่าเริ่มต้นและบันทึกผลลัพธ์เป็น CSV: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +ตรวจสอบด้วยการตั้งค่าที่แนะนำของ Australian Signals Directorate และบันทึกผลลัพธ์เป็น CSV: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +ตรวจสอบด้วยการตั้งค่า Server OS ที่แนะนำของ Microsoft และแสดงผลลัพธ์ใน GUI: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +ตรวจสอบด้วยการตั้งค่า Client OS ที่แนะนำของ Microsoft และแสดงผลลัพธ์ในรูปแบบตาราง: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +คำสั่ง `audit-filesize` จะตรวจสอบขนาดไฟล์ของ Windows event logs และเปรียบเทียบกับการตั้งค่าที่แนะนำจาก Yamato Security + +### ตัวอย่างคำสั่ง `audit-filesize` +ตรวจสอบขนาดไฟล์ Windows event log ด้วยคำแนะนำของ Yamato Security และบันทึกผลลัพธ์เป็น CSV: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +คำสั่ง `configure` จะตั้งค่านโยบายการตรวจสอบ (audit policy) ของ Windows event log และขนาดไฟล์ตามที่แนะนำ + +#### ตัวอย่างคำสั่ง `configure` +ใช้การตั้งค่าที่แนะนำของ Yamato Security (พร้อมข้อความยืนยันก่อนการเปลี่ยนแปลงการตั้งค่า): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +ใช้การตั้งค่าที่แนะนำของ Australian Signals Directorate โดยไม่มีข้อความยืนยัน: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### ตัวอย่างคำสั่ง `update-rules` +อัปเดตไฟล์ config ของ Sigma rules ของ WELA: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.tr.md b/website/docs/commands/usage.tr.md new file mode 100644 index 00000000..5f7827f9 --- /dev/null +++ b/website/docs/commands/usage.tr.md @@ -0,0 +1,55 @@ +# Komut Kullanımı +## audit-settings +`audit-settings` komutu, Windows olay günlüğü denetim ilkesi ayarlarını kontrol eder ve bunları [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) ve [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) tarafından önerilen ayarlarla karşılaştırır. +`RuleCount`, o kategorideki olayları tespit edebilen [Sigma kurallarının](https://github.com/SigmaHQ/sigma) sayısını gösterir. + +### `audit-settings` komut örnekleri +Varsayılan Yamato Security'nin önerilen ayarlarıyla kontrol edin ve sonuçları CSV'ye kaydedin: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Australian Signals Directorate'in önerilen ayarlarıyla kontrol edin ve sonuçları CSV'ye kaydedin: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Microsoft'un önerilen Sunucu OS ayarlarıyla kontrol edin ve sonuçları bir GUI'de görüntüleyin: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Microsoft'un önerilen İstemci OS ayarlarıyla kontrol edin ve sonuçları tablo biçiminde görüntüleyin: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +`audit-filesize` komutu, Windows olay günlüklerinin dosya boyutunu kontrol eder ve bunları Yamato Security'nin önerileriyle karşılaştırır. + +### `audit-filesize` komut örnekleri +Windows olay günlüğü dosya boyutunu Yamato Security'nin önerileriyle kontrol edin ve sonuçları CSV'ye kaydedin: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +`configure` komutu, önerilen Windows olay günlüğü denetim ilkesini ve dosya boyutunu ayarlar. + +#### `configure` komut örnekleri +Yamato Security'nin önerilen ayarlarını uygulayın (ayarları değiştirmeden önce onay istemiyle): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Australian Signals Directorate'in önerilen ayarlarını onay istemi olmadan uygulayın: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules` komut örnekleri +WELA'nın Sigma kuralları yapılandırma dosyalarını güncelleyin: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.uk.md b/website/docs/commands/usage.uk.md new file mode 100644 index 00000000..64760017 --- /dev/null +++ b/website/docs/commands/usage.uk.md @@ -0,0 +1,55 @@ +# Використання команд +## audit-settings +Команда `audit-settings` перевіряє налаштування політики аудиту журналу подій Windows та порівнює їх із рекомендованими налаштуваннями від [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) та [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +`RuleCount` вказує кількість [правил Sigma](https://github.com/SigmaHQ/sigma), які можуть виявляти події в межах цієї категорії. + +### приклади команди `audit-settings` +Перевірка зі стандартними рекомендованими налаштуваннями Yamato Security та збереження результатів у CSV: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Перевірка з рекомендованими налаштуваннями Australian Signals Directorate та збереження результатів у CSV: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Перевірка з рекомендованими налаштуваннями Microsoft для серверної ОС та відображення результатів у графічному інтерфейсі: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Перевірка з рекомендованими налаштуваннями Microsoft для клієнтської ОС та відображення результатів у форматі таблиці: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +Команда `audit-filesize` перевіряє розмір файлів журналів подій Windows та порівнює їх із рекомендованими налаштуваннями від Yamato Security. + +### приклади команди `audit-filesize` +Перевірка розміру файлу журналу подій Windows за рекомендаціями Yamato Security та збереження результатів у CSV: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +Команда `configure` встановлює рекомендовану політику аудиту журналу подій Windows та розмір файлу. + +#### приклади команди `configure` +Застосування рекомендованих налаштувань Yamato Security (з підтвердженням перед зміною налаштувань): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Застосування рекомендованих налаштувань Australian Signals Directorate без підтвердження: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### приклади команди `update-rules` +Оновлення конфігураційних файлів правил Sigma для WELA: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.zh-TW.md b/website/docs/commands/usage.zh-TW.md new file mode 100644 index 00000000..705ebe56 --- /dev/null +++ b/website/docs/commands/usage.zh-TW.md @@ -0,0 +1,55 @@ +# 指令使用方式 +## audit-settings +`audit-settings` 指令會檢查 Windows 事件日誌的稽核原則設定，並將其與 [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings)、[Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) 以及 [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) 的建議設定進行比較。 +`RuleCount` 表示能夠偵測該類別中事件的 [Sigma 規則](https://github.com/SigmaHQ/sigma)數量。 + +### `audit-settings` 指令範例 +使用預設的 Yamato Security 建議設定進行檢查，並將結果儲存為 CSV： +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +使用 Australian Signals Directorate 的建議設定進行檢查，並將結果儲存為 CSV： +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +使用 Microsoft 建議的 Server OS 設定進行檢查，並以 GUI 顯示結果： +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +使用 Microsoft 建議的 Client OS 設定進行檢查，並以表格格式顯示結果： +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +`audit-filesize` 指令會檢查 Windows 事件日誌的檔案大小，並將其與 Yamato Security 的建議設定進行比較。 + +### `audit-filesize` 指令範例 +使用 Yamato Security 的建議檢查 Windows 事件日誌檔案大小，並將結果儲存為 CSV： +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +`configure` 指令會設定建議的 Windows 事件日誌稽核原則與檔案大小。 + +#### `configure` 指令範例 +套用 Yamato Security 的建議設定（變更設定前會出現確認提示）： +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +套用 Australian Signals Directorate 的建議設定，且不出現確認提示： +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules` 指令範例 +更新 WELA 的 Sigma 規則設定檔： +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/getting-started/index.ar.md b/website/docs/getting-started/index.ar.md new file mode 100644 index 00000000..dae6d666 --- /dev/null +++ b/website/docs/getting-started/index.ar.md @@ -0,0 +1,14 @@ +# البدء + +## المتطلبات الأساسية +* Windows PowerShell 5.1 أو PowerShell Core +* تشغيل PowerShell بامتيازات المسؤول + +## التنزيلات + +يرجى تنزيل أحدث إصدار مستقر من WELA من صفحة [Releases](https://github.com/Yamato-Security/wela/releases). + +## تشغيل WELA +1. قم بفك ضغط [ملف الإصدار المضغوط](https://github.com/Yamato-Security/wela/releases). +2. افتح PowerShell بـ **امتيازات المسؤول**. +3. `./WELA.ps1 help` لتشغيل WELA ورؤية طريقة استخدام المساعدة. diff --git a/website/docs/getting-started/index.de.md b/website/docs/getting-started/index.de.md new file mode 100644 index 00000000..9ba13f5e --- /dev/null +++ b/website/docs/getting-started/index.de.md @@ -0,0 +1,14 @@ +# Erste Schritte + +## Voraussetzungen +* Windows PowerShell 5.1 oder PowerShell Core +* Ausführen von PowerShell mit Administratorrechten + +## Downloads + +Bitte laden Sie die neueste stabile Version von WELA von der Seite [Releases](https://github.com/Yamato-Security/wela/releases) herunter. + +## WELA ausführen +1. Entpacken Sie die [Release-ZIP-Datei](https://github.com/Yamato-Security/wela/releases). +2. Öffnen Sie PowerShell mit **Administratorrechten**. +3. `./WELA.ps1 help`, um WELA auszuführen und die Hilfe zur Verwendung anzuzeigen. diff --git a/website/docs/getting-started/index.es.md b/website/docs/getting-started/index.es.md new file mode 100644 index 00000000..9f9e788a --- /dev/null +++ b/website/docs/getting-started/index.es.md @@ -0,0 +1,14 @@ +# Primeros pasos + +## Requisitos previos +* Windows PowerShell 5.1 o PowerShell Core +* Ejecutar PowerShell con privilegios de administrador + +## Descargas + +Descargue la última versión estable de WELA desde la página de [Releases](https://github.com/Yamato-Security/wela/releases). + +## Ejecutar WELA +1. Descomprima el [archivo zip de la versión](https://github.com/Yamato-Security/wela/releases). +2. Abra PowerShell con **privilegios de administrador**. +3. `./WELA.ps1 help` para ejecutar WELA y ver el uso de la ayuda. diff --git a/website/docs/getting-started/index.fr.md b/website/docs/getting-started/index.fr.md new file mode 100644 index 00000000..06dea995 --- /dev/null +++ b/website/docs/getting-started/index.fr.md @@ -0,0 +1,14 @@ +# Pour commencer + +## Prérequis +* Windows PowerShell 5.1 ou PowerShell Core +* Exécuter PowerShell avec des privilèges d'administrateur + +## Téléchargements + +Veuillez télécharger la dernière version stable de WELA depuis la page [Releases](https://github.com/Yamato-Security/wela/releases). + +## Exécution de WELA +1. Décompressez le [fichier zip de la release](https://github.com/Yamato-Security/wela/releases). +2. Ouvrez PowerShell avec des **privilèges d'administrateur**. +3. `./WELA.ps1 help` pour exécuter WELA et afficher l'aide d'utilisation. diff --git a/website/docs/getting-started/index.hi.md b/website/docs/getting-started/index.hi.md new file mode 100644 index 00000000..3da385f2 --- /dev/null +++ b/website/docs/getting-started/index.hi.md @@ -0,0 +1,14 @@ +# शुरुआत करना + +## आवश्यक शर्तें +* Windows PowerShell 5.1 या PowerShell Core +* Administrator विशेषाधिकारों के साथ PowerShell चलाना + +## डाउनलोड + +कृपया WELA का नवीनतम स्थिर संस्करण [Releases](https://github.com/Yamato-Security/wela/releases) पृष्ठ से डाउनलोड करें। + +## WELA चलाना +1. [release zip file](https://github.com/Yamato-Security/wela/releases) को अनज़िप करें। +2. **Administrator विशेषाधिकारों** के साथ PowerShell खोलें। +3. WELA चलाने और सहायता उपयोग देखने के लिए `./WELA.ps1 help`। diff --git a/website/docs/getting-started/index.id.md b/website/docs/getting-started/index.id.md new file mode 100644 index 00000000..c3ae9f79 --- /dev/null +++ b/website/docs/getting-started/index.id.md @@ -0,0 +1,14 @@ +# Memulai + +## Prasyarat +* Windows PowerShell 5.1 atau PowerShell Core +* Menjalankan PowerShell dengan hak istimewa Administrator + +## Unduhan + +Silakan unduh versi stabil terbaru WELA dari halaman [Releases](https://github.com/Yamato-Security/wela/releases). + +## Menjalankan WELA +1. Ekstrak [berkas zip rilis](https://github.com/Yamato-Security/wela/releases). +2. Buka PowerShell dengan **hak istimewa Administrator**. +3. `./WELA.ps1 help` untuk menjalankan WELA dan melihat petunjuk penggunaan bantuan. diff --git a/website/docs/getting-started/index.ko.md b/website/docs/getting-started/index.ko.md new file mode 100644 index 00000000..37a69c48 --- /dev/null +++ b/website/docs/getting-started/index.ko.md @@ -0,0 +1,14 @@ +# 시작하기 + +## 사전 요구 사항 +* Windows PowerShell 5.1 또는 PowerShell Core +* 관리자 권한으로 PowerShell 실행 + +## 다운로드 + +[Releases](https://github.com/Yamato-Security/wela/releases) 페이지에서 최신 안정 버전의 WELA를 다운로드하십시오. + +## WELA 실행 +1. [릴리스 zip 파일](https://github.com/Yamato-Security/wela/releases)의 압축을 해제합니다. +2. **관리자 권한**으로 PowerShell을 엽니다. +3. `./WELA.ps1 help`를 실행하여 WELA를 실행하고 도움말 사용법을 확인합니다. diff --git a/website/docs/getting-started/index.my.md b/website/docs/getting-started/index.my.md new file mode 100644 index 00000000..eeae4cf0 --- /dev/null +++ b/website/docs/getting-started/index.my.md @@ -0,0 +1,14 @@ +# စတင်ခြင်း + +## ကြိုတင်လိုအပ်ချက်များ +* Windows PowerShell 5.1 သို့မဟုတ် PowerShell Core +* Administrator အခွင့်အရေးများဖြင့် PowerShell ကို လုပ်ဆောင်ခြင်း + +## ဒေါင်းလုဒ်များ + +WELA ၏ နောက်ဆုံးထွက် တည်ငြိမ်သော ဗားရှင်းကို [Releases](https://github.com/Yamato-Security/wela/releases) စာမျက်နှာမှ ဒေါင်းလုဒ်ဆွဲပါ။ + +## WELA ကို လုပ်ဆောင်ခြင်း +1. [release zip file](https://github.com/Yamato-Security/wela/releases) ကို unzip ဖြည်ပါ။ +2. **Administrator အခွင့်အရေးများ** ဖြင့် PowerShell ကို ဖွင့်ပါ။ +3. WELA ကို လုပ်ဆောင်ပြီး help အသုံးပြုနည်းကို ကြည့်ရန် `./WELA.ps1 help` ဟု ရိုက်ထည့်ပါ။ diff --git a/website/docs/getting-started/index.pt-BR.md b/website/docs/getting-started/index.pt-BR.md new file mode 100644 index 00000000..ba30ae50 --- /dev/null +++ b/website/docs/getting-started/index.pt-BR.md @@ -0,0 +1,14 @@ +# Primeiros Passos + +## Pré-requisitos +* Windows PowerShell 5.1 ou PowerShell Core +* Executar o PowerShell com privilégios de Administrador + +## Downloads + +Faça o download da versão estável mais recente do WELA na página de [Releases](https://github.com/Yamato-Security/wela/releases). + +## Executando o WELA +1. Descompacte o [arquivo zip da release](https://github.com/Yamato-Security/wela/releases). +2. Abra o PowerShell com **privilégios de Administrador**. +3. `./WELA.ps1 help` para executar o WELA e ver as instruções de uso da ajuda. diff --git a/website/docs/getting-started/index.th.md b/website/docs/getting-started/index.th.md new file mode 100644 index 