CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-06 17:22:50 +01:00
Code Issues Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
fukusuket
2025-03-14 23:29:49 +09:00
parent e69cf1fbde
commit af8d0de0be
1 changed files with 19 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
WELA.ps1
View File

@@ -14,6 +14,10 @@
$jsonContent = Get-Content -Path $jsonFilePath -Raw | ConvertFrom-Json $jsonContent = Get-Content -Path $jsonFilePath -Raw | ConvertFrom-Json
foreach ($rule in $jsonContent) { foreach ($rule in $jsonContent) {
$rule | Add-Member -MemberType NoteProperty -Name "applicable" -Value $false $rule | Add-Member -MemberType NoteProperty -Name "applicable" -Value $false
if ($rule.channel -eq "pwsh") {
$rule.applicable = $true
continue
}
foreach ($guid in $rule.subcategory_guids) { foreach ($guid in $rule.subcategory_guids) {
if ($extractedGuids.Contains($guid)) { if ($extractedGuids.Contains($guid)) {
$rule.applicable = $true $rule.applicable = $true
@@ -34,7 +38,7 @@ function Get-RuleCounts {
} }
} }
function CalculatePercentages { function CalculateRate {
param ($counts, $totalCounts) param ($counts, $totalCounts)
$counts | ForEach-Object { $counts | ForEach-Object {
$total = ($totalCounts | Where-Object Level -match $PSItem.Level | Select-Object -ExpandProperty Count)[0] $total = ($totalCounts | Where-Object Level -match $PSItem.Level | Select-Object -ExpandProperty Count)[0]
@@ -47,12 +51,12 @@ function CalculatePercentages {
} }
} }
function DisplayRulePercentages { function DisplayRuleRate {
param ($usablePercentages, $msg) param ($usableRate, $msg)
Write-Output $msg Write-Output $msg
$customOrder = @("critical", "high", "medium", "low", "informational") $customOrder = @("critical", "high", "medium", "low", "informational")
$usablePercentages = $usablePercentages | Sort-Object { $customOrder.IndexOf($_.Level) } $usableRate = $usableRate | Sort-Object { $customOrder.IndexOf($_.Level) }
$usablePercentages | ForEach-Object { $usableRate | ForEach-Object {
Write-Output "$($_.Level) rules: $($_.UsableCount) / $($_.TotalCount) ($($_.Percentage)%)" Write-Output "$($_.Level) rules: $($_.UsableCount) / $($_.TotalCount) ($($_.Percentage)%)"
} }
Write-Output "" Write-Output ""
@@ -82,25 +86,25 @@ $rules = Get-ApplicableRules -outputFilePath $outputFilePath -jsonFilePath "./co
# Step 4: Count the number of usable and unusable rules for each level # Step 4: Count the number of usable and unusable rules for each level
$usableSecRules = $rules | Where-Object { $_.applicable -eq $true -and $_.channel -eq "sec" } $usableSecRules = $rules | Where-Object { $_.applicable -eq $true -and $_.channel -eq "sec" }
$usablePwshRules = $rules | Where-Object { $_.channel -eq "pwsh" } $usablePwsRules = $rules | Where-Object { $_.applicable -eq $true -and $_.channel -eq "pwsh" }
$unusableRules = $rules | Where-Object { $_.applicable -eq $false -and $_.channel -eq "sec" } $unusableRules = $rules | Where-Object { $_.applicable -eq $false }
$totalCounts = Get-RuleCounts -rules $rules $totalCounts = Get-RuleCounts -rules $rules
$usableSecCounts = Get-RuleCounts -rules $usableSecRules $usableSecCounts = Get-RuleCounts -rules $usableSecRules
$usablePwsCounts = Get-RuleCounts -rules $usablePwshRules $usablePwsCounts = Get-RuleCounts -rules $usablePwsRules
# Step 5: Calculate the percentages # Step 5: Calculate the Rate
$usableSecPercentages = CalculatePercentages -counts $usableSecCounts -totalCounts $totalCounts $usableSecRate = CalculateRate -counts $usableSecCounts -totalCounts $totalCounts
$usablePwsPercentages = CalculatePercentages -counts $usablePwsCounts -totalCounts $usablePwsCounts $usablePwsRate = CalculateRate -counts $usablePwsCounts -totalCounts $usablePwsCounts
# Step 6: Generate the required outputtotal # Step 6: Generate the required outputtotal
DisplayRulePercentages -usablePercentages $usableSecPercentages -msg "Security event log detection rules:" DisplayRuleRate -usableRate $usableSecRate -msg "Security event log detection rules:"
DisplayRulePercentages -usablePercentages $usablePwsPercentages -msg "PowerShell event log detection rules:" DisplayRuleRate -usableRate $usablePwsRate -msg "PowerShell event log detection rules:"
Write-Output "Usable detection rules list saved to: UsableRules.csv" Write-Output "Usable detection rules list saved to: UsableRules.csv"
Write-Output "Unusable detection rules list saved to: UnusableRules.csv" Write-Output "Unusable detection rules list saved to: UnusableRules.csv"
Write-Output "" Write-Output ""
$totalUsable = ($usableSecPercentages + $usablePwsPercentages| Measure-Object -Property UsableCount -Sum).Sum $totalUsable = ($usableSecRate + $usablePwsRate| Measure-Object -Property UsableCount -Sum).Sum
$totalRulesCount = ($totalCounts | Measure-Object -Property Count -Sum).Sum $totalRulesCount = ($totalCounts | Measure-Object -Property Count -Sum).Sum
$utilizationPercentage = "{0:N2}" -f (($totalUsable / $totalRulesCount) * 100) $utilizationPercentage = "{0:N2}" -f (($totalUsable / $totalRulesCount) * 100)
Write-Output "You can utilize $utilizationPercentage% of your detection rules." Write-Output "You can utilize $utilizationPercentage% of your detection rules."