diff --git a/WELA.ps1 b/WELA.ps1 index 54941d14..ccb7d8e8 100644 --- a/WELA.ps1 +++ b/WELA.ps1 @@ -14,6 +14,10 @@ $jsonContent = Get-Content -Path $jsonFilePath -Raw | ConvertFrom-Json foreach ($rule in $jsonContent) { $rule | Add-Member -MemberType NoteProperty -Name "applicable" -Value $false + if ($rule.channel -eq "pwsh") { + $rule.applicable = $true + continue + } foreach ($guid in $rule.subcategory_guids) { if ($extractedGuids.Contains($guid)) { $rule.applicable = $true @@ -34,7 +38,7 @@ function Get-RuleCounts { } } -function CalculatePercentages { +function CalculateRate { param ($counts, $totalCounts) $counts | ForEach-Object { $total = ($totalCounts | Where-Object Level -match $PSItem.Level | Select-Object -ExpandProperty Count)[0] @@ -47,12 +51,12 @@ function CalculatePercentages { } } -function DisplayRulePercentages { - param ($usablePercentages, $msg) +function DisplayRuleRate { + param ($usableRate, $msg) Write-Output $msg $customOrder = @("critical", "high", "medium", "low", "informational") - $usablePercentages = $usablePercentages | Sort-Object { $customOrder.IndexOf($_.Level) } - $usablePercentages | ForEach-Object { + $usableRate = $usableRate | Sort-Object { $customOrder.IndexOf($_.Level) } + $usableRate | ForEach-Object { Write-Output "$($_.Level) rules: $($_.UsableCount) / $($_.TotalCount) ($($_.Percentage)%)" } Write-Output "" @@ -82,25 +86,25 @@ $rules = Get-ApplicableRules -outputFilePath $outputFilePath -jsonFilePath "./co # Step 4: Count the number of usable and unusable rules for each level $usableSecRules = $rules | Where-Object { $_.applicable -eq $true -and $_.channel -eq "sec" } -$usablePwshRules = $rules | Where-Object { $_.channel -eq "pwsh" } -$unusableRules = $rules | Where-Object { $_.applicable -eq $false -and $_.channel -eq "sec" } +$usablePwsRules = $rules | Where-Object { $_.applicable -eq $true -and $_.channel -eq "pwsh" } +$unusableRules = $rules | Where-Object { $_.applicable -eq $false } -$totalCounts = Get-RuleCounts -rules $rules +$totalCounts = Get-RuleCounts -rules $rules $usableSecCounts = Get-RuleCounts -rules $usableSecRules -$usablePwsCounts = Get-RuleCounts -rules $usablePwshRules +$usablePwsCounts = Get-RuleCounts -rules $usablePwsRules -# Step 5: Calculate the percentages -$usableSecPercentages = CalculatePercentages -counts $usableSecCounts -totalCounts $totalCounts -$usablePwsPercentages = CalculatePercentages -counts $usablePwsCounts -totalCounts $usablePwsCounts +# Step 5: Calculate the Rate +$usableSecRate = CalculateRate -counts $usableSecCounts -totalCounts $totalCounts +$usablePwsRate = CalculateRate -counts $usablePwsCounts -totalCounts $usablePwsCounts # Step 6: Generate the required outputtotal -DisplayRulePercentages -usablePercentages $usableSecPercentages -msg "Security event log detection rules:" -DisplayRulePercentages -usablePercentages $usablePwsPercentages -msg "PowerShell event log detection rules:" +DisplayRuleRate -usableRate $usableSecRate -msg "Security event log detection rules:" +DisplayRuleRate -usableRate $usablePwsRate -msg "PowerShell event log detection rules:" Write-Output "Usable detection rules list saved to: UsableRules.csv" Write-Output "Unusable detection rules list saved to: UnusableRules.csv" Write-Output "" -$totalUsable = ($usableSecPercentages + $usablePwsPercentages| Measure-Object -Property UsableCount -Sum).Sum +$totalUsable = ($usableSecRate + $usablePwsRate| Measure-Object -Property UsableCount -Sum).Sum $totalRulesCount = ($totalCounts | Measure-Object -Property Count -Sum).Sum $utilizationPercentage = "{0:N2}" -f (($totalUsable / $totalRulesCount) * 100) Write-Output "You can utilize $utilizationPercentage% of your detection rules."