00000000..74955faf --- /dev/null +++ b/website/docs/getting-started/index.th.md @@ -0,0 +1,14 @@ +# การเริ่มต้นใช้งาน + +## ข้อกำหนดเบื้องต้น +* Windows PowerShell 5.1 หรือ PowerShell Core +* การเรียกใช้ PowerShell ด้วยสิทธิ์ของผู้ดูแลระบบ + +## การดาวน์โหลด + +โปรดดาวน์โหลด WELA เวอร์ชันเสถียรล่าสุดจากหน้า [Releases](https://github.com/Yamato-Security/wela/releases) + +## การเรียกใช้ WELA +1. แตกไฟล์ [release zip file](https://github.com/Yamato-Security/wela/releases) +2. เปิด PowerShell ด้วย **สิทธิ์ของผู้ดูแลระบบ** +3. `./WELA.ps1 help` เพื่อเรียกใช้ WELA และดูวิธีการใช้งานความช่วยเหลือ diff --git a/website/docs/getting-started/index.tr.md b/website/docs/getting-started/index.tr.md new file mode 100644 index 00000000..a4de1480 --- /dev/null +++ b/website/docs/getting-started/index.tr.md @@ -0,0 +1,14 @@ +# Başlarken + +## Ön Gereksinimler +* Windows PowerShell 5.1 veya PowerShell Core +* PowerShell'in Yönetici ayrıcalıklarıyla çalıştırılması + +## İndirmeler + +Lütfen WELA'nın en son kararlı sürümünü [Releases](https://github.com/Yamato-Security/wela/releases) sayfasından indirin. + +## WELA'yı Çalıştırma +1. [release zip dosyasını](https://github.com/Yamato-Security/wela/releases) çıkarın. +2. PowerShell'i **Yönetici ayrıcalıklarıyla** açın. +3. WELA'yı çalıştırmak ve yardım kullanımını görmek için `./WELA.ps1 help`. diff --git a/website/docs/getting-started/index.uk.md b/website/docs/getting-started/index.uk.md new file mode 100644 index 00000000..95b84d70 --- /dev/null +++ b/website/docs/getting-started/index.uk.md @@ -0,0 +1,14 @@ +# Початок роботи + +## Передумови +* Windows PowerShell 5.1 або PowerShell Core +* Запуск PowerShell з правами адміністратора + +## Завантаження + +Будь ласка, завантажте останню стабільну версію WELA зі сторінки [Releases](https://github.com/Yamato-Security/wela/releases). + +## Запуск WELA +1. Розпакуйте [release zip file](https://github.com/Yamato-Security/wela/releases). +2. Відкрийте PowerShell з **правами адміністратора**. +3. `./WELA.ps1 help`, щоб запустити WELA та переглянути довідку з використання. diff --git a/website/docs/getting-started/index.zh-TW.md b/website/docs/getting-started/index.zh-TW.md new file mode 100644 index 00000000..fcedbfa5 --- /dev/null +++ b/website/docs/getting-started/index.zh-TW.md @@ -0,0 +1,14 @@ +# 開始使用 + +## 先決條件 +* Windows PowerShell 5.1 或 PowerShell Core +* 以系統管理員權限執行 PowerShell + +## 下載 + +請從 [Releases](https://github.com/Yamato-Security/wela/releases) 頁面下載最新的穩定版 WELA。 + +## 執行 WELA +1. 解壓縮 [release zip 檔案](https://github.com/Yamato-Security/wela/releases)。 +2. 以**系統管理員權限**開啟 PowerShell。 +3. 執行 `./WELA.ps1 help` 來啟動 WELA 並檢視說明用法。 diff --git a/website/docs/index.ar.md b/website/docs/index.ar.md new file mode 100644 index 00000000..e726c048 --- /dev/null +++ b/website/docs/index.ar.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅)، الذي أنشأته +Yamato Security، هو أداة +لتدقيق إعدادات سجل أحداث Windows. تُعد سجلات أحداث Windows مصدرًا حيويًا +للمعلومات في DFIR — يساعدك WELA على التأكد من أنك تسجل بالفعل الأحداث المهمة. +

+ +
+[ابدأ الآن :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[مرجع الأوامر :material-console:](commands/index.md){ .md-button } +[عرض على GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## لماذا WELA؟ + +
+ +- :material-clipboard-check:{ .lg .middle } __تدقيق إعدادات سياسة السجل__ + + --- + + دقّق **إعدادات سياسة التدقيق** الخاصة بسجل أحداث Windows للتأكد من تسجيل الأحداث الصحيحة. + +- :material-book-check:{ .lg .middle } __مبني على الإرشادات__ + + --- + + يتحقق مقابل **إرشادات تكوين تدقيق سجل أحداث Windows الرئيسية**. + +- :material-shield-search:{ .lg .middle } __قابلية الاكتشاف بواسطة Sigma__ + + --- + + يقيّم إعداداتك مقابل **قابلية الاكتشاف الواقعية لقواعد Sigma** — هل ستلتقط سجلاتك الهجمات فعليًا؟ + +- :material-file-cog:{ .lg .middle } __تدقيق حجم الملف__ + + --- + + يدقق **أحجام ملفات** سجل أحداث Windows ويقترح الأحجام الموصى بها. + +- :material-cog-play:{ .lg .middle } __التكوين التلقائي__ + + --- + + طبّق سياسة التدقيق وأحجام ملفات السجل **الموصى بها** باستخدام أمر `configure`. + +- :material-chart-box:{ .lg .middle } __مخرجات مرنة__ + + --- + + اعرض النتائج في الطرفية، أو واجهة رسومية، أو جدول، أو كخريطة حرارية لـ **MITRE ATT&CK Navigator**. + +
+ +## روابط سريعة + +
+ +- __:material-book-open-variant: جديد هنا؟__ + + ابدأ بـ [نظرة عامة](overview/index.md)، ثم توجه إلى + [البدء](getting-started/index.md) لتثبيت WELA وتشغيله. + +- __:material-console-line: تعمل مع واجهة سطر الأوامر؟__ + + تصفّح [قائمة الأوامر](commands/index.md) ومرجع [استخدام الأوامر](commands/usage.md) + (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: تريد المزيد؟__ + + استكشف [المشاريع المصاحبة](resources/companion-projects.md)، و + [سجل التغييرات](resources/changelog.md)، وكيفية + [المساهمة](resources/contributing.md). + +
diff --git a/website/docs/index.de.md b/website/docs/index.de.md new file mode 100644 index 00000000..fa0b705f --- /dev/null +++ b/website/docs/index.de.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅), erstellt von +Yamato Security, ist ein Werkzeug zum +Überprüfen von Windows-Ereignisprotokolleinstellungen. Windows-Ereignisprotokolle sind eine entscheidende Informationsquelle +für DFIR — WELA hilft Ihnen sicherzustellen, dass Sie tatsächlich die Ereignisse aufzeichnen, die wichtig sind. +

+ +
+[Erste Schritte :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Befehlsreferenz :material-console:](commands/index.md){ .md-button } +[Auf GitHub ansehen :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## Warum WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __Überwachungsrichtlinieneinstellungen prüfen__ + + --- + + Überprüfen Sie die **Überwachungsrichtlinieneinstellungen** Ihrer Windows-Ereignisprotokolle, um zu bestätigen, dass die richtigen Ereignisse protokolliert werden. + +- :material-book-check:{ .lg .middle } __Auf Richtlinien basierend__ + + --- + + Prüft anhand der **wichtigsten Konfigurationsrichtlinien für die Überwachung von Windows-Ereignisprotokollen**. + +- :material-shield-search:{ .lg .middle } __Sigma-Erkennbarkeit__ + + --- + + Bewertet Ihre Einstellungen anhand der **realen Erkennbarkeit durch Sigma-Regeln** — werden Ihre Protokolle Angriffe tatsächlich erfassen? + +- :material-file-cog:{ .lg .middle } __Dateigrößenprüfung__ + + --- + + Prüft die **Dateigrößen** von Windows-Ereignisprotokollen und schlägt empfohlene Größen vor. + +- :material-cog-play:{ .lg .middle } __Automatische Konfiguration__ + + --- + + Wenden Sie die **empfohlene** Überwachungsrichtlinie und Protokolldateigrößen mit dem Befehl `configure` an. + +- :material-chart-box:{ .lg .middle } __Flexible Ausgabe__ + + --- + + Sehen Sie sich die Ergebnisse im Terminal, in einer GUI, in einer Tabelle oder als **MITRE ATT&CK Navigator**-Heatmap an. + +
+ +## Schnelllinks + +
+ +- __:material-book-open-variant: Neu hier?__ + + Beginnen Sie mit der [Übersicht](overview/index.md) und gehen Sie dann zu den + [Ersten Schritten](getting-started/index.md), um WELA zu installieren und auszuführen. + +- __:material-console-line: Arbeiten Sie mit der CLI?__ + + Durchsuchen Sie die [Befehlsliste](commands/index.md) und die Referenz zur [Befehlsverwendung](commands/usage.md) + (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: Gehen Sie weiter?__ + + Erkunden Sie die [Begleitprojekte](resources/companion-projects.md), das + [Änderungsprotokoll](resources/changelog.md) und wie Sie + [beitragen](resources/contributing.md) können. + +
diff --git a/website/docs/index.es.md b/website/docs/index.es.md new file mode 100644 index 00000000..e7238874 --- /dev/null +++ b/website/docs/index.es.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅), creado por +Yamato Security, es una herramienta para +auditar la configuración de los registros de eventos de Windows. Los registros de eventos de Windows son una fuente vital de +información para DFIR — WELA te ayuda a asegurarte de que realmente estás registrando los eventos que importan. +

+ +
+[Comenzar :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Referencia de comandos :material-console:](commands/index.md){ .md-button } +[Ver en GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## ¿Por qué WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __Auditar la configuración de la política de registro__ + + --- + + Audita la **configuración de la política de auditoría** de los registros de eventos de Windows para confirmar que se están registrando los eventos correctos. + +- :material-book-check:{ .lg .middle } __Basado en directrices__ + + --- + + Comprueba según las **principales directrices de configuración de auditoría de los registros de eventos de Windows**. + +- :material-shield-search:{ .lg .middle } __Detectabilidad de Sigma__ + + --- + + Evalúa tu configuración frente a la **detectabilidad de reglas Sigma del mundo real** — ¿tus registros realmente detectarán los ataques? + +- :material-file-cog:{ .lg .middle } __Auditoría del tamaño de archivos__ + + --- + + Audita los **tamaños de archivo** de los registros de eventos de Windows y sugiere tamaños recomendados. + +- :material-cog-play:{ .lg .middle } __Configuración automática__ + + --- + + Aplica la política de auditoría **recomendada** y los tamaños de archivo de registro con el comando `configure`. + +- :material-chart-box:{ .lg .middle } __Salida flexible__ + + --- + + Visualiza los resultados en la terminal, una GUI, una tabla o como un mapa de calor de **MITRE ATT&CK Navigator**. + +
+ +## Enlaces rápidos + +
+ +- __:material-book-open-variant: ¿Nuevo aquí?__ + + Comienza con la [Descripción general](overview/index.md), luego dirígete a + [Primeros pasos](getting-started/index.md) para instalar y ejecutar WELA. + +- __:material-console-line: ¿Trabajando con la CLI?__ + + Explora la [Lista de comandos](commands/index.md) y la referencia de [Uso de comandos](commands/usage.md) + (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: ¿Quieres ir más allá?__ + + Explora los [Proyectos complementarios](resources/companion-projects.md), el + [Registro de cambios](resources/changelog.md), y cómo + [contribuir](resources/contributing.md). + +
diff --git a/website/docs/index.fr.md b/website/docs/index.fr.md new file mode 100644 index 00000000..ed20d304 --- /dev/null +++ b/website/docs/index.fr.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅), créé par +Yamato Security, est un outil pour +auditer les paramètres des journaux d'événements Windows. Les journaux d'événements Windows sont une source d'informations essentielle +pour le DFIR — WELA vous aide à vous assurer que vous enregistrez réellement les événements qui comptent. +

+ +
+[Commencer :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Référence des commandes :material-console:](commands/index.md){ .md-button } +[Voir sur GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## Pourquoi WELA ? + +
+ +- :material-clipboard-check:{ .lg .middle } __Auditer les paramètres de la stratégie des journaux__ + + --- + + Auditez les **paramètres de la stratégie d'audit** de vos journaux d'événements Windows pour confirmer que les bons événements sont journalisés. + +- :material-book-check:{ .lg .middle } __Basé sur des recommandations__ + + --- + + Vérifie par rapport aux **principales recommandations de configuration d'audit des journaux d'événements Windows**. + +- :material-shield-search:{ .lg .middle } __Détectabilité Sigma__ + + --- + + Évalue vos paramètres par rapport à la **détectabilité réelle des règles Sigma** — vos journaux détecteront-ils réellement les attaques ? + +- :material-file-cog:{ .lg .middle } __Audit de la taille des fichiers__ + + --- + + Audite la **taille des fichiers** des journaux d'événements Windows et suggère des tailles recommandées. + +- :material-cog-play:{ .lg .middle } __Configuration automatique__ + + --- + + Appliquez la stratégie d'audit **recommandée** et les tailles des fichiers journaux avec la commande `configure`. + +- :material-chart-box:{ .lg .middle } __Sortie flexible__ + + --- + + Consultez les résultats dans le terminal, une interface graphique, un tableau, ou sous forme de carte de chaleur **MITRE ATT&CK Navigator**. + +
+ +## Liens rapides + +
+ +- __:material-book-open-variant: Vous débutez ?__ + + Commencez par l'[Aperçu](overview/index.md), puis dirigez-vous vers + [Premiers pas](getting-started/index.md) pour installer et exécuter WELA. + +- __:material-console-line: Vous travaillez avec la CLI ?__ + + Parcourez la [Liste des commandes](commands/index.md) et la référence d'[Utilisation des commandes](commands/usage.md) + (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: Aller plus loin ?__ + + Explorez les [Projets compagnons](resources/companion-projects.md), le + [Journal des modifications](resources/changelog.md), et comment + [contribuer](resources/contributing.md). + +
diff --git a/website/docs/index.hi.md b/website/docs/index.hi.md new file mode 100644 index 00000000..4fe07e2c --- /dev/null +++ b/website/docs/index.hi.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅), जिसे +Yamato Security द्वारा बनाया गया है, एक उपकरण है +Windows इवेंट लॉग सेटिंग्स के ऑडिट के लिए। Windows इवेंट लॉग DFIR के लिए जानकारी का +एक महत्वपूर्ण स्रोत हैं — WELA आपको यह सुनिश्चित करने में मदद करता है कि आप वास्तव में उन घटनाओं को रिकॉर्ड कर रहे हैं जो मायने रखती हैं। +

+ +
+[शुरू करें :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[कमांड संदर्भ :material-console:](commands/index.md){ .md-button } +[GitHub पर देखें :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## WELA क्यों? + +
+ +- :material-clipboard-check:{ .lg .middle } __ऑडिट लॉग पॉलिसी सेटिंग्स__ + + --- + + अपनी Windows इवेंट लॉग **ऑडिट पॉलिसी सेटिंग्स** का ऑडिट करें ताकि यह पुष्टि हो सके कि सही घटनाएं लॉग की जा रही हैं। + +- :material-book-check:{ .lg .middle } __दिशानिर्देशों पर आधारित__ + + --- + + **प्रमुख Windows इवेंट लॉग ऑडिट कॉन्फ़िगरेशन दिशानिर्देशों** के विरुद्ध जांच करता है। + +- :material-shield-search:{ .lg .middle } __Sigma पहचान क्षमता__ + + --- + + आपकी सेटिंग्स का **वास्तविक दुनिया की Sigma नियम पहचान क्षमता** के विरुद्ध मूल्यांकन करता है — क्या आपके लॉग वास्तव में हमलों को पकड़ पाएंगे? + +- :material-file-cog:{ .lg .middle } __फ़ाइल-आकार ऑडिटिंग__ + + --- + + Windows इवेंट लॉग **फ़ाइल आकारों** का ऑडिट करता है और अनुशंसित आकार सुझाता है। + +- :material-cog-play:{ .lg .middle } __स्वतः-कॉन्फ़िगर__ + + --- + + `configure` कमांड के साथ **अनुशंसित** ऑडिट पॉलिसी और लॉग फ़ाइल आकार लागू करें। + +- :material-chart-box:{ .lg .middle } __लचीला आउटपुट__ + + --- + + परिणामों को टर्मिनल, GUI, टेबल, या **MITRE ATT&CK Navigator** हीटमैप के रूप में देखें। + +
+ +## त्वरित लिंक + +
+ +- __:material-book-open-variant: यहां नए हैं?__ + + [Overview](overview/index.md) से शुरू करें, फिर WELA इंस्टॉल और चलाने के लिए + [Getting Started](getting-started/index.md) पर जाएं। + +- __:material-console-line: CLI के साथ काम कर रहे हैं?__ + + [Command List](commands/index.md) और [Command Usage](commands/usage.md) + संदर्भ ब्राउज़ करें (`audit-settings`, `audit-filesize`, `configure`, `update-rules`)। + +- __:material-puzzle: आगे बढ़ रहे हैं?__ + + [Companion Projects](resources/companion-projects.md), + [Changelog](resources/changelog.md), और + [योगदान](resources/contributing.md) कैसे करें, इसका अन्वेषण करें। + +
diff --git a/website/docs/index.id.md b/website/docs/index.id.md new file mode 100644 index 00000000..e55acc0b --- /dev/null +++ b/website/docs/index.id.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅), dibuat oleh +Yamato Security, adalah alat untuk +mengaudit pengaturan log peristiwa Windows. Log peristiwa Windows merupakan sumber +informasi yang vital bagi DFIR — WELA membantu Anda memastikan bahwa Anda benar-benar merekam peristiwa yang penting. +

+ +
+[Mulai :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Referensi Perintah :material-console:](commands/index.md){ .md-button } +[Lihat di GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## Mengapa WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __Audit pengaturan kebijakan log__ + + --- + + Audit **pengaturan kebijakan audit** log peristiwa Windows Anda untuk memastikan peristiwa yang tepat sedang dicatat. + +- :material-book-check:{ .lg .middle } __Berdasarkan pedoman__ + + --- + + Memeriksa terhadap **pedoman konfigurasi audit log peristiwa Windows yang utama**. + +- :material-shield-search:{ .lg .middle } __Keterdeteksian Sigma__ + + --- + + Mengevaluasi pengaturan Anda terhadap **keterdeteksian aturan Sigma di dunia nyata** — apakah log Anda benar-benar akan menangkap serangan? + +- :material-file-cog:{ .lg .middle } __Audit ukuran file__ + + --- + + Mengaudit **ukuran file** log peristiwa Windows dan menyarankan ukuran yang direkomendasikan. + +- :material-cog-play:{ .lg .middle } __Konfigurasi otomatis__ + + --- + + Terapkan kebijakan audit dan ukuran file log yang **direkomendasikan** dengan perintah `configure`. + +- :material-chart-box:{ .lg .middle } __Keluaran fleksibel__ + + --- + + Lihat hasil di terminal, GUI, tabel, atau sebagai peta panas **MITRE ATT&CK Navigator**. + +
+ +## Tautan cepat + +
+ +- __:material-book-open-variant: Baru di sini?__ + + Mulai dengan [Ikhtisar](overview/index.md), lalu lanjut ke + [Memulai](getting-started/index.md) untuk memasang dan menjalankan WELA. + +- __:material-console-line: Bekerja dengan CLI?__ + + Telusuri [Daftar Perintah](commands/index.md) dan referensi [Penggunaan Perintah](commands/usage.md) + (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: Ingin lebih jauh?__ + + Jelajahi [Proyek Pendamping](resources/companion-projects.md), + [Changelog](resources/changelog.md), dan cara + [berkontribusi](resources/contributing.md). + +
diff --git a/website/docs/index.ko.md b/website/docs/index.ko.md new file mode 100644 index 00000000..926eb100 --- /dev/null +++ b/website/docs/index.ko.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+Yamato Security가 만든 +WELA (Windows Event Log Analyzer, ゑ羅)는 +Windows 이벤트 로그 설정을 감사하기 위한 도구입니다. Windows 이벤트 로그는 DFIR에 필수적인 +정보 출처이며 — WELA는 여러분이 중요한 이벤트를 실제로 기록하고 있는지 확인하도록 도와줍니다. +

+ +
+[시작하기 :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[명령어 레퍼런스 :material-console:](commands/index.md){ .md-button } +[GitHub에서 보기 :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## 왜 WELA인가? + +
+ +- :material-clipboard-check:{ .lg .middle } __감사 로그 정책 설정__ + + --- + + 올바른 이벤트가 기록되고 있는지 확인하기 위해 Windows 이벤트 로그 **감사 정책 설정**을 감사합니다. + +- :material-book-check:{ .lg .middle } __가이드라인 기반__ + + --- + + **주요 Windows 이벤트 로그 감사 구성 가이드라인**을 기준으로 점검합니다. + +- :material-shield-search:{ .lg .middle } __Sigma 탐지 가능성__ + + --- + + **실제 환경의 Sigma 규칙 탐지 가능성**을 기준으로 설정을 평가합니다 — 여러분의 로그가 실제로 공격을 잡아낼 수 있을까요? + +- :material-file-cog:{ .lg .middle } __파일 크기 감사__ + + --- + + Windows 이벤트 로그 **파일 크기**를 감사하고 권장 크기를 제안합니다. + +- :material-cog-play:{ .lg .middle } __자동 구성__ + + --- + + `configure` 명령어로 **권장** 감사 정책과 로그 파일 크기를 적용합니다. + +- :material-chart-box:{ .lg .middle } __유연한 출력__ + + --- + + 결과를 터미널, GUI, 표, 또는 **MITRE ATT&CK Navigator** 히트맵으로 확인합니다. + +
+ +## 빠른 링크 + +
+ +- __:material-book-open-variant: 처음이신가요?__ + + [개요](overview/index.md)로 시작한 다음, + [시작하기](getting-started/index.md)로 이동하여 WELA를 설치하고 실행하세요. + +- __:material-console-line: CLI로 작업 중이신가요?__ + + [명령어 목록](commands/index.md)과 [명령어 사용법](commands/usage.md) + 레퍼런스(`audit-settings`, `audit-filesize`, `configure`, `update-rules`)를 살펴보세요. + +- __:material-puzzle: 더 깊이 알아보시려나요?__ + + [관련 프로젝트](resources/companion-projects.md), + [변경 이력](resources/changelog.md), 그리고 + [기여하기](resources/contributing.md) 방법을 살펴보세요. + +
diff --git a/website/docs/index.my.md b/website/docs/index.my.md new file mode 100644 index 00000000..11539972 --- /dev/null +++ b/website/docs/index.my.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅) ကို +Yamato Security မှ ဖန်တီးထားပြီး၊ ၎င်းသည် +Windows event log ဆက်တင်များကို စစ်ဆေးအတည်ပြုခြင်း အတွက် ကိရိယာတစ်ခုဖြစ်သည်။ Windows event log များသည် DFIR အတွက် အရေးကြီးသော +သတင်းအချက်အလက် ရင်းမြစ်တစ်ခုဖြစ်ပြီး — WELA သည် အရေးပါသော အဖြစ်အပျက်များကို သင်အမှန်တကယ် မှတ်တမ်းတင်နေကြောင်း သေချာစေရန် ကူညီပေးသည်။ +

+ +
+[စတင်အသုံးပြုရန် :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Command အကိုးအကား :material-console:](commands/index.md){ .md-button } +[GitHub တွင်ကြည့်ရှုရန် :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## WELA ကို ဘာကြောင့်ရွေးချယ်သင့်သနည်း။ + +
+ +- :material-clipboard-check:{ .lg .middle } __Log policy ဆက်တင်များကို စစ်ဆေးခြင်း__ + + --- + + မှန်ကန်သော အဖြစ်အပျက်များကို မှတ်တမ်းတင်နေကြောင်း အတည်ပြုရန် သင်၏ Windows event log **audit policy ဆက်တင်များ** ကို စစ်ဆေးပါ။ + +- :material-book-check:{ .lg .middle } __လမ်းညွှန်ချက်များအပေါ် အခြေခံထားသည်__ + + --- + + **အဓိက Windows event log audit configuration လမ်းညွှန်ချက်များ** နှင့်ညှိနှိုင်း၍ စစ်ဆေးပေးသည်။ + +- :material-shield-search:{ .lg .middle } __Sigma ဖြင့် ထောက်လှမ်းနိုင်စွမ်း__ + + --- + + သင်၏ ဆက်တင်များကို **လက်တွေ့ကမ္ဘာ Sigma rule ထောက်လှမ်းနိုင်စွမ်း** နှင့်ညှိနှိုင်း၍ အကဲဖြတ်ပေးသည် — သင်၏ log များသည် တိုက်ခိုက်မှုများကို အမှန်တကယ် ဖမ်းမိနိုင်ပါမည်လား။ + +- :material-file-cog:{ .lg .middle } __ဖိုင်အရွယ်အစား စစ်ဆေးခြင်း__ + + --- + + Windows event log **ဖိုင်အရွယ်အစားများ** ကို စစ်ဆေးပြီး အကြံပြုထားသော အရွယ်အစားများကို အကြံပြုပေးသည်။ + +- :material-cog-play:{ .lg .middle } __အလိုအလျောက် configure ပြုလုပ်ခြင်း__ + + --- + + **အကြံပြုထားသော** audit policy နှင့် log ဖိုင်အရွယ်အစားများကို `configure` command ဖြင့် အသုံးပြုပါ။ + +- :material-chart-box:{ .lg .middle } __ပြောင်းလွယ်ပြင်လွယ် output__ + + --- + + ရလဒ်များကို terminal၊ GUI၊ table တွင် သို့မဟုတ် **MITRE ATT&CK Navigator** heatmap အဖြစ် ကြည့်ရှုပါ။ + +
+ +## အမြန်လင့်ခ်များ + +
+ +- __:material-book-open-variant: ဤနေရာတွင် အသစ်လား။__ + + [Overview](overview/index.md) ဖြင့် စတင်ပြီးနောက် WELA ကို install ပြုလုပ်၍ run ရန် + [Getting Started](getting-started/index.md) သို့ ဆက်သွားပါ။ + +- __:material-console-line: CLI ဖြင့် အလုပ်လုပ်နေပါသလား။__ + + [Command List](commands/index.md) နှင့် [Command Usage](commands/usage.md) + အကိုးအကား (`audit-settings`, `audit-filesize`, `configure`, `update-rules`) ကို လှော်လှန်ကြည့်ပါ။ + +- __:material-puzzle: ပိုမိုဆက်လက်လေ့လာမည်လား။__ + + [Companion Projects](resources/companion-projects.md)၊ + [Changelog](resources/changelog.md) နှင့် + [contribute](resources/contributing.md) ပြုလုပ်နည်းကို လေ့လာပါ။ + +
diff --git a/website/docs/index.pt-BR.md b/website/docs/index.pt-BR.md new file mode 100644 index 00000000..376e8a48 --- /dev/null +++ b/website/docs/index.pt-BR.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+O WELA (Windows Event Log Analyzer, ゑ羅), criado pela +Yamato Security, é uma ferramenta para +auditar as configurações de log de eventos do Windows. Os logs de eventos do Windows são uma fonte vital de +informações para DFIR — o WELA ajuda você a garantir que está de fato registrando os eventos que importam. +

+ +
+[Começar :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Referência de Comandos :material-console:](commands/index.md){ .md-button } +[Ver no GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## Por que WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __Auditar configurações de política de log__ + + --- + + Audite as **configurações de política de auditoria** do log de eventos do Windows para confirmar que os eventos certos estão sendo registrados. + +- :material-book-check:{ .lg .middle } __Baseado em diretrizes__ + + --- + + Verifica em relação às **principais diretrizes de configuração de auditoria de log de eventos do Windows**. + +- :material-shield-search:{ .lg .middle } __Detectabilidade do Sigma__ + + --- + + Avalia suas configurações em relação à **detectabilidade real de regras Sigma** — seus logs realmente vão capturar ataques? + +- :material-file-cog:{ .lg .middle } __Auditoria de tamanho de arquivo__ + + --- + + Audita os **tamanhos de arquivo** do log de eventos do Windows e sugere tamanhos recomendados. + +- :material-cog-play:{ .lg .middle } __Configuração automática__ + + --- + + Aplique a política de auditoria e os tamanhos de arquivo de log **recomendados** com o comando `configure`. + +- :material-chart-box:{ .lg .middle } __Saída flexível__ + + --- + + Veja os resultados no terminal, em uma GUI, em uma tabela ou como um mapa de calor do **MITRE ATT&CK Navigator**. + +
+ +## Links rápidos + +
+ +- __:material-book-open-variant: Novo por aqui?__ + + Comece pela [Visão geral](overview/index.md) e, em seguida, vá para + [Primeiros passos](getting-started/index.md) para instalar e executar o WELA. + +- __:material-console-line: Trabalhando com a CLI?__ + + Navegue pela [Lista de Comandos](commands/index.md) e pela referência de + [Uso dos Comandos](commands/usage.md) (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: Indo mais além?__ + + Explore os [Projetos Complementares](resources/companion-projects.md), o + [Changelog](resources/changelog.md) e como + [contribuir](resources/contributing.md). + +
diff --git a/website/docs/index.th.md b/website/docs/index.th.md new file mode 100644 index 00000000..6504b082 --- /dev/null +++ b/website/docs/index.th.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅) สร้างโดย +Yamato Security เป็นเครื่องมือสำหรับ +ตรวจสอบการตั้งค่า Windows event log Windows event log เป็นแหล่ง +ข้อมูลที่สำคัญสำหรับ DFIR — WELA ช่วยให้คุณมั่นใจได้ว่าคุณกำลังบันทึกเหตุการณ์ที่มีความสำคัญอย่างแท้จริง +

+ +
+[เริ่มต้นใช้งาน :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[คู่มืออ้างอิงคำสั่ง :material-console:](commands/index.md){ .md-button } +[ดูบน GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## ทำไมต้อง WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __ตรวจสอบการตั้งค่านโยบายการบันทึก log__ + + --- + + ตรวจสอบ **การตั้งค่านโยบายการตรวจสอบ (audit policy)** ของ Windows event log เพื่อยืนยันว่ามีการบันทึกเหตุการณ์ที่ถูกต้อง + +- :material-book-check:{ .lg .middle } __อ้างอิงตามแนวทางมาตรฐาน__ + + --- + + ตรวจสอบเทียบกับ **แนวทางการกำหนดค่าการตรวจสอบ Windows event log หลัก ๆ** + +- :material-shield-search:{ .lg .middle } __ความสามารถในการตรวจจับของ Sigma__ + + --- + + ประเมินการตั้งค่าของคุณเทียบกับ **ความสามารถในการตรวจจับด้วยกฎ Sigma ในสถานการณ์จริง** — log ของคุณจะจับการโจมตีได้จริงหรือไม่? + +- :material-file-cog:{ .lg .middle } __ตรวจสอบขนาดไฟล์__ + + --- + + ตรวจสอบ **ขนาดไฟล์** ของ Windows event log และแนะนำขนาดที่เหมาะสม + +- :material-cog-play:{ .lg .middle } __กำหนดค่าอัตโนมัติ__ + + --- + + นำ **นโยบายการตรวจสอบและขนาดไฟล์ log ที่แนะนำ** ไปใช้ด้วยคำสั่ง `configure` + +- :material-chart-box:{ .lg .middle } __ผลลัพธ์ที่ยืดหยุ่น__ + + --- + + ดูผลลัพธ์ในเทอร์มินัล, GUI, ตาราง หรือในรูปแบบ heatmap ของ **MITRE ATT&CK Navigator** + +
+ +## ลิงก์ด่วน + +
+ +- __:material-book-open-variant: เพิ่งเริ่มต้นใช้งาน?__ + + เริ่มจาก [ภาพรวม](overview/index.md) จากนั้นไปที่ + [การเริ่มต้นใช้งาน](getting-started/index.md) เพื่อติดตั้งและรัน WELA + +- __:material-console-line: กำลังใช้งานผ่าน CLI?__ + + เรียกดู [รายการคำสั่ง](commands/index.md) และคู่มืออ้างอิง [การใช้งานคำสั่ง](commands/usage.md) + (`audit-settings`, `audit-filesize`, `configure`, `update-rules`) + +- __:material-puzzle: ต้องการเรียนรู้เพิ่มเติม?__ + + สำรวจ [โปรเจกต์ที่เกี่ยวข้อง](resources/companion-projects.md), + [บันทึกการเปลี่ยนแปลง](resources/changelog.md) และวิธีการ + [มีส่วนร่วม](resources/contributing.md) + +
diff --git a/website/docs/index.tr.md b/website/docs/index.tr.md new file mode 100644 index 00000000..8439f43c --- /dev/null +++ b/website/docs/index.tr.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+Yamato Security tarafından oluşturulan +WELA (Windows Event Log Analyzer, ゑ羅), +Windows olay günlüğü ayarlarını denetlemek için bir araçtır. Windows olay günlükleri DFIR için hayati bir +bilgi kaynağıdır — WELA, önemli olayları gerçekten kaydettiğinizden emin olmanıza yardımcı olur. +

+ +
+[Başlayın :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Komut Referansı :material-console:](commands/index.md){ .md-button } +[GitHub'da Görüntüle :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## Neden WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __Günlük ilkesi ayarlarını denetleyin__ + + --- + + Doğru olayların günlüğe kaydedildiğini doğrulamak için Windows olay günlüğü **denetim ilkesi ayarlarınızı** denetleyin. + +- :material-book-check:{ .lg .middle } __Yönergelere dayalı__ + + --- + + **Başlıca Windows olay günlüğü denetim yapılandırma yönergelerine** karşı kontrol eder. + +- :material-shield-search:{ .lg .middle } __Sigma tespit edilebilirliği__ + + --- + + Ayarlarınızı **gerçek dünya Sigma kuralı tespit edilebilirliğine** karşı değerlendirir — günlükleriniz saldırıları gerçekten yakalayacak mı? + +- :material-file-cog:{ .lg .middle } __Dosya boyutu denetimi__ + + --- + + Windows olay günlüğü **dosya boyutlarını** denetler ve önerilen boyutları önerir. + +- :material-cog-play:{ .lg .middle } __Otomatik yapılandırma__ + + --- + + `configure` komutuyla **önerilen** denetim ilkesini ve günlük dosyası boyutlarını uygulayın. + +- :material-chart-box:{ .lg .middle } __Esnek çıktı__ + + --- + + Sonuçları terminalde, bir GUI'de, bir tabloda veya bir **MITRE ATT&CK Navigator** ısı haritası olarak görüntüleyin. + +
+ +## Hızlı bağlantılar + +
+ +- __:material-book-open-variant: Buraya yeni mi geldiniz?__ + + [Genel Bakış](overview/index.md) ile başlayın, ardından WELA'yı kurmak ve çalıştırmak için + [Başlangıç](getting-started/index.md) bölümüne geçin. + +- __:material-console-line: CLI ile mi çalışıyorsunuz?__ + + [Komut Listesi](commands/index.md) ve [Komut Kullanımı](commands/usage.md) + referansına göz atın (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: Daha ileri mi gidiyorsunuz?__ + + [Tamamlayıcı Projeleri](resources/companion-projects.md), + [Değişiklik Günlüğünü](resources/changelog.md) ve nasıl + [katkıda bulunabileceğinizi](resources/contributing.md) keşfedin. + +
diff --git a/website/docs/index.uk.md b/website/docs/index.uk.md new file mode 100644 index 00000000..3210e4e1 --- /dev/null +++ b/website/docs/index.uk.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅), створений +Yamato Security, — це інструмент для +аудиту налаштувань журналу подій Windows. Журнали подій Windows є життєво важливим джерелом +інформації для DFIR — WELA допомагає переконатися, що ви дійсно записуєте події, які мають значення. +

+ +
+[Почати роботу :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Довідник команд :material-console:](commands/index.md){ .md-button } +[Переглянути на GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## Чому WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __Аудит налаштувань політики журналювання__ + + --- + + Перевіряйте **налаштування політики аудиту** журналу подій Windows, щоб підтвердити, що журналюються правильні події. + +- :material-book-check:{ .lg .middle } __На основі рекомендацій__ + + --- + + Перевірка відповідно до **основних рекомендацій з налаштування аудиту журналу подій Windows**. + +- :material-shield-search:{ .lg .middle } __Виявлюваність Sigma__ + + --- + + Оцінює ваші налаштування за **реальною виявлюваністю правил Sigma** — чи дійсно ваші журнали виявлятимуть атаки? + +- :material-file-cog:{ .lg .middle } __Аудит розміру файлів__ + + --- + + Перевіряє **розміри файлів** журналу подій Windows та пропонує рекомендовані розміри. + +- :material-cog-play:{ .lg .middle } __Автоматичне налаштування__ + + --- + + Застосовуйте **рекомендовану** політику аудиту та розміри файлів журналу за допомогою команди `configure`. + +- :material-chart-box:{ .lg .middle } __Гнучкий вивід__ + + --- + + Переглядайте результати в терміналі, графічному інтерфейсі, у вигляді таблиці або як теплову карту **MITRE ATT&CK Navigator**. + +
+ +## Швидкі посилання + +
+ +- __:material-book-open-variant: Уперше тут?__ + + Почніть з [Огляду](overview/index.md), а потім перейдіть до + [Початку роботи](getting-started/index.md), щоб встановити та запустити WELA. + +- __:material-console-line: Працюєте з CLI?__ + + Перегляньте [Список команд](commands/index.md) та довідник + [Використання команд](commands/usage.md) (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: Хочете більше?__ + + Ознайомтеся із [Супутніми проєктами](resources/companion-projects.md), + [Журналом змін](resources/changelog.md) та тим, як + [зробити внесок](resources/contributing.md). + +
diff --git a/website/docs/index.zh-TW.md b/website/docs/index.zh-TW.md new file mode 100644 index 00000000..810e9562 --- /dev/null +++ b/website/docs/index.zh-TW.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA（Windows Event Log Analyzer，ゑ羅）由 +Yamato Security 開發，是一款用於 +稽核 Windows 事件記錄檔設定的工具。Windows 事件記錄檔是 DFIR 至關重要的 +資訊來源——WELA 協助你確認自己確實記錄了重要的事件。 +

+ +
+[開始使用 :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[指令參考 :material-console:](commands/index.md){ .md-button } +[在 GitHub 上檢視 :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## 為什麼選擇 WELA？ + +
+ +- :material-clipboard-check:{ .lg .middle } __稽核記錄原則設定__ + + --- + + 稽核你的 Windows 事件記錄檔**稽核原則設定**，確認正確的事件確實有被記錄。 + +- :material-book-check:{ .lg .middle } __以指南為依據__ + + --- + + 對照**主要的 Windows 事件記錄檔稽核設定指南**進行檢查。 + +- :material-shield-search:{ .lg .middle } __Sigma 偵測能力__ + + --- + + 依據**真實世界的 Sigma 規則偵測能力**評估你的設定——你的記錄檔真的能捕捉到攻擊嗎？ + +- :material-file-cog:{ .lg .middle } __檔案大小稽核__ + + --- + + 稽核 Windows 事件記錄檔的**檔案大小**並建議建議的大小。 + +- :material-cog-play:{ .lg .middle } __自動設定__ + + --- + + 透過 `configure` 指令套用**建議的**稽核原則與記錄檔檔案大小。 + +- :material-chart-box:{ .lg .middle } __彈性的輸出__ + + --- + + 可在終端機、GUI、表格中檢視結果，或以 **MITRE ATT&CK Navigator** 熱圖呈現。 + +
+ +## 快速連結 + +
+ +- __:material-book-open-variant: 第一次使用？__ + + 先從[概覽](overview/index.md)開始，接著前往 + [開始使用](getting-started/index.md)來安裝並執行 WELA。 + +- __:material-console-line: 在使用 CLI 嗎？__ + + 瀏覽[指令清單](commands/index.md)以及[指令用法](commands/usage.md) + 參考（`audit-settings`、`audit-filesize`、`configure`、`update-rules`）。 + +- __:material-puzzle: 想更進一步？__ + + 探索[相關專案](resources/companion-projects.md)、 + [變更紀錄](resources/changelog.md)，以及如何 + [貢獻](resources/contributing.md)。 + +
diff --git a/website/docs/overview/features.ar.md b/website/docs/overview/features.ar.md new file mode 100644 index 00000000..48d82964 --- /dev/null +++ b/website/docs/overview/features.ar.md @@ -0,0 +1,6 @@ +# الميزات +- تدقيق إعدادات سياسة تدقيق سجل أحداث Windows. +- التحقق **استنادًا إلى الإرشادات الرئيسية لتهيئة تدقيق سجل أحداث Windows**. +- التحقق من إعدادات تدقيق سجل أحداث Windows استنادًا إلى **قابلية اكتشاف قواعد Sigma في العالم الحقيقي**. +- تدقيق أحجام ملفات سجل أحداث Windows واقتراح الحجم الموصى به. +- ضبط سياسة تدقيق سجل أحداث Windows الموصى بها وأحجام الملفات. diff --git a/website/docs/overview/features.de.md b/website/docs/overview/features.de.md new file mode 100644 index 00000000..6a79ef4a --- /dev/null +++ b/website/docs/overview/features.de.md @@ -0,0 +1,6 @@ +# Funktionen +- Überprüfung der Einstellungen für die Überwachungsrichtlinie des Windows-Ereignisprotokolls. +- Überprüfung **anhand der wichtigsten Konfigurationsrichtlinien für die Überwachung des Windows-Ereignisprotokolls**. +- Überprüfung der Überwachungseinstellungen des Windows-Ereignisprotokolls auf Grundlage der **Erkennbarkeit durch reale Sigma-Regeln**. +- Überprüfung der Dateigrößen des Windows-Ereignisprotokolls und Vorschläge für die empfohlene Größe. +- Festlegen der empfohlenen Überwachungsrichtlinie und Dateigrößen für das Windows-Ereignisprotokoll. diff --git a/website/docs/overview/features.es.md b/website/docs/overview/features.es.md new file mode 100644 index 00000000..0ee9f3da --- /dev/null +++ b/website/docs/overview/features.es.md @@ -0,0 +1,6 @@ +# Funcionalidades +- Auditoría de la configuración de la política de auditoría del registro de eventos de Windows. +- Comprobación **basada en las principales directrices de configuración de auditoría del registro de eventos de Windows**. +- Comprobación de la configuración de auditoría del registro de eventos de Windows basada en la **detectabilidad de reglas Sigma en el mundo real**. +- Auditoría de los tamaños de archivo del registro de eventos de Windows y sugerencias del tamaño recomendado. +- Establecimiento de la política de auditoría del registro de eventos de Windows y los tamaños de archivo recomendados. diff --git a/website/docs/overview/features.fr.md b/website/docs/overview/features.fr.md new file mode 100644 index 00000000..5edf3149 --- /dev/null +++ b/website/docs/overview/features.fr.md @@ -0,0 +1,6 @@ +# Fonctionnalités +- Audit des paramètres de la stratégie d'audit du journal d'événements Windows. +- Vérification **basée sur les principales directives de configuration d'audit du journal d'événements Windows**. +- Vérification des paramètres d'audit du journal d'événements Windows en fonction de la **détectabilité des règles Sigma dans des conditions réelles**. +- Audit de la taille des fichiers du journal d'événements Windows et suggestions concernant la taille recommandée. +- Définition de la stratégie d'audit recommandée et des tailles de fichiers du journal d'événements Windows. diff --git a/website/docs/overview/features.hi.md b/website/docs/overview/features.hi.md new file mode 100644 index 00000000..7e060995 --- /dev/null +++ b/website/docs/overview/features.hi.md @@ -0,0 +1,6 @@ +# विशेषताएँ +- Windows इवेंट लॉग ऑडिट पॉलिसी सेटिंग्स का ऑडिट करना। +- **प्रमुख Windows इवेंट लॉग ऑडिट कॉन्फ़िगरेशन दिशानिर्देशों के आधार पर** जाँच करना। +- **वास्तविक दुनिया की Sigma नियम पहचान-योग्यता के आधार पर** Windows इवेंट लॉग ऑडिट सेटिंग्स की जाँच करना। +- Windows इवेंट लॉग फ़ाइल आकारों का ऑडिट करना और अनुशंसित आकार के लिए सुझाव देना। +- अनुशंसित Windows इवेंट लॉग ऑडिट पॉलिसी और फ़ाइल आकार सेट करना। diff --git a/website/docs/overview/features.id.md b/website/docs/overview/features.id.md new file mode 100644 index 00000000..70ab2b2d --- /dev/null +++ b/website/docs/overview/features.id.md @@ -0,0 +1,6 @@ +# Fitur +- Mengaudit pengaturan kebijakan audit log peristiwa Windows. +- Memeriksa **berdasarkan panduan konfigurasi audit log peristiwa Windows yang utama**. +- Memeriksa pengaturan audit log peristiwa Windows berdasarkan **kemampuan deteksi aturan Sigma di dunia nyata**. +- Mengaudit ukuran file log peristiwa Windows dan memberikan saran ukuran yang direkomendasikan. +- Mengatur kebijakan audit log peristiwa Windows dan ukuran file yang direkomendasikan. diff --git a/website/docs/overview/features.ko.md b/website/docs/overview/features.ko.md new file mode 100644 index 00000000..08b01fd6 --- /dev/null +++ b/website/docs/overview/features.ko.md @@ -0,0 +1,6 @@ +# 기능 +- Windows 이벤트 로그 감사 정책 설정 감사. +- **주요 Windows 이벤트 로그 감사 구성 지침을 기반으로** 확인. +- **실제 Sigma 규칙 탐지 가능성을 기반으로** Windows 이벤트 로그 감사 설정 확인. +- Windows 이벤트 로그 파일 크기 감사 및 권장 크기 제안. +- 권장 Windows 이벤트 로그 감사 정책 및 파일 크기 설정. diff --git a/website/docs/overview/features.my.md b/website/docs/overview/features.my.md new file mode 100644 index 00000000..76717622 --- /dev/null +++ b/website/docs/overview/features.my.md @@ -0,0 +1,6 @@ +# အင်္ဂါရပ်များ +- Windows event log audit policy ဆက်တင်များကို စစ်ဆေးခြင်း။ +- **အဓိက Windows event log audit ပြင်ဆင်သတ်မှတ်မှု လမ်းညွှန်ချက်များကို အခြေခံ၍** စစ်ဆေးခြင်း။ +- **လက်တွေ့ကမ္ဘာ၏ Sigma rule ထောက်လှမ်းနိုင်စွမ်းကို အခြေခံ၍** Windows event log audit ဆက်တင်များကို စစ်ဆေးခြင်း။ +- Windows event log ဖိုင်အရွယ်အစားများကို စစ်ဆေးခြင်းနှင့် အကြံပြုထားသော အရွယ်အစားအတွက် အကြံပြုချက်များ။ +- အကြံပြုထားသော Windows event log audit policy နှင့် ဖိုင်အရွယ်အစားများကို သတ်မှတ်ခြင်း။ diff --git a/website/docs/overview/features.pt-BR.md b/website/docs/overview/features.pt-BR.md new file mode 100644 index 00000000..47bfdb07 --- /dev/null +++ b/website/docs/overview/features.pt-BR.md @@ -0,0 +1,6 @@ +# Recursos +- Auditoria das configurações de política de auditoria de logs de eventos do Windows. +- Verificação **com base nas principais diretrizes de configuração de auditoria de logs de eventos do Windows**. +- Verificação das configurações de auditoria de logs de eventos do Windows com base na **detectabilidade real das regras Sigma**. +- Auditoria dos tamanhos dos arquivos de logs de eventos do Windows e sugestões para o tamanho recomendado. +- Configuração da política de auditoria de logs de eventos do Windows e dos tamanhos de arquivo recomendados. diff --git a/website/docs/overview/features.th.md b/website/docs/overview/features.th.md new file mode 100644 index 00000000..accb0e22 --- /dev/null +++ b/website/docs/overview/features.th.md @@ -0,0 +1,6 @@ +# คุณสมบัติ +- การตรวจสอบการตั้งค่านโยบายการตรวจสอบ Windows event log +- การตรวจสอบ **โดยอิงตามแนวทางหลักในการกำหนดค่าการตรวจสอบ Windows event log** +- การตรวจสอบการตั้งค่าการตรวจสอบ Windows event log โดยอิงตาม **ความสามารถในการตรวจจับด้วยกฎ Sigma ในสภาพแวดล้อมจริง** +- การตรวจสอบขนาดไฟล์ Windows event log และคำแนะนำเกี่ยวกับขนาดที่แนะนำ +- การตั้งค่านโยบายการตรวจสอบ Windows event log และขนาดไฟล์ที่แนะนำ diff --git a/website/docs/overview/features.tr.md b/website/docs/overview/features.tr.md new file mode 100644 index 00000000..3a869556 --- /dev/null +++ b/website/docs/overview/features.tr.md @@ -0,0 +1,6 @@ +# Özellikler +- Windows olay günlüğü denetim politikası ayarlarının denetlenmesi. +- **Başlıca Windows olay günlüğü denetim yapılandırma kılavuzlarına dayalı** kontrol. +- Windows olay günlüğü denetim ayarlarının **gerçek dünya Sigma kuralı tespit edilebilirliğine** dayalı kontrolü. +- Windows olay günlüğü dosya boyutlarının denetlenmesi ve önerilen boyut için öneriler. +- Önerilen Windows olay günlüğü denetim politikasının ve dosya boyutlarının ayarlanması. diff --git a/website/docs/overview/features.uk.md b/website/docs/overview/features.uk.md new file mode 100644 index 00000000..13dff2b6 --- /dev/null +++ b/website/docs/overview/features.uk.md @@ -0,0 +1,6 @@ +# Можливості +- Аудит налаштувань політики аудиту журналу подій Windows. +- Перевірка **на основі основних рекомендацій щодо конфігурації аудиту журналу подій Windows**. +- Перевірка налаштувань аудиту журналу подій Windows на основі **реальної виявлюваності правил Sigma**. +- Аудит розмірів файлів журналу подій Windows та рекомендації щодо рекомендованого розміру. +- Налаштування рекомендованої політики аудиту журналу подій Windows та розмірів файлів. diff --git a/website/docs/overview/features.zh-TW.md b/website/docs/overview/features.zh-TW.md new file mode 100644 index 00000000..141801d8 --- /dev/null +++ b/website/docs/overview/features.zh-TW.md @@ -0,0 +1,6 @@ +# 功能特色 +- 稽核 Windows 事件日誌的稽核原則設定。 +- **依據主要的 Windows 事件日誌稽核設定指南**進行檢查。 +- 依據**實際的 Sigma 規則可偵測性**檢查 Windows 事件日誌的稽核設定。 +- 稽核 Windows 事件日誌的檔案大小，並提供建議大小的建議。 +- 設定建議的 Windows 事件日誌稽核原則與檔案大小。 diff --git a/website/docs/overview/index.ar.md b/website/docs/overview/index.ar.md new file mode 100644 index 00000000..fb97fc7f --- /dev/null +++ b/website/docs/overview/index.ar.md @@ -0,0 +1,6 @@ +# حول WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** هي أداة لتدقيق إعدادات سجل أحداث Windows. +تُعد سجلات أحداث Windows مصدرًا حيويًا للمعلومات في مجال التحقيقات الجنائية الرقمية والاستجابة للحوادث (DFIR)، حيث توفر رؤية واضحة لنشاط النظام وأحداث الأمان. +**لسوء الحظ، غالبًا ما تؤدي التكوينات الافتراضية إلى مشكلات مثل محدودية الاحتفاظ بالسجلات، وعدم كفاية سياسات التدقيق، والنقاط العمياء التي تقلل من القدرة على الكشف**. +تساعد WELA في الكشف عن نقاط الضعف هذه وتقدم توصيات عملية لتحسين إعدادات التدقيق وتعزيز رؤية الأمان. +كما تقوم WELA بتقييم تكوينات السجلات **استنادًا إلى تغطية قواعد Sigma في العالم الواقعي**، مما يتيح للمستخدمين تقييم ما يمكن أو لا يمكن اكتشافه ضمن الإعدادات الحالية. diff --git a/website/docs/overview/index.de.md b/website/docs/overview/index.de.md new file mode 100644 index 00000000..1971a424 --- /dev/null +++ b/website/docs/overview/index.de.md @@ -0,0 +1,6 @@ +# Über WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** ist ein Werkzeug zur Überprüfung von Windows-Ereignisprotokolleinstellungen. +Windows-Ereignisprotokolle sind eine wichtige Informationsquelle für Digital Forensics and Incident Response (DFIR) und bieten Einblick in Systemaktivitäten und Sicherheitsereignisse. +**Leider führen Standardkonfigurationen oft zu Problemen wie begrenzter Protokollaufbewahrung, unzureichenden Überwachungsrichtlinien und blinden Flecken, die die Erkennungsfähigkeit verringern**. +WELA hilft dabei, diese Schwachstellen aufzudecken und bietet praktische Empfehlungen zur Verbesserung der Überwachungseinstellungen und zur Erhöhung der Sicherheitstransparenz. +WELA bewertet außerdem Protokollkonfigurationen **auf Grundlage der realen Abdeckung durch Sigma-Regeln** und ermöglicht es Benutzern zu beurteilen, was unter den aktuellen Einstellungen erkannt werden kann und was nicht. diff --git a/website/docs/overview/index.es.md b/website/docs/overview/index.es.md new file mode 100644 index 00000000..254dbeca --- /dev/null +++ b/website/docs/overview/index.es.md @@ -0,0 +1,6 @@ +# Acerca de WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** es una herramienta para auditar la configuración del registro de eventos de Windows. +Los registros de eventos de Windows son una fuente vital de información para la investigación forense digital y la respuesta a incidentes (DFIR), ya que ofrecen visibilidad sobre la actividad del sistema y los eventos de seguridad. +**Lamentablemente, las configuraciones predeterminadas suelen provocar problemas como una retención de registros limitada, políticas de auditoría insuficientes y puntos ciegos que reducen la capacidad de detección**. +WELA ayuda a descubrir estas debilidades y ofrece recomendaciones prácticas para mejorar la configuración de auditoría y reforzar la visibilidad de seguridad. +WELA también evalúa las configuraciones de registros **basándose en la cobertura real de las reglas Sigma**, lo que permite a los usuarios evaluar qué se puede o no detectar con la configuración actual. diff --git a/website/docs/overview/index.fr.md b/website/docs/overview/index.fr.md new file mode 100644 index 00000000..ef175335 --- /dev/null +++ b/website/docs/overview/index.fr.md @@ -0,0 +1,6 @@ +# À propos de WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** est un outil d'audit des paramètres des journaux d'événements Windows. +Les journaux d'événements Windows sont une source d'information essentielle pour l'investigation numérique et la réponse aux incidents (DFIR), offrant une visibilité sur l'activité du système et les événements de sécurité. +**Malheureusement, les configurations par défaut entraînent souvent des problèmes tels qu'une rétention limitée des journaux, des stratégies d'audit insuffisantes et des angles morts qui réduisent les capacités de détection**. +WELA aide à révéler ces faiblesses et propose des recommandations pratiques pour améliorer les paramètres d'audit et renforcer la visibilité en matière de sécurité. +WELA évalue également les configurations de journalisation **en se basant sur la couverture réelle des règles Sigma**, permettant aux utilisateurs d'évaluer ce qui peut ou ne peut pas être détecté avec les paramètres actuels. diff --git a/website/docs/overview/index.hi.md b/website/docs/overview/index.hi.md new file mode 100644 index 00000000..79d2cdbb --- /dev/null +++ b/website/docs/overview/index.hi.md @@ -0,0 +1,6 @@ +# WELA के बारे में +**WELA (Windows Event Log Analyzer, ゑ羅)** Windows इवेंट लॉग सेटिंग्स का ऑडिट करने के लिए एक टूल है। +Windows इवेंट लॉग, Digital Forensics and Incident Response (DFIR) के लिए जानकारी का एक महत्वपूर्ण स्रोत हैं, जो सिस्टम गतिविधि और सुरक्षा घटनाओं में दृश्यता प्रदान करते हैं। +**दुर्भाग्य से, डिफ़ॉल्ट कॉन्फ़िगरेशन अक्सर सीमित लॉग प्रतिधारण, अपर्याप्त ऑडिट नीतियों, और ऐसे अंधे धब्बों जैसी समस्याओं को जन्म देते हैं जो पहचान क्षमता को कम कर देते हैं**। +WELA इन कमज़ोरियों को उजागर करने में मदद करता है और ऑडिट सेटिंग्स को बेहतर बनाने तथा सुरक्षा दृश्यता को बढ़ाने के लिए व्यावहारिक सिफारिशें प्रदान करता है। +WELA **वास्तविक दुनिया की Sigma नियम कवरेज के आधार पर** भी लॉग कॉन्फ़िगरेशन का आकलन करता है, जिससे उपयोगकर्ता मूल्यांकन कर सकते हैं कि वर्तमान सेटिंग्स के तहत क्या पता लगाया जा सकता है और क्या नहीं। diff --git a/website/docs/overview/index.id.md b/website/docs/overview/index.id.md new file mode 100644 index 00000000..40249ce6 --- /dev/null +++ b/website/docs/overview/index.id.md @@ -0,0 +1,6 @@ +# Tentang WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** adalah alat untuk mengaudit pengaturan log peristiwa Windows. +Log peristiwa Windows merupakan sumber informasi penting untuk Digital Forensics and Incident Response (DFIR), yang memberikan visibilitas terhadap aktivitas sistem dan peristiwa keamanan. +**Sayangnya, konfigurasi bawaan sering kali menimbulkan masalah seperti retensi log yang terbatas, kebijakan audit yang tidak memadai, serta titik buta yang mengurangi kemampuan deteksi**. +WELA membantu mengungkap kelemahan-kelemahan ini dan menawarkan rekomendasi praktis untuk meningkatkan pengaturan audit serta memperkuat visibilitas keamanan. +WELA juga menilai konfigurasi log **berdasarkan cakupan aturan Sigma di dunia nyata**, sehingga memungkinkan pengguna mengevaluasi apa yang dapat atau tidak dapat dideteksi dengan pengaturan saat ini. diff --git a/website/docs/overview/index.ko.md b/website/docs/overview/index.ko.md new file mode 100644 index 00000000..342a1127 --- /dev/null +++ b/website/docs/overview/index.ko.md @@ -0,0 +1,6 @@ +# WELA 소개 +**WELA (Windows Event Log Analyzer, ゑ羅)** 는 Windows 이벤트 로그 설정을 감사하기 위한 도구입니다. +Windows 이벤트 로그는 디지털 포렌식 및 사고 대응(DFIR)을 위한 중요한 정보원으로, 시스템 활동과 보안 이벤트에 대한 가시성을 제공합니다. +**안타깝게도 기본 구성은 제한된 로그 보존, 불충분한 감사 정책, 탐지 능력을 저하시키는 사각지대와 같은 문제로 이어지는 경우가 많습니다**. +WELA는 이러한 취약점을 발견하고 감사 설정을 개선하며 보안 가시성을 강화하기 위한 실질적인 권장 사항을 제공합니다. +WELA는 또한 **실제 Sigma 규칙 커버리지를 기반으로** 로그 구성을 평가하여, 사용자가 현재 설정에서 무엇을 탐지할 수 있고 무엇을 탐지할 수 없는지 평가할 수 있도록 합니다. diff --git a/website/docs/overview/index.my.md b/website/docs/overview/index.my.md new file mode 100644 index 00000000..fd8abdf1 --- /dev/null +++ b/website/docs/overview/index.my.md @@ -0,0 +1,6 @@ +# WELA အကြောင်း +**WELA (Windows Event Log Analyzer, ゑ羅)** သည် Windows event log ဆက်တင်များကို စစ်ဆေးရန် ကိရိယာတစ်ခုဖြစ်သည်။ +Windows event log များသည် Digital Forensics and Incident Response (DFIR) အတွက် အရေးပါသော သတင်းအချက်အလက် ရင်းမြစ်တစ်ခုဖြစ်ပြီး၊ စနစ်လုပ်ဆောင်ချက်နှင့် လုံခြုံရေးဆိုင်ရာ ဖြစ်ရပ်များကို မြင်နိုင်စေသည်။ +**ကံမကောင်းစွာဖြင့်၊ မူရင်းဖွဲ့စည်းမှုပုံစံများသည် log သိမ်းဆည်းမှု ကန့်သတ်ခြင်း၊ စစ်ဆေးရေးမူဝါဒ မလုံလောက်ခြင်းနှင့် ထောက်လှမ်းနိုင်စွမ်းကို လျှော့ချသည့် မမြင်နိုင်သောနေရာများ ကဲ့သို့သော ပြဿနာများကို မကြာခဏ ဖြစ်ပေါ်စေသည်**။ +WELA သည် ဤအားနည်းချက်များကို ဖော်ထုတ်ရန် ကူညီပေးပြီး စစ်ဆေးရေးဆက်တင်များ တိုးတက်စေရန်နှင့် လုံခြုံရေး မြင်နိုင်မှု မြှင့်တင်ရန်အတွက် လက်တွေ့ကျသော အကြံပြုချက်များကို ပေးသည်။ +WELA သည် log ဖွဲ့စည်းမှုပုံစံများကိုလည်း **လက်တွေ့ Sigma rule လွှမ်းခြုံမှုအပေါ် အခြေခံ၍** အကဲဖြတ်ပေးပြီး၊ သုံးစွဲသူများအား လက်ရှိဆက်တင်များအောက်တွင် မည်သည့်အရာကို ထောက်လှမ်းနိုင်သည် သို့မဟုတ် မထောက်လှမ်းနိုင်သည်ကို အကဲဖြတ်နိုင်စေသည်။ diff --git a/website/docs/overview/index.pt-BR.md b/website/docs/overview/index.pt-BR.md new file mode 100644 index 00000000..30be267a --- /dev/null +++ b/website/docs/overview/index.pt-BR.md @@ -0,0 +1,6 @@ +# Sobre o WELA +O **WELA (Windows Event Log Analyzer, ゑ羅)** é uma ferramenta para auditar as configurações de log de eventos do Windows. +Os logs de eventos do Windows são uma fonte vital de informações para a Forense Digital e Resposta a Incidentes (DFIR), proporcionando visibilidade sobre a atividade do sistema e os eventos de segurança. +**Infelizmente, as configurações padrão geralmente levam a problemas como retenção limitada de logs, políticas de auditoria insuficientes e pontos cegos que reduzem a capacidade de detecção**. +O WELA ajuda a revelar essas fragilidades e oferece recomendações práticas para melhorar as configurações de auditoria e aprimorar a visibilidade de segurança. +O WELA também avalia as configurações de log **com base na cobertura real das regras Sigma**, permitindo que os usuários avaliem o que pode ou não ser detectado com as configurações atuais. diff --git a/website/docs/overview/index.th.md b/website/docs/overview/index.th.md new file mode 100644 index 00000000..579b236d --- /dev/null +++ b/website/docs/overview/index.th.md @@ -0,0 +1,6 @@ +# เกี่ยวกับ WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** เป็นเครื่องมือสำหรับตรวจสอบการตั้งค่า Windows event log +Windows event log เป็นแหล่งข้อมูลที่สำคัญสำหรับ Digital Forensics and Incident Response (DFIR) ซึ่งช่วยให้มองเห็นกิจกรรมของระบบและเหตุการณ์ด้านความปลอดภัยได้ +**น่าเสียดายที่การกำหนดค่าเริ่มต้นมักนำไปสู่ปัญหาต่าง ๆ เช่น การเก็บรักษา log ที่จำกัด นโยบายการตรวจสอบที่ไม่เพียงพอ และจุดบอดที่ลดความสามารถในการตรวจจับ** +WELA ช่วยเปิดเผยจุดอ่อนเหล่านี้ และนำเสนอคำแนะนำเชิงปฏิบัติเพื่อปรับปรุงการตั้งค่าการตรวจสอบและเพิ่มการมองเห็นด้านความปลอดภัย +WELA ยังประเมินการกำหนดค่า log **โดยอ้างอิงจากความครอบคลุมของ Sigma rule ในสถานการณ์จริง** ทำให้ผู้ใช้สามารถประเมินได้ว่าสิ่งใดสามารถหรือไม่สามารถตรวจจับได้ภายใต้การตั้งค่าปัจจุบัน diff --git a/website/docs/overview/index.tr.md b/website/docs/overview/index.tr.md new file mode 100644 index 00000000..e95e06b9 --- /dev/null +++ b/website/docs/overview/index.tr.md @@ -0,0 +1,6 @@ +# WELA Hakkında +**WELA (Windows Event Log Analyzer, ゑ羅)**, Windows olay günlüğü ayarlarını denetlemek için bir araçtır. +Windows olay günlükleri, Dijital Adli Bilişim ve Olay Müdahalesi (DFIR) için hayati bir bilgi kaynağıdır ve sistem etkinliği ile güvenlik olaylarına görünürlük sağlar. +**Maalesef, varsayılan yapılandırmalar genellikle sınırlı günlük saklama süresi, yetersiz denetim politikaları ve tespit yeteneğini azaltan kör noktalar gibi sorunlara yol açar**. +WELA, bu zayıflıkları ortaya çıkarmaya yardımcı olur ve denetim ayarlarını iyileştirmek ve güvenlik görünürlüğünü artırmak için pratik öneriler sunar. +WELA ayrıca **gerçek dünya Sigma kuralı kapsamına dayalı olarak** günlük yapılandırmalarını değerlendirir ve kullanıcıların mevcut ayarlar altında nelerin tespit edilip edilemeyeceğini değerlendirmesine olanak tanır. diff --git a/website/docs/overview/index.uk.md b/website/docs/overview/index.uk.md new file mode 100644 index 00000000..d8a089e3 --- /dev/null +++ b/website/docs/overview/index.uk.md @@ -0,0 +1,6 @@ +# Про WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** — це інструмент для аудиту налаштувань журналів подій Windows. +Журнали подій Windows є життєво важливим джерелом інформації для цифрової криміналістики та реагування на інциденти (DFIR), забезпечуючи видимість активності системи та подій безпеки. +**На жаль, конфігурації за замовчуванням часто призводять до таких проблем, як обмежений строк зберігання журналів, недостатні політики аудиту та сліпі зони, що знижують здатність до виявлення**. +WELA допомагає виявити ці слабкі місця та пропонує практичні рекомендації щодо покращення налаштувань аудиту та підвищення видимості безпеки. +WELA також оцінює конфігурації журналів **на основі реального покриття правилами Sigma**, дозволяючи користувачам оцінити, що може бути виявлено за поточних налаштувань, а що ні. diff --git a/website/docs/overview/index.zh-TW.md b/website/docs/overview/index.zh-TW.md new file mode 100644 index 00000000..b8b9057e --- /dev/null +++ b/website/docs/overview/index.zh-TW.md @@ -0,0 +1,6 @@ +# 關於 WELA +**WELA（Windows Event Log Analyzer，ゑ羅）** 是一套用於稽核 Windows 事件記錄設定的工具。 +Windows 事件記錄是數位鑑識與事件回應（DFIR）的重要資訊來源，能提供系統活動與安全事件的可視性。 +**遺憾的是，預設組態往往會導致諸多問題，例如記錄保存期限有限、稽核原則不足，以及降低偵測能力的盲點**。 +WELA 能協助找出這些弱點，並提供實用的建議，以改善稽核設定並強化安全可視性。 +WELA 也會**根據真實世界中的 Sigma 規則涵蓋範圍**來評估記錄組態，讓使用者能夠評估在目前設定下哪些可以偵測、哪些無法偵測。 diff --git a/website/docs/overview/screenshots.ar.md b/website/docs/overview/screenshots.ar.md new file mode 100644 index 00000000..6ce891d3 --- /dev/null +++ b/website/docs/overview/screenshots.ar.md @@ -0,0 +1,21 @@ +# لقطات الشاشة + +## قائمة المساعدة عند بدء التشغيل +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (مخرجات الطرفية) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (واجهة المستخدم الرسومية) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (جدول) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.de.md b/website/docs/overview/screenshots.de.md new file mode 100644 index 00000000..5e89e82f --- /dev/null +++ b/website/docs/overview/screenshots.de.md @@ -0,0 +1,21 @@ +# Screenshots + +## Startup-Hilfemenü +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (Terminalausgabe) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (Tabelle) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.es.md b/website/docs/overview/screenshots.es.md new file mode 100644 index 00000000..b1804bb6 --- /dev/null +++ b/website/docs/overview/screenshots.es.md @@ -0,0 +1,21 @@ +# Capturas de pantalla + +## Menú de ayuda de inicio +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (salida de terminal) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (tabla) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.fr.md b/website/docs/overview/screenshots.fr.md new file mode 100644 index 00000000..63b6ce69 --- /dev/null +++ b/website/docs/overview/screenshots.fr.md @@ -0,0 +1,21 @@ +# Captures d'écran + +## Menu d'aide au démarrage +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (sortie du terminal) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (interface graphique) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (tableau) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.hi.md b/website/docs/overview/screenshots.hi.md new file mode 100644 index 00000000..846bf242 --- /dev/null +++ b/website/docs/overview/screenshots.hi.md @@ -0,0 +1,21 @@ +# स्क्रीनशॉट + +## स्टार्टअप हेल्प मेनू +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (टर्मिनल आउटपुट) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (टेबल) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.id.md b/website/docs/overview/screenshots.id.md new file mode 100644 index 00000000..20609c1e --- /dev/null +++ b/website/docs/overview/screenshots.id.md @@ -0,0 +1,21 @@ +# Tangkapan Layar + +## Menu Bantuan Awal +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (keluaran terminal) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (tabel) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.ko.md b/website/docs/overview/screenshots.ko.md new file mode 100644 index 00000000..150c7848 --- /dev/null +++ b/website/docs/overview/screenshots.ko.md @@ -0,0 +1,21 @@ +# 스크린샷 + +## 시작 도움말 메뉴 +![WELA 시작](../assets/screenshots/startup.png) + +## audit-settings (터미널 출력) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (테이블) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.my.md b/website/docs/overview/screenshots.my.md new file mode 100644 index 00000000..a6c2eac3 --- /dev/null +++ b/website/docs/overview/screenshots.my.md @@ -0,0 +1,21 @@ +# စခရင်ရှော့များ + +## စတင်ချိန် အကူအညီ မီနူး +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (terminal output) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (table) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.pt-BR.md b/website/docs/overview/screenshots.pt-BR.md new file mode 100644 index 00000000..7f43c058 --- /dev/null +++ b/website/docs/overview/screenshots.pt-BR.md @@ -0,0 +1,21 @@ +# Capturas de tela + +## Menu de Ajuda Inicial +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (saída do terminal) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (tabela) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.th.md b/website/docs/overview/screenshots.th.md new file mode 100644 index 00000000..4055a00d --- /dev/null +++ b/website/docs/overview/screenshots.th.md @@ -0,0 +1,21 @@ +# ภาพหน้าจอ + +## เมนูช่วยเหลือเมื่อเริ่มต้น +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (เอาต์พุตในเทอร์มินัล) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (ตาราง) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.tr.md b/website/docs/overview/screenshots.tr.md new file mode 100644 index 00000000..375d6a76 --- /dev/null +++ b/website/docs/overview/screenshots.tr.md @@ -0,0 +1,21 @@ +# Ekran Görüntüleri + +## Başlangıç Yardım Menüsü +![WELA Başlangıç](../assets/screenshots/startup.png) + +## audit-settings (terminal çıktısı) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (tablo) +![WELA Tablo](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.uk.md b/website/docs/overview/screenshots.uk.md new file mode 100644 index 00000000..5b7534a7 --- /dev/null +++ b/website/docs/overview/screenshots.uk.md @@ -0,0 +1,21 @@ +# Знімки екрана + +## Меню довідки під час запуску +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (вивід у терміналі) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (графічний інтерфейс) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (таблиця) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.zh-TW.md b/website/docs/overview/screenshots.zh-TW.md new file mode 100644 index 00000000..54cf9f24 --- /dev/null +++ b/website/docs/overview/screenshots.zh-TW.md @@ -0,0 +1,21 @@ +# 螢幕截圖 + +## 啟動說明選單 +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings（終端機輸出） +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings（GUI） +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings（表格） +![WELA Table](../assets/screenshots/table.png) + +## audit-settings（mitre-attack-navigator） +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/resources/companion-projects.ar.md b/website/docs/resources/companion-projects.ar.md new file mode 100644 index 00000000..1fc5ed2b --- /dev/null +++ b/website/docs/resources/companion-projects.ar.md @@ -0,0 +1,5 @@ +# المشاريع المصاحبة + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): دليل Yamato Security لتهيئة سجل أحداث Windows. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): أداة لتصور فجوات الكشف في قواعد Sigma والأدلة الرئيسية. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): أداة لإنشاء ملفات التهيئة المتعلقة بقواعد Sigma الخاصة بـ WELA. diff --git a/website/docs/resources/companion-projects.de.md b/website/docs/resources/companion-projects.de.md new file mode 100644 index 00000000..b85acc55 --- /dev/null +++ b/website/docs/resources/companion-projects.de.md @@ -0,0 +1,5 @@ +# Begleitprojekte + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Yamato Securitys Konfigurationsleitfaden für das Windows-Ereignisprotokoll. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Ein Werkzeug zur Visualisierung von Erkennungslücken in Sigma-Regeln und wichtigen Leitfäden. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): Ein Werkzeug zur Erzeugung der Sigma-regelbezogenen Konfigurationsdateien von WELA. diff --git a/website/docs/resources/companion-projects.es.md b/website/docs/resources/companion-projects.es.md new file mode 100644 index 00000000..fe9d974d --- /dev/null +++ b/website/docs/resources/companion-projects.es.md @@ -0,0 +1,5 @@ +# Proyectos complementarios + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Guía de configuración del registro de eventos de Windows de Yamato Security. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Una herramienta para visualizar las brechas de detección en las reglas Sigma y las principales guías. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): Una herramienta para generar los archivos de configuración relacionados con las reglas Sigma de WELA. diff --git a/website/docs/resources/companion-projects.fr.md b/website/docs/resources/companion-projects.fr.md new file mode 100644 index 00000000..97e103a5 --- /dev/null +++ b/website/docs/resources/companion-projects.fr.md @@ -0,0 +1,5 @@ +# Projets associés + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) : Guide de configuration des journaux d'événements Windows de Yamato Security. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide) : Un outil pour visualiser les lacunes de détection dans les règles Sigma et les principaux guides. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator) : Un outil pour générer les fichiers de configuration liés aux règles Sigma de WELA. diff --git a/website/docs/resources/companion-projects.hi.md b/website/docs/resources/companion-projects.hi.md new file mode 100644 index 00000000..57b7a0c9 --- /dev/null +++ b/website/docs/resources/companion-projects.hi.md @@ -0,0 +1,5 @@ +# सहयोगी परियोजनाएँ + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Yamato Security की Windows Event Log कॉन्फ़िगरेशन गाइड। +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Sigma नियमों और प्रमुख गाइडों में पहचान की कमियों को दृश्यमान करने के लिए एक टूल। +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): WELA की Sigma नियम-संबंधित कॉन्फ़िग फ़ाइलें उत्पन्न करने के लिए एक टूल। diff --git a/website/docs/resources/companion-projects.id.md b/website/docs/resources/companion-projects.id.md new file mode 100644 index 00000000..0f7664ec --- /dev/null +++ b/website/docs/resources/companion-projects.id.md @@ -0,0 +1,5 @@ +# Proyek Pendamping + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Panduan Konfigurasi Windows Event Log dari Yamato Security. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Alat untuk memvisualisasikan celah deteksi pada aturan Sigma dan panduan-panduan utama. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): Alat untuk menghasilkan berkas konfigurasi terkait aturan Sigma WELA. diff --git a/website/docs/resources/companion-projects.ko.md b/website/docs/resources/companion-projects.ko.md new file mode 100644 index 00000000..d0969fcb --- /dev/null +++ b/website/docs/resources/companion-projects.ko.md @@ -0,0 +1,5 @@ +# 관련 프로젝트 + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Yamato Security의 Windows 이벤트 로그 구성 가이드입니다. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Sigma 규칙 및 주요 가이드에서 탐지 공백을 시각화하는 도구입니다. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): WELA의 Sigma 규칙 관련 구성 파일을 생성하는 도구입니다. diff --git a/website/docs/resources/companion-projects.my.md b/website/docs/resources/companion-projects.my.md new file mode 100644 index 00000000..266b0f43 --- /dev/null +++ b/website/docs/resources/companion-projects.my.md @@ -0,0 +1,5 @@ +# တွဲဖက်ပရောဂျက်များ + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Yamato Security ၏ Windows Event Log ဖွဲ့စည်းသတ်မှတ်ခြင်း လမ်းညွှန်။ +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Sigma rules နှင့် အဓိကလမ်းညွှန်များတွင် ထောက်လှမ်းမှု ကွာဟချက်များကို မြင်သာစေရန် ကိရိယာတစ်ခု။ +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): WELA ၏ Sigma rule နှင့်ဆက်စပ်သော config ဖိုင်များကို ထုတ်လုပ်ရန် ကိရိယာတစ်ခု။ diff --git a/website/docs/resources/companion-projects.pt-BR.md b/website/docs/resources/companion-projects.pt-BR.md new file mode 100644 index 00000000..591af180 --- /dev/null +++ b/website/docs/resources/companion-projects.pt-BR.md @@ -0,0 +1,5 @@ +# Projetos Complementares + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Guia de Configuração de Log de Eventos do Windows da Yamato Security. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Uma ferramenta para visualizar lacunas de detecção em regras Sigma e nos principais guias. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): Uma ferramenta para gerar os arquivos de configuração relacionados às regras Sigma do WELA. diff --git a/website/docs/resources/companion-projects.th.md b/website/docs/resources/companion-projects.th.md new file mode 100644 index 00000000..f154249c --- /dev/null +++ b/website/docs/resources/companion-projects.th.md @@ -0,0 +1,5 @@ +# โปรเจกต์ที่เกี่ยวข้อง + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): คู่มือการตั้งค่า Windows Event Log ของ Yamato Security +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): เครื่องมือสำหรับแสดงภาพช่องว่างของการตรวจจับในกฎ Sigma และคู่มือหลักต่าง ๆ +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): เครื่องมือสำหรับสร้างไฟล์ config ที่เกี่ยวข้องกับกฎ Sigma ของ WELA diff --git a/website/docs/resources/companion-projects.tr.md b/website/docs/resources/companion-projects.tr.md new file mode 100644 index 00000000..f750f083 --- /dev/null +++ b/website/docs/resources/companion-projects.tr.md @@ -0,0 +1,5 @@ +# Tamamlayıcı Projeler + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Yamato Security'nin Windows Olay Günlüğü Yapılandırma Kılavuzu. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Sigma kurallarındaki ve başlıca kılavuzlardaki tespit boşluklarını görselleştiren bir araç. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): WELA'nın Sigma kuralıyla ilgili yapılandırma dosyalarını oluşturmaya yönelik bir araç. diff --git a/website/docs/resources/companion-projects.uk.md b/website/docs/resources/companion-projects.uk.md new file mode 100644 index 00000000..07793e97 --- /dev/null +++ b/website/docs/resources/companion-projects.uk.md @@ -0,0 +1,5 @@ +# Супутні проєкти + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Посібник Yamato Security з налаштування журналу подій Windows. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Інструмент для візуалізації прогалин у виявленні в правилах Sigma та основних посібниках. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): Інструмент для генерації конфігураційних файлів, пов'язаних із правилами Sigma для WELA. diff --git a/website/docs/resources/companion-projects.zh-TW.md b/website/docs/resources/companion-projects.zh-TW.md new file mode 100644 index 00000000..3c77039a --- /dev/null +++ b/website/docs/resources/companion-projects.zh-TW.md @@ -0,0 +1,5 @@ +# 相關專案 + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings)：Yamato Security 的 Windows 事件記錄檔設定指南。 +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide)：用於視覺化呈現 Sigma 規則與主要指南中偵測缺口的工具。 +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator)：用於產生 WELA 的 Sigma 規則相關設定檔的工具。 diff --git a/website/docs/resources/contributing.ar.md b/website/docs/resources/contributing.ar.md new file mode 100644 index 00000000..648550fa --- /dev/null +++ b/website/docs/resources/contributing.ar.md @@ -0,0 +1,30 @@ +# المساهمة والدعم + +## المساهمات + +يسعدنا تلقي أي شكل من أشكال المساهمة. +طلبات السحب (Pull requests) هي الأفضل، لكن طلبات الميزات وإبلاغنا بالأخطاء وما إلى ذلك من خلال المشكلات (issues) مرحب بها أيضًا. + +على أقل تقدير، **إذا أعجبتك أدواتنا ومواردنا، فيرجى منحنا نجمة على GitHub وإظهار دعمك!** + +## إرسال الأخطاء + +* يرجى إرسال أي أخطاء تجدها [هنا.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* تتم صيانة هذا المشروع بنشاط حاليًا، ويسعدنا إصلاح أي أخطاء يتم الإبلاغ عنها. + +## الترخيص + +* يتم إصدار WELA بموجب [ترخيص MIT](https://opensource.org/licenses/MIT). + +## المساهمون + +* Fukusuke Takahashi (المطور الأساسي) +* Zach Mathis (قائد المشروع، تصميم الأدوات، الاختبار، وما إلى ذلك...) (@yamatosecurity) + +## شكر وتقدير + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.de.md b/website/docs/resources/contributing.de.md new file mode 100644 index 00000000..602acb42 --- /dev/null +++ b/website/docs/resources/contributing.de.md @@ -0,0 +1,30 @@ +# Mitwirken & Support + +## Beiträge + +Wir würden uns über jede Form von Beitrag freuen. +Pull Requests sind am besten, aber auch Feature-Anfragen, die uns über Bugs usw. mittels Issues informieren, sind sehr willkommen. + +Zumindest: **Wenn Ihnen unsere Tools und Ressourcen gefallen, dann geben Sie uns bitte einen Stern auf GitHub und zeigen Sie Ihre Unterstützung!** + +## Bug-Meldung + +* Bitte melden Sie alle gefundenen Bugs [hier.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* Dieses Projekt wird derzeit aktiv gepflegt, und wir beheben gemeldete Bugs gerne. + +## Lizenz + +* WELA wird unter der [MIT License](https://opensource.org/licenses/MIT) veröffentlicht. + +## Mitwirkende + +* Fukusuke Takahashi (Hauptentwickler) +* Zach Mathis (Projektleiter, Tool-Design, Tests usw.) (@yamatosecurity) + +## Danksagungen + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.es.md b/website/docs/resources/contributing.es.md new file mode 100644 index 00000000..ec80aa4c --- /dev/null +++ b/website/docs/resources/contributing.es.md @@ -0,0 +1,30 @@ +# Contribuciones y soporte + +## Contribuciones + +Nos encantaría recibir cualquier forma de contribución. +Las pull requests son lo mejor, pero las solicitudes de funciones que nos notifiquen errores, etc... a través de issues también son muy bienvenidas. + +Como mínimo, **si te gustan nuestras herramientas y recursos, ¡danos una estrella en GitHub y muestra tu apoyo!** + +## Envío de errores + +* Por favor, envía cualquier error que encuentres [aquí.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* Este proyecto se mantiene actualmente de forma activa, y estaremos encantados de corregir cualquier error reportado. + +## Licencia + +* WELA se publica bajo la [Licencia MIT](https://opensource.org/licenses/MIT). + +## Colaboradores + +* Fukusuke Takahashi (desarrollador principal) +* Zach Mathis (líder del proyecto, diseño de herramientas, pruebas, etc...) (@yamatosecurity) + +## Agradecimientos + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.fr.md b/website/docs/resources/contributing.fr.md new file mode 100644 index 00000000..023eafb2 --- /dev/null +++ b/website/docs/resources/contributing.fr.md @@ -0,0 +1,30 @@ +# Contribution et support + +## Contributions + +Nous serions ravis de recevoir toute forme de contribution. +Les pull requests sont idéales, mais les demandes de fonctionnalités, les signalements de bugs, etc. via les issues sont également les bienvenus. + +Au minimum, **si vous appréciez nos outils et nos ressources, alors n'hésitez pas à nous attribuer une étoile sur GitHub et à montrer votre soutien !** + +## Signalement de bugs + +* Veuillez signaler tout bug que vous trouvez [ici.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* Ce projet est actuellement activement maintenu, et nous serons heureux de corriger tout bug signalé. + +## Licence + +* WELA est distribué sous la [licence MIT](https://opensource.org/licenses/MIT). + +## Contributeurs + +* Fukusuke Takahashi (développeur principal) +* Zach Mathis (chef de projet, conception de l'outil, tests, etc.) (@yamatosecurity) + +## Remerciements + +* [Australian Cyber Security Centre : Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft : Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.hi.md b/website/docs/resources/contributing.hi.md new file mode 100644 index 00000000..07e25f32 --- /dev/null +++ b/website/docs/resources/contributing.hi.md @@ -0,0 +1,30 @@ +# योगदान और समर्थन + +## योगदान + +हम किसी भी प्रकार के योगदान का स्वागत करते हैं। +पुल रिक्वेस्ट सबसे अच्छे हैं, लेकिन इश्यू के माध्यम से बग्स आदि के बारे में हमें सूचित करने वाले फीचर रिक्वेस्ट का भी हम बहुत स्वागत करते हैं। + +कम से कम, **यदि आपको हमारे टूल और संसाधन पसंद आते हैं, तो कृपया GitHub पर हमें एक स्टार दें और अपना समर्थन दिखाएं!** + +## बग सबमिशन + +* कृपया अपने द्वारा पाए गए किसी भी बग को [यहाँ](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) सबमिट करें। +* यह प्रोजेक्ट वर्तमान में सक्रिय रूप से मेंटेन किया जा रहा है, और हमें रिपोर्ट किए गए किसी भी बग को ठीक करने में खुशी होगी। + +## लाइसेंस + +* WELA को [MIT License](https://opensource.org/licenses/MIT) के तहत जारी किया गया है। + +## योगदानकर्ता + +* Fukusuke Takahashi (कोर डेवलपर) +* Zach Mathis (प्रोजेक्ट लीडर, टूल डिज़ाइन, टेस्टिंग, आदि) (@yamatosecurity) + +## आभार + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.id.md b/website/docs/resources/contributing.id.md new file mode 100644 index 00000000..3b1b6106 --- /dev/null +++ b/website/docs/resources/contributing.id.md @@ -0,0 +1,30 @@ +# Kontribusi & Dukungan + +## Kontribusi + +Kami akan sangat senang menerima segala bentuk kontribusi. +Pull request adalah yang terbaik, tetapi permintaan fitur yang memberitahu kami tentang bug, dll... melalui issue juga sangat kami sambut. + +Setidaknya, **jika Anda menyukai alat dan sumber daya kami, mohon berikan kami bintang di GitHub dan tunjukkan dukungan Anda!** + +## Pengiriman Bug + +* Silakan kirimkan bug apa pun yang Anda temukan [di sini.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* Proyek ini saat ini dipelihara secara aktif, dan kami dengan senang hati memperbaiki bug apa pun yang dilaporkan. + +## Lisensi + +* WELA dirilis di bawah [MIT License](https://opensource.org/licenses/MIT). + +## Kontributor + +* Fukusuke Takahashi (pengembang inti) +* Zach Mathis (pemimpin proyek, desain alat, pengujian, dll...) (@yamatosecurity) + +## Ucapan Terima Kasih + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.ko.md b/website/docs/resources/contributing.ko.md new file mode 100644 index 00000000..1bb56795 --- /dev/null +++ b/website/docs/resources/contributing.ko.md @@ -0,0 +1,30 @@ +# 기여 및 지원 + +## 기여 + +어떤 형태의 기여라도 환영합니다. +풀 리퀘스트가 가장 좋지만, 이슈를 통해 버그 등을 알려주는 기능 요청도 매우 환영합니다. + +적어도, **저희 도구와 리소스가 마음에 드신다면 GitHub에서 별표를 눌러 지지를 보여주세요!** + +## 버그 제출 + +* 발견한 버그는 [여기에서](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) 제출해 주세요. +* 이 프로젝트는 현재 활발히 유지 관리되고 있으며, 보고된 버그를 기꺼이 수정합니다. + +## 라이선스 + +* WELA는 [MIT License](https://opensource.org/licenses/MIT) 하에 배포됩니다. + +## 기여자 + +* Fukusuke Takahashi (핵심 개발자) +* Zach Mathis (프로젝트 리더, 도구 설계, 테스트 등) (@yamatosecurity) + +## 감사의 말 + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.my.md b/website/docs/resources/contributing.my.md new file mode 100644 index 00000000..dbffb162 --- /dev/null +++ b/website/docs/resources/contributing.my.md @@ -0,0 +1,30 @@ +# ပံ့ပိုးကူညီခြင်းနှင့် ပံ့ပိုးမှု + +## ပံ့ပိုးကူညီမှုများ + +မည်သည့်ပုံစံဖြင့်မဆို ပံ့ပိုးကူညီမှုကို ကျွန်ုပ်တို့ ကြိုဆိုပါသည်။ +Pull request များသည် အကောင်းဆုံးဖြစ်သော်လည်း၊ issue များမှတစ်ဆင့် bug များ စသည်တို့ကို ကျွန်ုပ်တို့အား အသိပေးသည့် feature တောင်းဆိုမှုများကိုလည်း အလွန်ကြိုဆိုပါသည်။ + +အနည်းဆုံးအားဖြင့်၊ **ကျွန်ုပ်တို့၏ tool များနှင့် အရင်းအမြစ်များကို သင်နှစ်သက်ပါက၊ ကျေးဇူးပြု၍ GitHub တွင် ကျွန်ုပ်တို့အား star ပေး၍ သင်၏ပံ့ပိုးမှုကို ပြသပါ!** + +## Bug တင်ပြခြင်း + +* သင်တွေ့ရှိသည့် မည်သည့် bug ကိုမဆို [ဤနေရာတွင်](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) ကျေးဇူးပြု၍ တင်ပြပါ။ +* ဤ project ကို လက်ရှိတွင် တက်ကြွစွာ ထိန်းသိမ်းနေပြီး၊ တင်ပြလာသည့် မည်သည့် bug ကိုမဆို ပြုပြင်ရန် ကျွန်ုပ်တို့ ဝမ်းသာပါသည်။ + +## လိုင်စင် + +* WELA ကို [MIT License](https://opensource.org/licenses/MIT) အောက်တွင် ထုတ်ဝေထားပါသည်။ + +## ပံ့ပိုးကူညီသူများ + +* Fukusuke Takahashi (core developer) +* Zach Mathis (project leader, tool design, testing, etc...) (@yamatosecurity) + +## ကျေးဇူးတင်လွှာ + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.pt-BR.md b/website/docs/resources/contributing.pt-BR.md new file mode 100644 index 00000000..d4acad38 --- /dev/null +++ b/website/docs/resources/contributing.pt-BR.md @@ -0,0 +1,30 @@ +# Contribuições e Suporte + +## Contribuições + +Adoraríamos qualquer forma de contribuição. +Pull requests são as melhores, mas solicitações de funcionalidades, nos notificando sobre bugs, etc... por meio de issues também são muito bem-vindas. + +No mínimo, **se você gosta das nossas ferramentas e recursos, então por favor nos dê uma estrela no GitHub e mostre seu apoio!** + +## Envio de Bugs + +* Por favor, envie quaisquer bugs que você encontrar [aqui.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* Este projeto está atualmente sendo mantido ativamente, e ficamos felizes em corrigir quaisquer bugs reportados. + +## Licença + +* O WELA é distribuído sob a [Licença MIT](https://opensource.org/licenses/MIT). + +## Contribuidores + +* Fukusuke Takahashi (desenvolvedor principal) +* Zach Mathis (líder do projeto, design da ferramenta, testes, etc...) (@yamatosecurity) + +## Agradecimentos + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.th.md b/website/docs/resources/contributing.th.md new file mode 100644 index 00000000..ef07d3e0 --- /dev/null +++ b/website/docs/resources/contributing.th.md @@ -0,0 +1,30 @@ +# การมีส่วนร่วมและการสนับสนุน + +## การมีส่วนร่วม + +เรายินดีรับการมีส่วนร่วมในทุกรูปแบบ +Pull request เป็นสิ่งที่ดีที่สุด แต่คำขอฟีเจอร์ การแจ้งบั๊กต่าง ๆ ผ่าน issue ก็เป็นที่ยินดีอย่างยิ่งเช่นกัน + +อย่างน้อยที่สุด **หากคุณชื่นชอบเครื่องมือและทรัพยากรของเรา โปรดให้ดาวเราบน GitHub และแสดงการสนับสนุนของคุณ!** + +## การส่งรายงานบั๊ก + +* โปรดส่งบั๊กใด ๆ ที่คุณพบ [ที่นี่](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* โปรเจกต์นี้กำลังอยู่ในระหว่างการดูแลรักษาอย่างต่อเนื่อง และเรายินดีที่จะแก้ไขบั๊กใด ๆ ที่ได้รับรายงาน + +## สัญญาอนุญาต + +* WELA เผยแพร่ภายใต้ [MIT License](https://opensource.org/licenses/MIT) + +## ผู้มีส่วนร่วม + +* Fukusuke Takahashi (นักพัฒนาหลัก) +* Zach Mathis (หัวหน้าโปรเจกต์, การออกแบบเครื่องมือ, การทดสอบ ฯลฯ) (@yamatosecurity) + +## กิตติกรรมประกาศ + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.tr.md b/website/docs/resources/contributing.tr.md new file mode 100644 index 00000000..bae0218b --- /dev/null +++ b/website/docs/resources/contributing.tr.md @@ -0,0 +1,30 @@ +# Katkıda Bulunma ve Destek + +## Katkılar + +Her türlü katkıyı memnuniyetle karşılarız. +En iyisi pull request'lerdir, ancak issue'lar aracılığıyla bizi hatalardan vb. haberdar eden özellik istekleri de çok hoş karşılanır. + +En azından, **araçlarımızı ve kaynaklarımızı beğeniyorsanız, lütfen GitHub'da bize bir yıldız verin ve desteğinizi gösterin!** + +## Hata Bildirimi + +* Bulduğunuz hataları lütfen [buradan](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) bildirin. +* Bu proje şu anda aktif olarak bakımı yapılan bir projedir ve bildirilen her hatayı düzeltmekten memnuniyet duyarız. + +## Lisans + +* WELA [MIT Lisansı](https://opensource.org/licenses/MIT) altında yayınlanmıştır. + +## Katkıda Bulunanlar + +* Fukusuke Takahashi (çekirdek geliştirici) +* Zach Mathis (proje lideri, araç tasarımı, test, vb...) (@yamatosecurity) + +## Teşekkürler + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.uk.md b/website/docs/resources/contributing.uk.md new file mode 100644 index 00000000..a2c1aa1b --- /dev/null +++ b/website/docs/resources/contributing.uk.md @@ -0,0 +1,30 @@ +# Внесок та підтримка + +## Внески + +Ми будемо раді будь-якій формі внеску. +Pull request — це найкраще, але запити на функції, повідомлення про помилки тощо через issues також дуже вітаються. + +Як мінімум, **якщо вам подобаються наші інструменти та ресурси, будь ласка, поставте нам зірочку на GitHub і виявіть свою підтримку!** + +## Подання повідомлень про помилки + +* Будь ласка, надсилайте будь-які помилки, які ви знайдете, [сюди.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* Цей проєкт наразі активно підтримується, і ми будемо раді виправити будь-які повідомлені помилки. + +## Ліцензія + +* WELA випускається під [ліцензією MIT](https://opensource.org/licenses/MIT). + +## Учасники + +* Fukusuke Takahashi (основний розробник) +* Zach Mathis (керівник проєкту, дизайн інструментів, тестування тощо) (@yamatosecurity) + +## Подяки + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.zh-TW.md b/website/docs/resources/contributing.zh-TW.md new file mode 100644 index 00000000..2e2df32f --- /dev/null +++ b/website/docs/resources/contributing.zh-TW.md @@ -0,0 +1,30 @@ +# 貢獻與支援 + +## 貢獻 + +我們非常歡迎任何形式的貢獻。 +Pull request 是最好的方式，但透過 issue 通知我們功能需求、回報錯誤等也都非常歡迎。 + +至少，**如果您喜歡我們的工具與資源，請在 GitHub 上給我們一顆星，表達您的支持！** + +## 錯誤回報 + +* 請在[此處](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D)回報您發現的任何錯誤。 +* 本專案目前正積極維護中，我們很樂意修正任何回報的錯誤。 + +## 授權 + +* WELA 以 [MIT License](https://opensource.org/licenses/MIT) 釋出。 + +## 貢獻者 + +* Fukusuke Takahashi（核心開發者） +* Zach Mathis（專案負責人、工具設計、測試等）（@yamatosecurity） + +## 致謝 + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/other-resources.ar.md b/website/docs/resources/other-resources.ar.md new file mode 100644 index 00000000..d9a6a807 --- /dev/null +++ b/website/docs/resources/other-resources.ar.md @@ -0,0 +1,9 @@ +# موارد أخرى متعلقة بإعدادات تدقيق سجل أحداث Windows + +* [نهج قائم على البيانات لسياسة التدقيق المتقدمة في Windows – ما الذي يجب تمكينه ولماذا](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [توصيات سياسة التدقيق](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [تكوين سياسات التدقيق لسجلات أحداث Windows](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [تسجيل أحداث Windows وإعادة توجيهها](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.de.md b/website/docs/resources/other-resources.de.md new file mode 100644 index 00000000..7e44e085 --- /dev/null +++ b/website/docs/resources/other-resources.de.md @@ -0,0 +1,9 @@ +# Weitere Ressourcen zu Audit-Einstellungen für Windows-Ereignisprotokolle + +* [A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Audit Policy Recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configure audit policies for Windows event logs](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.es.md b/website/docs/resources/other-resources.es.md new file mode 100644 index 00000000..dc6c8a2d --- /dev/null +++ b/website/docs/resources/other-resources.es.md @@ -0,0 +1,9 @@ +# Otros recursos relacionados con la configuración de auditoría del Registro de eventos de Windows + +* [A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Audit Policy Recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configure audit policies for Windows event logs](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.fr.md b/website/docs/resources/other-resources.fr.md new file mode 100644 index 00000000..d9910c1a --- /dev/null +++ b/website/docs/resources/other-resources.fr.md @@ -0,0 +1,9 @@ +# Autres ressources liées aux paramètres d'audit des journaux d'événements Windows + +* [Une approche fondée sur les données pour la stratégie d'audit avancée de Windows – Quoi activer et pourquoi](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Recommandations de stratégie d'audit](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configurer les stratégies d'audit pour les journaux d'événements Windows](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Journalisation et transfert des événements Windows](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.hi.md b/website/docs/resources/other-resources.hi.md new file mode 100644 index 00000000..f6e248c6 --- /dev/null +++ b/website/docs/resources/other-resources.hi.md @@ -0,0 +1,9 @@ +# अन्य Windows इवेंट लॉग ऑडिट सेटिंग्स से संबंधित संसाधन + +* [Windows एडवांस्ड ऑडिट पॉलिसी के लिए एक डेटा-संचालित दृष्टिकोण – क्या सक्षम करें और क्यों](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [ऑडिट पॉलिसी अनुशंसाएँ](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Windows इवेंट लॉग के लिए ऑडिट पॉलिसी कॉन्फ़िगर करें](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows इवेंट लॉगिंग और फ़ॉरवर्डिंग](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.id.md b/website/docs/resources/other-resources.id.md new file mode 100644 index 00000000..55c72fd0 --- /dev/null +++ b/website/docs/resources/other-resources.id.md @@ -0,0 +1,9 @@ +# Sumber Daya Terkait Pengaturan Audit Log Peristiwa Windows Lainnya + +* [A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Audit Policy Recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configure audit policies for Windows event logs](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.ko.md b/website/docs/resources/other-resources.ko.md new file mode 100644 index 00000000..c371d595 --- /dev/null +++ b/website/docs/resources/other-resources.ko.md @@ -0,0 +1,9 @@ +# 기타 Windows 이벤트 로그 감사 설정 관련 자료 + +* [데이터 기반 Windows 고급 감사 정책 접근법 – 무엇을 활성화하고 왜 그래야 하는가](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [감사 정책 권장 사항](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Windows 이벤트 로그를 위한 감사 정책 구성](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows 이벤트 로깅 및 전달](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.my.md b/website/docs/resources/other-resources.my.md new file mode 100644 index 00000000..1c11cc7c --- /dev/null +++ b/website/docs/resources/other-resources.my.md @@ -0,0 +1,9 @@ +# အခြား Windows Event Log စစ်ဆေးရေးဆက်တင်များနှင့် သက်ဆိုင်သော အရင်းအမြစ်များ + +* [A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Audit Policy Recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configure audit policies for Windows event logs](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.pt-BR.md b/website/docs/resources/other-resources.pt-BR.md new file mode 100644 index 00000000..b9d7e82b --- /dev/null +++ b/website/docs/resources/other-resources.pt-BR.md @@ -0,0 +1,9 @@ +# Outros recursos relacionados às configurações de auditoria de logs de eventos do Windows + +* [Uma abordagem orientada a dados para a Política de Auditoria Avançada do Windows – O que habilitar e por quê](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Recomendações de Política de Auditoria](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configurar políticas de auditoria para logs de eventos do Windows](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Registro e encaminhamento de eventos do Windows](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.th.md b/website/docs/resources/other-resources.th.md new file mode 100644 index 00000000..417170f6 --- /dev/null +++ b/website/docs/resources/other-resources.th.md @@ -0,0 +1,9 @@ +# แหล่งข้อมูลอื่น ๆ ที่เกี่ยวข้องกับการตั้งค่าการตรวจสอบ Windows Event Log + +* [A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Audit Policy Recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configure audit policies for Windows event logs](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.tr.md b/website/docs/resources/other-resources.tr.md new file mode 100644 index 00000000..6e8c126d --- /dev/null +++ b/website/docs/resources/other-resources.tr.md @@ -0,0 +1,9 @@ +# Windows Olay Günlüğü Denetim Ayarlarıyla İlgili Diğer Kaynaklar + +* [Windows Gelişmiş Denetim İlkesine Veri Odaklı Bir Yaklaşım – Neyi Etkinleştirmeli ve Neden](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Denetim İlkesi Önerileri](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Windows olay günlükleri için denetim ilkelerini yapılandırma](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows olay günlüğü kaydı ve iletme](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.uk.md b/website/docs/resources/other-resources.uk.md new file mode 100644 index 00000000..2664ccbd --- /dev/null +++ b/website/docs/resources/other-resources.uk.md @@ -0,0 +1,9 @@ +# Інші ресурси, пов'язані з налаштуваннями аудиту журналів подій Windows + +* [Підхід на основі даних до розширеної політики аудиту Windows – що ввімкнути та чому](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Рекомендації щодо політики аудиту](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Налаштування політик аудиту для журналів подій Windows](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Журналювання та пересилання подій Windows](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.zh-TW.md b/website/docs/resources/other-resources.zh-TW.md new file mode 100644 index 00000000..5076f6c9 --- /dev/null +++ b/website/docs/resources/other-resources.zh-TW.md @@ -0,0 +1,9 @@ +# 其他 Windows 事件記錄稽核設定相關資源 + +* [資料驅動的 Windows 進階稽核原則方法 – 該啟用什麼以及為什麼](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [稽核原則建議](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [為 Windows 事件記錄設定稽核原則](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows 事件記錄與轉送](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/mkdocs.yml b/website/mkdocs.yml index 1741e65d..369471ec 100644 --- a/website/mkdocs.yml +++ b/website/mkdocs.yml @@ -135,42 +135,237 @@ plugins: - locale: zh-TW name: 繁體中文 build: true + nav_translations: + "Home": "首頁" + "Overview": "概觀" + "About WELA": "關於 WELA" + "Features": "功能特色" + "Screenshots": "螢幕截圖" + "Getting Started": "快速入門" + "Commands": "命令" + "Command List": "命令清單" + "Command Usage": "命令用法" + "Resources": "資源" + "Companion Projects": "相關專案" + "Other Resources": "其他資源" + "Changelog": "變更紀錄" + "Contributing & Support": "貢獻與支援" - locale: ko name: 한국어 build: true + nav_translations: + "Home": "홈" + "Overview": "개요" + "About WELA": "WELA 소개" + "Features": "기능" + "Screenshots": "스크린샷" + "Getting Started": "시작하기" + "Commands": "명령어" + "Command List": "명령어 목록" + "Command Usage": "명령어 사용법" + "Resources": "리소스" + "Companion Projects": "관련 프로젝트" + "Other Resources": "기타 리소스" + "Changelog": "변경 이력" + "Contributing & Support": "기여 및 지원" - locale: de name: Deutsch build: true + nav_translations: + "Home": "Startseite" + "Overview": "Übersicht" + "About WELA": "Über WELA" + "Features": "Funktionen" + "Screenshots": "Screenshots" + "Getting Started": "Erste Schritte" + "Commands": "Befehle" + "Command List": "Befehlsliste" + "Command Usage": "Befehlsverwendung" + "Resources": "Ressourcen" + "Companion Projects": "Begleitprojekte" + "Other Resources": "Weitere Ressourcen" + "Changelog": "Änderungsprotokoll" + "Contributing & Support": "Mitwirken & Support" - locale: tr name: Türkçe build: true + nav_translations: + "Home": "Ana Sayfa" + "Overview": "Genel Bakış" + "About WELA": "WELA Hakkında" + "Features": "Özellikler" + "Screenshots": "Ekran Görüntüleri" + "Getting Started": "Başlarken" + "Commands": "Komutlar" + "Command List": "Komut Listesi" + "Command Usage": "Komut Kullanımı" + "Resources": "Kaynaklar" + "Companion Projects": "Tamamlayıcı Projeler" + "Other Resources": "Diğer Kaynaklar" + "Changelog": "Değişiklik Günlüğü" + "Contributing & Support": "Katkıda Bulunma ve Destek" - locale: fr name: Français build: true + nav_translations: + "Home": "Accueil" + "Overview": "Aperçu" + "About WELA": "À propos de WELA" + "Features": "Fonctionnalités" + "Screenshots": "Captures d'écran" + "Getting Started": "Premiers pas" + "Commands": "Commandes" + "Command List": "Liste des commandes" + "Command Usage": "Utilisation des commandes" + "Resources": "Ressources" + "Companion Projects": "Projets associés" + "Other Resources": "Autres ressources" + "Changelog": "Journal des modifications" + "Contributing & Support": "Contribution et support" - locale: es name: Español build: true + nav_translations: + "Home": "Inicio" + "Overview": "Visión general" + "About WELA": "Acerca de WELA" + "Features": "Características" + "Screenshots": "Capturas de pantalla" + "Getting Started": "Primeros pasos" + "Commands": "Comandos" + "Command List": "Lista de comandos" + "Command Usage": "Uso de comandos" + "Resources": "Recursos" + "Companion Projects": "Proyectos complementarios" + "Other Resources": "Otros recursos" + "Changelog": "Registro de cambios" + "Contributing & Support": "Contribución y soporte" - locale: pt-BR name: Português (Brasil) build: true + nav_translations: + "Home": "Início" + "Overview": "Visão Geral" + "About WELA": "Sobre o WELA" + "Features": "Recursos" + "Screenshots": "Capturas de Tela" + "Getting Started": "Primeiros Passos" + "Commands": "Comandos" + "Command List": "Lista de Comandos" + "Command Usage": "Uso dos Comandos" + "Resources": "Recursos" + "Companion Projects": "Projetos Complementares" + "Other Resources": "Outros Recursos" + "Changelog": "Registro de Alterações" + "Contributing & Support": "Contribuição e Suporte" - locale: uk name: Українська build: true + nav_translations: + "Home": "Головна" + "Overview": "Огляд" + "About WELA": "Про WELA" + "Features": "Можливості" + "Screenshots": "Знімки екрана" + "Getting Started": "Початок роботи" + "Commands": "Команди" + "Command List": "Список команд" + "Command Usage": "Використання команд" + "Resources": "Ресурси" + "Companion Projects": "Супутні проєкти" + "Other Resources": "Інші ресурси" + "Changelog": "Журнал змін" + "Contributing & Support": "Внесок і підтримка" - locale: hi name: हिन्दी build: true + nav_translations: + "Home": "मुख्य पृष्ठ" + "Overview": "अवलोकन" + "About WELA": "WELA के बारे में" + "Features": "विशेषताएँ" + "Screenshots": "स्क्रीनशॉट" + "Getting Started": "शुरुआत करना" + "Commands": "कमांड" + "Command List": "कमांड सूची" + "Command Usage": "कमांड उपयोग" + "Resources": "संसाधन" + "Companion Projects": "सहयोगी परियोजनाएँ" + "Other Resources": "अन्य संसाधन" + "Changelog": "परिवर्तन सूची" + "Contributing & Support": "योगदान और सहायता" - locale: id name: Bahasa Indonesia build: true + nav_translations: + "Home": "Beranda" + "Overview": "Ikhtisar" + "About WELA": "Tentang WELA" + "Features": "Fitur" + "Screenshots": "Tangkapan Layar" + "Getting Started": "Memulai" + "Commands": "Perintah" + "Command List": "Daftar Perintah" + "Command Usage": "Penggunaan Perintah" + "Resources": "Sumber Daya" + "Companion Projects": "Proyek Pendamping" + "Other Resources": "Sumber Daya Lainnya" + "Changelog": "Catatan Perubahan" + "Contributing & Support": "Kontribusi & Dukungan" - locale: my name: မြန်မာဘာသာ build: true + nav_translations: + "Home": "ပင်မစာမျက်နှာ" + "Overview": "ခြုံငုံသုံးသပ်ချက်" + "About WELA": "WELA အကြောင်း" + "Features": "လုပ်ဆောင်ချက်များ" + "Screenshots": "မျက်နှာပြင်ဓာတ်ပုံများ" + "Getting Started": "စတင်အသုံးပြုခြင်း" + "Commands": "ညွှန်ကြားချက်များ" + "Command List": "ညွှန်ကြားချက်စာရင်း" + "Command Usage": "ညွှန်ကြားချက်အသုံးပြုပုံ" + "Resources": "အရင်းအမြစ်များ" + "Companion Projects": "ဆက်စပ်ပရောဂျက်များ" + "Other Resources": "အခြားအရင်းအမြစ်များ" + "Changelog": "ပြောင်းလဲမှုမှတ်တမ်း" + "Contributing & Support": "ပါဝင်ကူညီခြင်းနှင့် ပံ့ပိုးမှု" - locale: th name: ไทย build: true + nav_translations: + "Home": "หน้าแรก" + "Overview": "ภาพรวม" + "About WELA": "เกี่ยวกับ WELA" + "Features": "คุณสมบัติ" + "Screenshots": "ภาพหน้าจอ" + "Getting Started": "เริ่มต้นใช้งาน" + "Commands": "คำสั่ง" + "Command List": "รายการคำสั่ง" + "Command Usage": "การใช้งานคำสั่ง" + "Resources": "แหล่งข้อมูล" + "Companion Projects": "โครงการที่เกี่ยวข้อง" + "Other Resources": "แหล่งข้อมูลอื่น ๆ" + "Changelog": "บันทึกการเปลี่ยนแปลง" + "Contributing & Support": "การมีส่วนร่วมและการสนับสนุน" - locale: ar name: العربية build: true + nav_translations: + "Home": "الرئيسية" + "Overview": "نظرة عامة" + "About WELA": "حول WELA" + "Features": "الميزات" + "Screenshots": "لقطات الشاشة" + "Getting Started": "البدء" + "Commands": "الأوامر" + "Command List": "قائمة الأوامر" + "Command Usage": "استخدام الأوامر" + "Resources": "الموارد" + "Companion Projects": "المشاريع المصاحبة" + "Other Resources": "موارد أخرى" + "Changelog": "سجل التغييرات" + "Contributing & Support": "المساهمة والدعم" extra: social: