diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml new file mode 100644 index 00000000..163aa24c --- /dev/null +++ b/.github/workflows/docs.yml @@ -0,0 +1,66 @@ +name: Deploy docs to GitHub Pages + +# Build the Material for MkDocs site in website/ and publish it to GitHub Pages. +# One-time setup: Settings -> Pages -> Source: "GitHub Actions". + +on: + push: + branches: [main] + paths: + - "website/**" + - "CHANGELOG.md" + - "CHANGELOG-Japanese.md" + - ".github/workflows/docs.yml" + workflow_dispatch: + +permissions: + contents: read + pages: write + id-token: write + +concurrency: + group: pages + cancel-in-progress: false + +jobs: + build: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + fetch-depth: 0 + + - name: Set up Python + uses: actions/setup-python@v6 + with: + python-version: "3.x" + cache: pip + + - name: Install dependencies + run: pip install -r website/requirements.txt + + - name: Sync changelog into docs + run: python website/scripts/sync_changelog.py + + - name: Build site (strict) + run: mkdocs build --strict --config-file website/mkdocs.yml + + - name: Configure Pages + uses: actions/configure-pages@v6 + + - name: Upload artifact + uses: actions/upload-pages-artifact@v5 + with: + path: website/site + + deploy: + needs: build + runs-on: ubuntu-latest + environment: + name: github-pages + url: ${{ steps.deployment.outputs.page_url }} + steps: + - name: Deploy to GitHub Pages + id: deployment + uses: actions/deploy-pages@v5 diff --git a/.gitignore b/.gitignore index e6fa573a..1a20b9fb 100644 --- a/.gitignore +++ b/.gitignore @@ -5,4 +5,6 @@ Cargo.lock *.pdb .idea/ *.csv -.DS_Store \ No newline at end of file +.DS_Store +# MkDocs documentation site build output +/website/site/ diff --git a/website/docs/assets/screenshots/WELA-Logo.png b/website/docs/assets/screenshots/WELA-Logo.png new file mode 100644 index 00000000..d358edc7 Binary files /dev/null and b/website/docs/assets/screenshots/WELA-Logo.png differ diff --git a/website/docs/assets/screenshots/configure.png b/website/docs/assets/screenshots/configure.png new file mode 100644 index 00000000..28127c64 Binary files /dev/null and b/website/docs/assets/screenshots/configure.png differ diff --git a/website/docs/assets/screenshots/filesize.png b/website/docs/assets/screenshots/filesize.png new file mode 100644 index 00000000..1363ee66 Binary files /dev/null and b/website/docs/assets/screenshots/filesize.png differ diff --git a/website/docs/assets/screenshots/gui.png b/website/docs/assets/screenshots/gui.png new file mode 100644 index 00000000..d7c957f2 Binary files /dev/null and b/website/docs/assets/screenshots/gui.png differ diff --git a/website/docs/assets/screenshots/mitre.png b/website/docs/assets/screenshots/mitre.png new file mode 100644 index 00000000..ecbee02d Binary files /dev/null and b/website/docs/assets/screenshots/mitre.png differ diff --git a/website/docs/assets/screenshots/startup.png b/website/docs/assets/screenshots/startup.png new file mode 100644 index 00000000..4cd69595 Binary files /dev/null and b/website/docs/assets/screenshots/startup.png differ diff --git a/website/docs/assets/screenshots/stdout.png b/website/docs/assets/screenshots/stdout.png new file mode 100644 index 00000000..83c946dc Binary files /dev/null and b/website/docs/assets/screenshots/stdout.png differ diff --git a/website/docs/assets/screenshots/table.png b/website/docs/assets/screenshots/table.png new file mode 100644 index 00000000..54b21d9f Binary files /dev/null and b/website/docs/assets/screenshots/table.png differ diff --git a/website/docs/commands/index.ar.md b/website/docs/commands/index.ar.md new file mode 100644 index 00000000..1317862b --- /dev/null +++ b/website/docs/commands/index.ar.md @@ -0,0 +1,5 @@ +# قائمة الأوامر +- `audit-settings`: التحقق من إعدادات سياسة تدقيق سجل أحداث Windows. +- `audit-filesize`: التحقق من حجم ملف سجل أحداث Windows. +- `configure`: تكوين سياسة تدقيق سجل أحداث Windows وحجم الملف الموصى بهما. +- `update-rules`: تحديث ملفات تكوين قواعد Sigma الخاصة بـ WELA. diff --git a/website/docs/commands/index.de.md b/website/docs/commands/index.de.md new file mode 100644 index 00000000..03ecd575 --- /dev/null +++ b/website/docs/commands/index.de.md @@ -0,0 +1,5 @@ +# Befehlsliste +- `audit-settings`: Überprüfen der Überwachungsrichtlinieneinstellungen für das Windows-Ereignisprotokoll. +- `audit-filesize`: Überprüfen der Dateigröße des Windows-Ereignisprotokolls. +- `configure`: Konfigurieren der empfohlenen Überwachungsrichtlinie und Dateigröße für das Windows-Ereignisprotokoll. +- `update-rules`: Aktualisieren der Sigma-Regelkonfigurationsdateien von WELA. diff --git a/website/docs/commands/index.es.md b/website/docs/commands/index.es.md new file mode 100644 index 00000000..7606a1bd --- /dev/null +++ b/website/docs/commands/index.es.md @@ -0,0 +1,5 @@ +# Lista de comandos +- `audit-settings`: Comprobar la configuración de la política de auditoría del registro de eventos de Windows. +- `audit-filesize`: Comprobar el tamaño del archivo del registro de eventos de Windows. +- `configure`: Configurar la política de auditoría y el tamaño de archivo recomendados del registro de eventos de Windows. +- `update-rules`: Actualizar los archivos de configuración de reglas Sigma de WELA. diff --git a/website/docs/commands/index.fr.md b/website/docs/commands/index.fr.md new file mode 100644 index 00000000..779b6a04 --- /dev/null +++ b/website/docs/commands/index.fr.md @@ -0,0 +1,5 @@ +# Liste des commandes +- `audit-settings` : Vérifier les paramètres de la stratégie d'audit du journal d'événements Windows. +- `audit-filesize` : Vérifier la taille du fichier du journal d'événements Windows. +- `configure` : Configurer la stratégie d'audit recommandée du journal d'événements Windows et la taille du fichier. +- `update-rules` : Mettre à jour les fichiers de configuration des règles Sigma de WELA. diff --git a/website/docs/commands/index.hi.md b/website/docs/commands/index.hi.md new file mode 100644 index 00000000..7c6c02b9 --- /dev/null +++ b/website/docs/commands/index.hi.md @@ -0,0 +1,5 @@ +# कमांड सूची +- `audit-settings`: Windows इवेंट लॉग ऑडिट पॉलिसी सेटिंग्स जाँचें। +- `audit-filesize`: Windows इवेंट लॉग फ़ाइल आकार जाँचें। +- `configure`: अनुशंसित Windows इवेंट लॉग ऑडिट पॉलिसी और फ़ाइल आकार कॉन्फ़िगर करें। +- `update-rules`: WELA की Sigma नियम कॉन्फ़िग फ़ाइलें अपडेट करें। diff --git a/website/docs/commands/index.id.md b/website/docs/commands/index.id.md new file mode 100644 index 00000000..7ef344b6 --- /dev/null +++ b/website/docs/commands/index.id.md @@ -0,0 +1,5 @@ +# Daftar Perintah +- `audit-settings`: Memeriksa pengaturan kebijakan audit Windows event log. +- `audit-filesize`: Memeriksa ukuran berkas Windows event log. +- `configure`: Mengonfigurasi kebijakan audit dan ukuran berkas Windows event log yang direkomendasikan. +- `update-rules`: Memperbarui berkas konfigurasi aturan Sigma milik WELA. diff --git a/website/docs/commands/index.ja.md b/website/docs/commands/index.ja.md new file mode 100644 index 00000000..36bbab1e --- /dev/null +++ b/website/docs/commands/index.ja.md @@ -0,0 +1,5 @@ +# コマンド一覧 +- `audit-settings`: Windowsイベントログ監査ポリシー設定を評価する +- `audit-filesize`: Windowsイベントログファイルサイズを評価する +- `configure`: 推奨のWindowsイベントログ監査ポリシーとファイズサイズを設定する +- `update-rules`: WELAのSigmaルール設定ファイルを更新する diff --git a/website/docs/commands/index.ko.md b/website/docs/commands/index.ko.md new file mode 100644 index 00000000..1a8721c8 --- /dev/null +++ b/website/docs/commands/index.ko.md @@ -0,0 +1,5 @@ +# 명령어 목록 +- `audit-settings`: Windows 이벤트 로그 감사 정책 설정을 확인합니다. +- `audit-filesize`: Windows 이벤트 로그 파일 크기를 확인합니다. +- `configure`: 권장되는 Windows 이벤트 로그 감사 정책과 파일 크기를 설정합니다. +- `update-rules`: WELA의 Sigma 규칙 설정 파일을 업데이트합니다. diff --git a/website/docs/commands/index.md b/website/docs/commands/index.md new file mode 100644 index 00000000..a09e167d --- /dev/null +++ b/website/docs/commands/index.md @@ -0,0 +1,5 @@ +# Command List +- `audit-settings`: Check Windows event log audit policy settings. +- `audit-filesize`: Check Windows event log file size. +- `configure`: Configure recommended Windows event log audit policy and file size. +- `update-rules`: Update WELA's Sigma rules config files. diff --git a/website/docs/commands/index.my.md b/website/docs/commands/index.my.md new file mode 100644 index 00000000..2f503470 --- /dev/null +++ b/website/docs/commands/index.my.md @@ -0,0 +1,5 @@ +# Command List +- `audit-settings`: Windows event log ၏ audit policy ဆက်တင်များကို စစ်ဆေးပါ။ +- `audit-filesize`: Windows event log ဖိုင်အရွယ်အစားကို စစ်ဆေးပါ။ +- `configure`: အကြံပြုထားသော Windows event log audit policy နှင့် ဖိုင်အရွယ်အစားကို ပြင်ဆင်သတ်မှတ်ပါ။ +- `update-rules`: WELA ၏ Sigma rules config ဖိုင်များကို အပ်ဒိတ်လုပ်ပါ။ diff --git a/website/docs/commands/index.pt-BR.md b/website/docs/commands/index.pt-BR.md new file mode 100644 index 00000000..e56589de --- /dev/null +++ b/website/docs/commands/index.pt-BR.md @@ -0,0 +1,5 @@ +# Lista de Comandos +- `audit-settings`: Verifica as configurações de política de auditoria do log de eventos do Windows. +- `audit-filesize`: Verifica o tamanho do arquivo de log de eventos do Windows. +- `configure`: Configura a política de auditoria recomendada e o tamanho do arquivo do log de eventos do Windows. +- `update-rules`: Atualiza os arquivos de configuração das regras Sigma do WELA. diff --git a/website/docs/commands/index.th.md b/website/docs/commands/index.th.md new file mode 100644 index 00000000..32a18180 --- /dev/null +++ b/website/docs/commands/index.th.md @@ -0,0 +1,5 @@ +# รายการคำสั่ง +- `audit-settings`: ตรวจสอบการตั้งค่านโยบายการตรวจสอบ (audit policy) ของ Windows event log +- `audit-filesize`: ตรวจสอบขนาดไฟล์ของ Windows event log +- `configure`: กำหนดค่านโยบายการตรวจสอบ (audit policy) และขนาดไฟล์ของ Windows event log ที่แนะนำ +- `update-rules`: อัปเดตไฟล์การตั้งค่ากฎ Sigma ของ WELA diff --git a/website/docs/commands/index.tr.md b/website/docs/commands/index.tr.md new file mode 100644 index 00000000..13cd9db6 --- /dev/null +++ b/website/docs/commands/index.tr.md @@ -0,0 +1,5 @@ +# Komut Listesi +- `audit-settings`: Windows olay günlüğü denetim politikası ayarlarını kontrol eder. +- `audit-filesize`: Windows olay günlüğü dosya boyutunu kontrol eder. +- `configure`: Önerilen Windows olay günlüğü denetim politikasını ve dosya boyutunu yapılandırır. +- `update-rules`: WELA'nın Sigma kuralları yapılandırma dosyalarını günceller. diff --git a/website/docs/commands/index.uk.md b/website/docs/commands/index.uk.md new file mode 100644 index 00000000..93a809e0 --- /dev/null +++ b/website/docs/commands/index.uk.md @@ -0,0 +1,5 @@ +# Список команд +- `audit-settings`: Перевірка налаштувань політики аудиту журналу подій Windows. +- `audit-filesize`: Перевірка розміру файлу журналу подій Windows. +- `configure`: Налаштування рекомендованої політики аудиту та розміру файлу журналу подій Windows. +- `update-rules`: Оновлення конфігураційних файлів правил Sigma для WELA. diff --git a/website/docs/commands/index.zh-TW.md b/website/docs/commands/index.zh-TW.md new file mode 100644 index 00000000..ecea7c50 --- /dev/null +++ b/website/docs/commands/index.zh-TW.md @@ -0,0 +1,5 @@ +# 命令列表 +- `audit-settings`：檢查 Windows 事件記錄稽核原則設定。 +- `audit-filesize`：檢查 Windows 事件記錄檔案大小。 +- `configure`：設定建議的 Windows 事件記錄稽核原則與檔案大小。 +- `update-rules`：更新 WELA 的 Sigma 規則設定檔。 diff --git a/website/docs/commands/usage.ar.md b/website/docs/commands/usage.ar.md new file mode 100644 index 00000000..29896948 --- /dev/null +++ b/website/docs/commands/usage.ar.md @@ -0,0 +1,55 @@ +# استخدام الأوامر +## audit-settings +يتحقق الأمر `audit-settings` من إعدادات سياسة تدقيق سجل أحداث Windows ويقارنها بالإعدادات الموصى بها من [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings) و[Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) و[Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +يشير `RuleCount` إلى عدد [قواعد Sigma](https://github.com/SigmaHQ/sigma) التي يمكنها اكتشاف الأحداث ضمن تلك الفئة. + +### أمثلة على أمر `audit-settings` +التحقق باستخدام إعدادات Yamato Security الموصى بها الافتراضية وحفظ النتائج إلى CSV: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +التحقق باستخدام إعدادات Australian Signals Directorate الموصى بها وحفظ النتائج إلى CSV: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +التحقق باستخدام إعدادات Microsoft الموصى بها لنظام تشغيل الخادم وعرض النتائج في واجهة رسومية: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +التحقق باستخدام إعدادات Microsoft الموصى بها لنظام تشغيل العميل وعرض النتائج في صيغة جدول: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +يتحقق الأمر `audit-filesize` من حجم ملفات سجلات أحداث Windows ويقارنها بالإعدادات الموصى بها من توصيات Yamato Security. + +### أمثلة على أمر `audit-filesize` +التحقق من حجم ملف سجل أحداث Windows باستخدام توصيات Yamato Security وحفظ النتائج إلى CSV: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +يضبط الأمر `configure` سياسة تدقيق سجل أحداث Windows الموصى بها وحجم الملف. + +#### أمثلة على أمر `configure` +تطبيق إعدادات Yamato Security الموصى بها (مع مطالبة تأكيد قبل تغيير الإعدادات): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +تطبيق إعدادات Australian Signals Directorate الموصى بها دون مطالبة تأكيد: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### أمثلة على أمر `update-rules` +تحديث ملفات إعدادات قواعد Sigma الخاصة بـ WELA: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.de.md b/website/docs/commands/usage.de.md new file mode 100644 index 00000000..de1e9007 --- /dev/null +++ b/website/docs/commands/usage.de.md @@ -0,0 +1,55 @@ +# Befehlsverwendung +## audit-settings +Der Befehl `audit-settings` überprüft die Einstellungen der Überwachungsrichtlinie des Windows-Ereignisprotokolls und vergleicht sie mit den empfohlenen Einstellungen von [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) und [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +`RuleCount` gibt die Anzahl der [Sigma-Regeln](https://github.com/SigmaHQ/sigma) an, die Ereignisse innerhalb dieser Kategorie erkennen können. + +### `audit-settings`-Befehlsbeispiele +Mit den standardmäßig empfohlenen Einstellungen von Yamato Security überprüfen und Ergebnisse als CSV speichern: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Mit den empfohlenen Einstellungen des Australian Signals Directorate überprüfen und Ergebnisse als CSV speichern: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Mit den von Microsoft empfohlenen Einstellungen für Server-Betriebssysteme überprüfen und Ergebnisse in einer GUI anzeigen: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Mit den von Microsoft empfohlenen Einstellungen für Client-Betriebssysteme überprüfen und Ergebnisse im Tabellenformat anzeigen: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +Der Befehl `audit-filesize` überprüft die Dateigröße der Windows-Ereignisprotokolle und vergleicht sie mit den Empfehlungen von Yamato Security. + +### `audit-filesize`-Befehlsbeispiele +Die Dateigröße des Windows-Ereignisprotokolls mit den Empfehlungen von Yamato Security überprüfen und Ergebnisse als CSV speichern: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +Der Befehl `configure` legt die empfohlene Überwachungsrichtlinie und Dateigröße des Windows-Ereignisprotokolls fest. + +#### `configure`-Befehlsbeispiele +Die von Yamato Security empfohlenen Einstellungen anwenden (mit Bestätigungsaufforderung vor dem Ändern der Einstellungen): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Die vom Australian Signals Directorate empfohlenen Einstellungen ohne Bestätigungsaufforderung anwenden: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules`-Befehlsbeispiele +Die Sigma-Regel-Konfigurationsdateien von WELA aktualisieren: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.es.md b/website/docs/commands/usage.es.md new file mode 100644 index 00000000..c69d4bc6 --- /dev/null +++ b/website/docs/commands/usage.es.md @@ -0,0 +1,55 @@ +# Uso de comandos +## audit-settings +El comando `audit-settings` comprueba la configuración de la política de auditoría del registro de eventos de Windows y la compara con la configuración recomendada de [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) y [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +`RuleCount` indica el número de [reglas Sigma](https://github.com/SigmaHQ/sigma) que pueden detectar eventos dentro de esa categoría. + +### Ejemplos del comando `audit-settings` +Comprobar con la configuración recomendada predeterminada de Yamato Security y guardar los resultados en CSV: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Comprobar con la configuración recomendada de Australian Signals Directorate y guardar los resultados en CSV: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Comprobar con la configuración recomendada de Microsoft para SO de servidor y mostrar los resultados en una GUI: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Comprobar con la configuración recomendada de Microsoft para SO de cliente y mostrar los resultados en formato de tabla: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +El comando `audit-filesize` comprueba el tamaño de archivo de los registros de eventos de Windows y lo compara con la configuración recomendada de las recomendaciones de Yamato Security. + +### Ejemplos del comando `audit-filesize` +Comprobar el tamaño de archivo del registro de eventos de Windows con las recomendaciones de Yamato Security y guardar los resultados en CSV: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +El comando `configure` establece la política de auditoría del registro de eventos de Windows y el tamaño de archivo recomendados. + +#### Ejemplos del comando `configure` +Aplicar la configuración recomendada de Yamato Security (con solicitud de confirmación antes de cambiar la configuración): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Aplicar la configuración recomendada de Australian Signals Directorate sin solicitud de confirmación: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### Ejemplos del comando `update-rules` +Actualizar los archivos de configuración de reglas Sigma de WELA: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.fr.md b/website/docs/commands/usage.fr.md new file mode 100644 index 00000000..c432a83a --- /dev/null +++ b/website/docs/commands/usage.fr.md @@ -0,0 +1,55 @@ +# Utilisation des commandes +## audit-settings +La commande `audit-settings` vérifie les paramètres de la stratégie d'audit du journal d'événements Windows et les compare aux paramètres recommandés par [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) et l'[Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +`RuleCount` indique le nombre de [règles Sigma](https://github.com/SigmaHQ/sigma) capables de détecter des événements dans cette catégorie. + +### Exemples de la commande `audit-settings` +Vérifier avec les paramètres recommandés par défaut de Yamato Security et enregistrer les résultats au format CSV : +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Vérifier avec les paramètres recommandés par l'Australian Signals Directorate et enregistrer les résultats au format CSV : +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Vérifier avec les paramètres recommandés par Microsoft pour les systèmes d'exploitation Server et afficher les résultats dans une interface graphique : +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Vérifier avec les paramètres recommandés par Microsoft pour les systèmes d'exploitation Client et afficher les résultats sous forme de tableau : +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +La commande `audit-filesize` vérifie la taille des fichiers des journaux d'événements Windows et la compare aux paramètres recommandés par Yamato Security. + +### Exemples de la commande `audit-filesize` +Vérifier la taille des fichiers du journal d'événements Windows avec les recommandations de Yamato Security et enregistrer les résultats au format CSV : +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +La commande `configure` définit la stratégie d'audit du journal d'événements Windows et la taille des fichiers recommandées. + +#### Exemples de la commande `configure` +Appliquer les paramètres recommandés par Yamato Security (avec une invite de confirmation avant de modifier les paramètres) : +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Appliquer les paramètres recommandés par l'Australian Signals Directorate sans invite de confirmation : +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### Exemples de la commande `update-rules` +Mettre à jour les fichiers de configuration des règles Sigma de WELA : +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.hi.md b/website/docs/commands/usage.hi.md new file mode 100644 index 00000000..f5e6cb5e --- /dev/null +++ b/website/docs/commands/usage.hi.md @@ -0,0 +1,55 @@ +# कमांड उपयोग +## audit-settings +`audit-settings` कमांड Windows इवेंट लॉग ऑडिट पॉलिसी सेटिंग्स की जाँच करता है और उनकी तुलना [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations), और [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) की अनुशंसित सेटिंग्स से करता है। +`RuleCount` उस श्रेणी के भीतर की घटनाओं का पता लगाने में सक्षम [Sigma rules](https://github.com/SigmaHQ/sigma) की संख्या को दर्शाता है। + +### `audit-settings` कमांड के उदाहरण +डिफ़ॉल्ट Yamato Security की अनुशंसित सेटिंग्स के साथ जाँचें और परिणामों को CSV में सहेजें: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Australian Signals Directorate की अनुशंसित सेटिंग्स के साथ जाँचें और परिणामों को CSV में सहेजें: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Microsoft की अनुशंसित Server OS सेटिंग्स के साथ जाँचें और परिणामों को GUI में प्रदर्शित करें: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Microsoft की अनुशंसित Client OS सेटिंग्स के साथ जाँचें और परिणामों को तालिका प्रारूप में प्रदर्शित करें: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +`audit-filesize` कमांड Windows इवेंट लॉग्स के फ़ाइल आकार की जाँच करता है और उनकी तुलना Yamato Security की अनुशंसाओं से करता है। + +### `audit-filesize` कमांड के उदाहरण +Windows इवेंट लॉग फ़ाइल आकार को Yamato Security की अनुशंसाओं के साथ जाँचें और परिणामों को CSV में सहेजें: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +`configure` कमांड अनुशंसित Windows इवेंट लॉग ऑडिट पॉलिसी और फ़ाइल आकार सेट करता है। + +#### `configure` कमांड के उदाहरण +Yamato Security की अनुशंसित सेटिंग्स लागू करें (सेटिंग्स बदलने से पहले पुष्टिकरण प्रॉम्प्ट के साथ): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Australian Signals Directorate की अनुशंसित सेटिंग्स बिना पुष्टिकरण प्रॉम्प्ट के लागू करें: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules` कमांड के उदाहरण +WELA की Sigma rules कॉन्फ़िग फ़ाइलों को अपडेट करें: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.id.md b/website/docs/commands/usage.id.md new file mode 100644 index 00000000..9c593dc1 --- /dev/null +++ b/website/docs/commands/usage.id.md @@ -0,0 +1,55 @@ +# Penggunaan Perintah +## audit-settings +Perintah `audit-settings` memeriksa pengaturan kebijakan audit log peristiwa Windows dan membandingkannya dengan pengaturan yang direkomendasikan dari [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations), dan [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +`RuleCount` menunjukkan jumlah [aturan Sigma](https://github.com/SigmaHQ/sigma) yang dapat mendeteksi peristiwa dalam kategori tersebut. + +### Contoh perintah `audit-settings` +Periksa dengan pengaturan rekomendasi default Yamato Security dan simpan hasilnya ke CSV: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Periksa dengan pengaturan rekomendasi Australian Signals Directorate dan simpan hasilnya ke CSV: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Periksa dengan pengaturan rekomendasi Server OS dari Microsoft dan tampilkan hasilnya dalam GUI: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Periksa dengan pengaturan rekomendasi Client OS dari Microsoft dan tampilkan hasilnya dalam format tabel: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +Perintah `audit-filesize` memeriksa ukuran file log peristiwa Windows dan membandingkannya dengan pengaturan yang direkomendasikan dari rekomendasi Yamato Security. + +### Contoh perintah `audit-filesize` +Periksa ukuran file log peristiwa Windows dengan rekomendasi Yamato Security dan simpan hasilnya ke CSV: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +Perintah `configure` menetapkan kebijakan audit log peristiwa Windows dan ukuran file yang direkomendasikan. + +#### Contoh perintah `configure` +Terapkan pengaturan rekomendasi Yamato Security (dengan prompt konfirmasi sebelum mengubah pengaturan): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Terapkan pengaturan rekomendasi Australian Signals Directorate tanpa prompt konfirmasi: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### Contoh perintah `update-rules` +Perbarui file konfigurasi aturan Sigma WELA: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.ja.md b/website/docs/commands/usage.ja.md new file mode 100644 index 00000000..76dacd7e --- /dev/null +++ b/website/docs/commands/usage.ja.md @@ -0,0 +1,55 @@ +# コマンド使用例 +## audit-settings +`audit-settings`コマンドは、Windowsイベントログ監査ポリシー設定を評価し、[Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings)、[Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations)、[Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding)の推奨設定と比較します。 +RuleCountは、そのカテゴリ内のイベントを検出できる[Sigmaルール](https://github.com/SigmaHQ/sigma)の数を示します。 + +#### `audit-settings` command examples +YamatoSecurityの推奨設定でチェックし、CSV形式で保存する: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Australian Signals Directorateの推奨設定でチェックし、CSV形式で保存する: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Microsoftの推奨設定(Server)でチェックし、GUI形式で表示する: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Microsoftの推奨設定(Client)でチェックし、Table形式で表示する: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +`audit-filesize`コマンドは、Windowsイベントログファイルサイズを評価し、Yamato Securityの推奨設定と比較します。 + +#### `audit-filesize` command examples +WindowsイベントログファイルサイズをYamatoSecurityの推奨設定でチェックし、CSV形式で保存する: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +`configure`コマンドは、推奨のWindowsイベントログ監査ポリシーとファイルサイズを設定します。 + +#### `configure` command examples +Yamato Securityの推奨設定を適用する（設定変更時に確認プロンプトを表示）: +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Australian Signals Directorateの推奨設定を自動で適用する: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules` command examples +WELAのSigmaルール設定ファイルを更新する: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.ko.md b/website/docs/commands/usage.ko.md new file mode 100644 index 00000000..1b358be4 --- /dev/null +++ b/website/docs/commands/usage.ko.md @@ -0,0 +1,55 @@ +# 명령어 사용법 +## audit-settings +`audit-settings` 명령어는 Windows 이벤트 로그 감사 정책 설정을 확인하고 이를 [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations), [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding)의 권장 설정과 비교합니다. +`RuleCount`는 해당 카테고리 내의 이벤트를 탐지할 수 있는 [Sigma 규칙](https://github.com/SigmaHQ/sigma)의 개수를 나타냅니다. + +### `audit-settings` 명령어 예시 +기본 Yamato Security의 권장 설정으로 확인하고 결과를 CSV로 저장: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Australian Signals Directorate의 권장 설정으로 확인하고 결과를 CSV로 저장: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Microsoft의 권장 Server OS 설정으로 확인하고 결과를 GUI로 표시: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Microsoft의 권장 Client OS 설정으로 확인하고 결과를 테이블 형식으로 표시: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +`audit-filesize` 명령어는 Windows 이벤트 로그의 파일 크기를 확인하고 이를 Yamato Security의 권장 설정과 비교합니다. + +### `audit-filesize` 명령어 예시 +Yamato Security의 권장 설정으로 Windows 이벤트 로그 파일 크기를 확인하고 결과를 CSV로 저장: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +`configure` 명령어는 권장되는 Windows 이벤트 로그 감사 정책과 파일 크기를 설정합니다. + +#### `configure` 명령어 예시 +Yamato Security의 권장 설정 적용(설정 변경 전 확인 프롬프트 포함): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Australian Signals Directorate의 권장 설정을 확인 프롬프트 없이 적용: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules` 명령어 예시 +WELA의 Sigma 규칙 구성 파일 업데이트: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.md b/website/docs/commands/usage.md new file mode 100644 index 00000000..7843242e --- /dev/null +++ b/website/docs/commands/usage.md @@ -0,0 +1,55 @@ +# Command Usage +## audit-settings +The `audit-settings` command checks the Windows event log audit policy settings and compares them with the recommended settings from [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations), and [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +`RuleCount` indicates the number of [Sigma rules](https://github.com/SigmaHQ/sigma) that can detect events within that category. + +### `audit-settings` command examples +Check with the default Yamato Security's recommended settings and save results to CSV: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Check with the Australian Signals Directorate's recommended settings and save results to CSV: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Check with Microsoft's recommended Server OS settings and display results in a GUI: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Check with Microsoft's recommended Client OS settings and display results in table format: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +The `audit-filesize` command checks the Windows event logs' file size and compares them with the recommended settings from Yamato Security's recommendations. + +### `audit-filesize` command examples +Check the Windows event log file size with Yamato Security's recommendations and save results to CSV: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +The `configure` command sets the recommended Windows event log audit policy and file size. + +#### `configure` command examples +Apply Yamato Security's recommended settings (with confirmation prompt before changing settings): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Apply Australian Signals Directorate's recommended settings without confirmation prompt: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules` command examples +Update WELA's Sigma rules config files: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.my.md b/website/docs/commands/usage.my.md new file mode 100644 index 00000000..1c6e0812 --- /dev/null +++ b/website/docs/commands/usage.my.md @@ -0,0 +1,55 @@ +# Command အသုံးပြုပုံ +## audit-settings +`audit-settings` command သည် Windows event log audit policy settings များကို စစ်ဆေးပြီး [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings)၊ [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) နှင့် [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) တို့မှ အကြံပြုထားသော settings များနှင့် နှိုင်းယှဉ်ပေးပါသည်။ +`RuleCount` သည် ထို category အတွင်းရှိ events များကို ရှာဖွေတွေ့ရှိနိုင်သော [Sigma rules](https://github.com/SigmaHQ/sigma) အရေအတွက်ကို ဖော်ပြသည်။ + +### `audit-settings` command နမူနာများ +ပုံသေ Yamato Security ၏ အကြံပြုထားသော settings များဖြင့် စစ်ဆေးပြီး ရလဒ်များကို CSV သို့ သိမ်းဆည်းရန်- +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Australian Signals Directorate ၏ အကြံပြုထားသော settings များဖြင့် စစ်ဆေးပြီး ရလဒ်များကို CSV သို့ သိမ်းဆည်းရန်- +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Microsoft ၏ အကြံပြုထားသော Server OS settings များဖြင့် စစ်ဆေးပြီး ရလဒ်များကို GUI တွင် ပြသရန်- +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Microsoft ၏ အကြံပြုထားသော Client OS settings များဖြင့် စစ်ဆေးပြီး ရလဒ်များကို table format ဖြင့် ပြသရန်- +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +`audit-filesize` command သည် Windows event logs များ၏ file size ကို စစ်ဆေးပြီး Yamato Security ၏ အကြံပြုချက်များမှ အကြံပြုထားသော settings များနှင့် နှိုင်းယှဉ်ပေးပါသည်။ + +### `audit-filesize` command နမူနာများ +Windows event log file size ကို Yamato Security ၏ အကြံပြုချက်များဖြင့် စစ်ဆေးပြီး ရလဒ်များကို CSV သို့ သိမ်းဆည်းရန်- +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +`configure` command သည် အကြံပြုထားသော Windows event log audit policy နှင့် file size ကို သတ်မှတ်ပေးပါသည်။ + +#### `configure` command နမူနာများ +Yamato Security ၏ အကြံပြုထားသော settings များကို အသုံးချရန် (settings များ ပြောင်းလဲမည့်အကြိုတွင် အတည်ပြုချက် prompt ဖြင့်)- +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Australian Signals Directorate ၏ အကြံပြုထားသော settings များကို အတည်ပြုချက် prompt မပါဘဲ အသုံးချရန်- +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules` command နမူနာများ +WELA ၏ Sigma rules config files များကို update လုပ်ရန်- +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.pt-BR.md b/website/docs/commands/usage.pt-BR.md new file mode 100644 index 00000000..73c41475 --- /dev/null +++ b/website/docs/commands/usage.pt-BR.md @@ -0,0 +1,55 @@ +# Uso de Comandos +## audit-settings +O comando `audit-settings` verifica as configurações da política de auditoria do log de eventos do Windows e as compara com as configurações recomendadas da [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), da [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) e da [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +`RuleCount` indica o número de [regras Sigma](https://github.com/SigmaHQ/sigma) que podem detectar eventos dentro daquela categoria. + +### exemplos do comando `audit-settings` +Verifique com as configurações recomendadas padrão da Yamato Security e salve os resultados em CSV: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Verifique com as configurações recomendadas da Australian Signals Directorate e salve os resultados em CSV: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Verifique com as configurações recomendadas da Microsoft para SO Server e exiba os resultados em uma GUI: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Verifique com as configurações recomendadas da Microsoft para SO Client e exiba os resultados em formato de tabela: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +O comando `audit-filesize` verifica o tamanho dos arquivos dos logs de eventos do Windows e os compara com as configurações recomendadas pela Yamato Security. + +### exemplos do comando `audit-filesize` +Verifique o tamanho do arquivo do log de eventos do Windows com as recomendações da Yamato Security e salve os resultados em CSV: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +O comando `configure` define a política de auditoria recomendada do log de eventos do Windows e o tamanho do arquivo. + +#### exemplos do comando `configure` +Aplique as configurações recomendadas da Yamato Security (com prompt de confirmação antes de alterar as configurações): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Aplique as configurações recomendadas da Australian Signals Directorate sem prompt de confirmação: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### exemplos do comando `update-rules` +Atualize os arquivos de configuração das regras Sigma do WELA: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.th.md b/website/docs/commands/usage.th.md new file mode 100644 index 00000000..14601929 --- /dev/null +++ b/website/docs/commands/usage.th.md @@ -0,0 +1,55 @@ +# การใช้งานคำสั่ง +## audit-settings +คำสั่ง `audit-settings` จะตรวจสอบการตั้งค่านโยบายการตรวจสอบ (audit policy) ของ Windows event log และเปรียบเทียบกับการตั้งค่าที่แนะนำจาก [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations), และ [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +`RuleCount` แสดงจำนวน [Sigma rules](https://github.com/SigmaHQ/sigma) ที่สามารถตรวจจับเหตุการณ์ภายในหมวดหมู่นั้นได้ + +### ตัวอย่างคำสั่ง `audit-settings` +ตรวจสอบด้วยการตั้งค่าที่แนะนำของ Yamato Security ซึ่งเป็นค่าเริ่มต้นและบันทึกผลลัพธ์เป็น CSV: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +ตรวจสอบด้วยการตั้งค่าที่แนะนำของ Australian Signals Directorate และบันทึกผลลัพธ์เป็น CSV: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +ตรวจสอบด้วยการตั้งค่า Server OS ที่แนะนำของ Microsoft และแสดงผลลัพธ์ใน GUI: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +ตรวจสอบด้วยการตั้งค่า Client OS ที่แนะนำของ Microsoft และแสดงผลลัพธ์ในรูปแบบตาราง: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +คำสั่ง `audit-filesize` จะตรวจสอบขนาดไฟล์ของ Windows event logs และเปรียบเทียบกับการตั้งค่าที่แนะนำจาก Yamato Security + +### ตัวอย่างคำสั่ง `audit-filesize` +ตรวจสอบขนาดไฟล์ Windows event log ด้วยคำแนะนำของ Yamato Security และบันทึกผลลัพธ์เป็น CSV: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +คำสั่ง `configure` จะตั้งค่านโยบายการตรวจสอบ (audit policy) ของ Windows event log และขนาดไฟล์ตามที่แนะนำ + +#### ตัวอย่างคำสั่ง `configure` +ใช้การตั้งค่าที่แนะนำของ Yamato Security (พร้อมข้อความยืนยันก่อนการเปลี่ยนแปลงการตั้งค่า): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +ใช้การตั้งค่าที่แนะนำของ Australian Signals Directorate โดยไม่มีข้อความยืนยัน: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### ตัวอย่างคำสั่ง `update-rules` +อัปเดตไฟล์ config ของ Sigma rules ของ WELA: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.tr.md b/website/docs/commands/usage.tr.md new file mode 100644 index 00000000..5f7827f9 --- /dev/null +++ b/website/docs/commands/usage.tr.md @@ -0,0 +1,55 @@ +# Komut Kullanımı +## audit-settings +`audit-settings` komutu, Windows olay günlüğü denetim ilkesi ayarlarını kontrol eder ve bunları [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) ve [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) tarafından önerilen ayarlarla karşılaştırır. +`RuleCount`, o kategorideki olayları tespit edebilen [Sigma kurallarının](https://github.com/SigmaHQ/sigma) sayısını gösterir. + +### `audit-settings` komut örnekleri +Varsayılan Yamato Security'nin önerilen ayarlarıyla kontrol edin ve sonuçları CSV'ye kaydedin: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Australian Signals Directorate'in önerilen ayarlarıyla kontrol edin ve sonuçları CSV'ye kaydedin: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Microsoft'un önerilen Sunucu OS ayarlarıyla kontrol edin ve sonuçları bir GUI'de görüntüleyin: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Microsoft'un önerilen İstemci OS ayarlarıyla kontrol edin ve sonuçları tablo biçiminde görüntüleyin: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +`audit-filesize` komutu, Windows olay günlüklerinin dosya boyutunu kontrol eder ve bunları Yamato Security'nin önerileriyle karşılaştırır. + +### `audit-filesize` komut örnekleri +Windows olay günlüğü dosya boyutunu Yamato Security'nin önerileriyle kontrol edin ve sonuçları CSV'ye kaydedin: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +`configure` komutu, önerilen Windows olay günlüğü denetim ilkesini ve dosya boyutunu ayarlar. + +#### `configure` komut örnekleri +Yamato Security'nin önerilen ayarlarını uygulayın (ayarları değiştirmeden önce onay istemiyle): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Australian Signals Directorate'in önerilen ayarlarını onay istemi olmadan uygulayın: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules` komut örnekleri +WELA'nın Sigma kuralları yapılandırma dosyalarını güncelleyin: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.uk.md b/website/docs/commands/usage.uk.md new file mode 100644 index 00000000..64760017 --- /dev/null +++ b/website/docs/commands/usage.uk.md @@ -0,0 +1,55 @@ +# Використання команд +## audit-settings +Команда `audit-settings` перевіряє налаштування політики аудиту журналу подій Windows та порівнює їх із рекомендованими налаштуваннями від [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) та [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding). +`RuleCount` вказує кількість [правил Sigma](https://github.com/SigmaHQ/sigma), які можуть виявляти події в межах цієї категорії. + +### приклади команди `audit-settings` +Перевірка зі стандартними рекомендованими налаштуваннями Yamato Security та збереження результатів у CSV: +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +Перевірка з рекомендованими налаштуваннями Australian Signals Directorate та збереження результатів у CSV: +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +Перевірка з рекомендованими налаштуваннями Microsoft для серверної ОС та відображення результатів у графічному інтерфейсі: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +Перевірка з рекомендованими налаштуваннями Microsoft для клієнтської ОС та відображення результатів у форматі таблиці: +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +Команда `audit-filesize` перевіряє розмір файлів журналів подій Windows та порівнює їх із рекомендованими налаштуваннями від Yamato Security. + +### приклади команди `audit-filesize` +Перевірка розміру файлу журналу подій Windows за рекомендаціями Yamato Security та збереження результатів у CSV: +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +Команда `configure` встановлює рекомендовану політику аудиту журналу подій Windows та розмір файлу. + +#### приклади команди `configure` +Застосування рекомендованих налаштувань Yamato Security (з підтвердженням перед зміною налаштувань): +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +Застосування рекомендованих налаштувань Australian Signals Directorate без підтвердження: +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### приклади команди `update-rules` +Оновлення конфігураційних файлів правил Sigma для WELA: +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/commands/usage.zh-TW.md b/website/docs/commands/usage.zh-TW.md new file mode 100644 index 00000000..705ebe56 --- /dev/null +++ b/website/docs/commands/usage.zh-TW.md @@ -0,0 +1,55 @@ +# 指令使用方式 +## audit-settings +`audit-settings` 指令會檢查 Windows 事件日誌的稽核原則設定，並將其與 [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings)、[Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) 以及 [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) 的建議設定進行比較。 +`RuleCount` 表示能夠偵測該類別中事件的 [Sigma 規則](https://github.com/SigmaHQ/sigma)數量。 + +### `audit-settings` 指令範例 +使用預設的 Yamato Security 建議設定進行檢查，並將結果儲存為 CSV： +``` +./WELA.ps1 audit-settings -Baseline YamatoSecurity +``` + +使用 Australian Signals Directorate 的建議設定進行檢查，並將結果儲存為 CSV： +``` +./WELA.ps1 audit-settings -Baseline ASD +``` + +使用 Microsoft 建議的 Server OS 設定進行檢查，並以 GUI 顯示結果： +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Server -OutType gui +``` + +使用 Microsoft 建議的 Client OS 設定進行檢查，並以表格格式顯示結果： +``` +./WELA.ps1 audit-settings -Baseline Microsoft_Client -OutType table +``` + +## audit-filesize +`audit-filesize` 指令會檢查 Windows 事件日誌的檔案大小，並將其與 Yamato Security 的建議設定進行比較。 + +### `audit-filesize` 指令範例 +使用 Yamato Security 的建議檢查 Windows 事件日誌檔案大小，並將結果儲存為 CSV： +``` +./WELA.ps1 audit-filesize -Baseline YamatoSecurity +``` + +## configure +`configure` 指令會設定建議的 Windows 事件日誌稽核原則與檔案大小。 + +#### `configure` 指令範例 +套用 Yamato Security 的建議設定（變更設定前會出現確認提示）： +``` +./WELA.ps1 configure -Baseline YamatoSecurity +``` + +套用 Australian Signals Directorate 的建議設定，且不出現確認提示： +``` +./WELA.ps1 configure -Baseline ASD -auto +``` + +## update-rules +#### `update-rules` 指令範例 +更新 WELA 的 Sigma 規則設定檔： +``` +./WELA.ps1 update-rules +``` diff --git a/website/docs/getting-started/index.ar.md b/website/docs/getting-started/index.ar.md new file mode 100644 index 00000000..dae6d666 --- /dev/null +++ b/website/docs/getting-started/index.ar.md @@ -0,0 +1,14 @@ +# البدء + +## المتطلبات الأساسية +* Windows PowerShell 5.1 أو PowerShell Core +* تشغيل PowerShell بامتيازات المسؤول + +## التنزيلات + +يرجى تنزيل أحدث إصدار مستقر من WELA من صفحة [Releases](https://github.com/Yamato-Security/wela/releases). + +## تشغيل WELA +1. قم بفك ضغط [ملف الإصدار المضغوط](https://github.com/Yamato-Security/wela/releases). +2. افتح PowerShell بـ **امتيازات المسؤول**. +3. `./WELA.ps1 help` لتشغيل WELA ورؤية طريقة استخدام المساعدة. diff --git a/website/docs/getting-started/index.de.md b/website/docs/getting-started/index.de.md new file mode 100644 index 00000000..9ba13f5e --- /dev/null +++ b/website/docs/getting-started/index.de.md @@ -0,0 +1,14 @@ +# Erste Schritte + +## Voraussetzungen +* Windows PowerShell 5.1 oder PowerShell Core +* Ausführen von PowerShell mit Administratorrechten + +## Downloads + +Bitte laden Sie die neueste stabile Version von WELA von der Seite [Releases](https://github.com/Yamato-Security/wela/releases) herunter. + +## WELA ausführen +1. Entpacken Sie die [Release-ZIP-Datei](https://github.com/Yamato-Security/wela/releases). +2. Öffnen Sie PowerShell mit **Administratorrechten**. +3. `./WELA.ps1 help`, um WELA auszuführen und die Hilfe zur Verwendung anzuzeigen. diff --git a/website/docs/getting-started/index.es.md b/website/docs/getting-started/index.es.md new file mode 100644 index 00000000..9f9e788a --- /dev/null +++ b/website/docs/getting-started/index.es.md @@ -0,0 +1,14 @@ +# Primeros pasos + +## Requisitos previos +* Windows PowerShell 5.1 o PowerShell Core +* Ejecutar PowerShell con privilegios de administrador + +## Descargas + +Descargue la última versión estable de WELA desde la página de [Releases](https://github.com/Yamato-Security/wela/releases). + +## Ejecutar WELA +1. Descomprima el [archivo zip de la versión](https://github.com/Yamato-Security/wela/releases). +2. Abra PowerShell con **privilegios de administrador**. +3. `./WELA.ps1 help` para ejecutar WELA y ver el uso de la ayuda. diff --git a/website/docs/getting-started/index.fr.md b/website/docs/getting-started/index.fr.md new file mode 100644 index 00000000..06dea995 --- /dev/null +++ b/website/docs/getting-started/index.fr.md @@ -0,0 +1,14 @@ +# Pour commencer + +## Prérequis +* Windows PowerShell 5.1 ou PowerShell Core +* Exécuter PowerShell avec des privilèges d'administrateur + +## Téléchargements + +Veuillez télécharger la dernière version stable de WELA depuis la page [Releases](https://github.com/Yamato-Security/wela/releases). + +## Exécution de WELA +1. Décompressez le [fichier zip de la release](https://github.com/Yamato-Security/wela/releases). +2. Ouvrez PowerShell avec des **privilèges d'administrateur**. +3. `./WELA.ps1 help` pour exécuter WELA et afficher l'aide d'utilisation. diff --git a/website/docs/getting-started/index.hi.md b/website/docs/getting-started/index.hi.md new file mode 100644 index 00000000..3da385f2 --- /dev/null +++ b/website/docs/getting-started/index.hi.md @@ -0,0 +1,14 @@ +# शुरुआत करना + +## आवश्यक शर्तें +* Windows PowerShell 5.1 या PowerShell Core +* Administrator विशेषाधिकारों के साथ PowerShell चलाना + +## डाउनलोड + +कृपया WELA का नवीनतम स्थिर संस्करण [Releases](https://github.com/Yamato-Security/wela/releases) पृष्ठ से डाउनलोड करें। + +## WELA चलाना +1. [release zip file](https://github.com/Yamato-Security/wela/releases) को अनज़िप करें। +2. **Administrator विशेषाधिकारों** के साथ PowerShell खोलें। +3. WELA चलाने और सहायता उपयोग देखने के लिए `./WELA.ps1 help`। diff --git a/website/docs/getting-started/index.id.md b/website/docs/getting-started/index.id.md new file mode 100644 index 00000000..c3ae9f79 --- /dev/null +++ b/website/docs/getting-started/index.id.md @@ -0,0 +1,14 @@ +# Memulai + +## Prasyarat +* Windows PowerShell 5.1 atau PowerShell Core +* Menjalankan PowerShell dengan hak istimewa Administrator + +## Unduhan + +Silakan unduh versi stabil terbaru WELA dari halaman [Releases](https://github.com/Yamato-Security/wela/releases). + +## Menjalankan WELA +1. Ekstrak [berkas zip rilis](https://github.com/Yamato-Security/wela/releases). +2. Buka PowerShell dengan **hak istimewa Administrator**. +3. `./WELA.ps1 help` untuk menjalankan WELA dan melihat petunjuk penggunaan bantuan. diff --git a/website/docs/getting-started/index.ja.md b/website/docs/getting-started/index.ja.md new file mode 100644 index 00000000..7d0e7e66 --- /dev/null +++ b/website/docs/getting-started/index.ja.md @@ -0,0 +1,14 @@ +# はじめに + +## 前提要件 +* PowerShell 5.1+ +* PowerShellをAdministrator権限で実行する + +## ダウンロード + +[リリースページ](https://github.com/Yamato-Security/wela/releases)から最新の安定版WELAをダウンロードしてください。 + +## WELAの実行 +1. [release zip file](https://github.com/Yamato-Security/wela/releases)を展開する。 +2. **Administrator権限**でPowerShellを開く。 +3. `./WELA.ps1 help`を実行する diff --git a/website/docs/getting-started/index.ko.md b/website/docs/getting-started/index.ko.md new file mode 100644 index 00000000..37a69c48 --- /dev/null +++ b/website/docs/getting-started/index.ko.md @@ -0,0 +1,14 @@ +# 시작하기 + +## 사전 요구 사항 +* Windows PowerShell 5.1 또는 PowerShell Core +* 관리자 권한으로 PowerShell 실행 + +## 다운로드 + +[Releases](https://github.com/Yamato-Security/wela/releases) 페이지에서 최신 안정 버전의 WELA를 다운로드하십시오. + +## WELA 실행 +1. [릴리스 zip 파일](https://github.com/Yamato-Security/wela/releases)의 압축을 해제합니다. +2. **관리자 권한**으로 PowerShell을 엽니다. +3. `./WELA.ps1 help`를 실행하여 WELA를 실행하고 도움말 사용법을 확인합니다. diff --git a/website/docs/getting-started/index.md b/website/docs/getting-started/index.md new file mode 100644 index 00000000..b08612fb --- /dev/null +++ b/website/docs/getting-started/index.md @@ -0,0 +1,14 @@ +# Getting Started + +## Prerequisites +* Windows PowerShell 5.1 or PowerShell Core +* Running PowerShell with Administrator privileges + +## Downloads + +Please download the latest stable version of WELA from the [Releases](https://github.com/Yamato-Security/wela/releases) page. + +## Running WELA +1. Unzip the [release zip file](https://github.com/Yamato-Security/wela/releases). +2. Open PowerShell with **Administrator privileges**. +3. `./WELA.ps1 help` to run WELA and see the help usage. diff --git a/website/docs/getting-started/index.my.md b/website/docs/getting-started/index.my.md new file mode 100644 index 00000000..eeae4cf0 --- /dev/null +++ b/website/docs/getting-started/index.my.md @@ -0,0 +1,14 @@ +# စတင်ခြင်း + +## ကြိုတင်လိုအပ်ချက်များ +* Windows PowerShell 5.1 သို့မဟုတ် PowerShell Core +* Administrator အခွင့်အရေးများဖြင့် PowerShell ကို လုပ်ဆောင်ခြင်း + +## ဒေါင်းလုဒ်များ + +WELA ၏ နောက်ဆုံးထွက် တည်ငြိမ်သော ဗားရှင်းကို [Releases](https://github.com/Yamato-Security/wela/releases) စာမျက်နှာမှ ဒေါင်းလုဒ်ဆွဲပါ။ + +## WELA ကို လုပ်ဆောင်ခြင်း +1. [release zip file](https://github.com/Yamato-Security/wela/releases) ကို unzip ဖြည်ပါ။ +2. **Administrator အခွင့်အရေးများ** ဖြင့် PowerShell ကို ဖွင့်ပါ။ +3. WELA ကို လုပ်ဆောင်ပြီး help အသုံးပြုနည်းကို ကြည့်ရန် `./WELA.ps1 help` ဟု ရိုက်ထည့်ပါ။ diff --git a/website/docs/getting-started/index.pt-BR.md b/website/docs/getting-started/index.pt-BR.md new file mode 100644 index 00000000..ba30ae50 --- /dev/null +++ b/website/docs/getting-started/index.pt-BR.md @@ -0,0 +1,14 @@ +# Primeiros Passos + +## Pré-requisitos +* Windows PowerShell 5.1 ou PowerShell Core +* Executar o PowerShell com privilégios de Administrador + +## Downloads + +Faça o download da versão estável mais recente do WELA na página de [Releases](https://github.com/Yamato-Security/wela/releases). + +## Executando o WELA +1. Descompacte o [arquivo zip da release](https://github.com/Yamato-Security/wela/releases). +2. Abra o PowerShell com **privilégios de Administrador**. +3. `./WELA.ps1 help` para executar o WELA e ver as instruções de uso da ajuda. diff --git a/website/docs/getting-started/index.th.md b/website/docs/getting-started/index.th.md new file mode 100644 index 00000000..74955faf --- /dev/null +++ b/website/docs/getting-started/index.th.md @@ -0,0 +1,14 @@ +# การเริ่มต้นใช้งาน + +## ข้อกำหนดเบื้องต้น +* Windows PowerShell 5.1 หรือ PowerShell Core +* การเรียกใช้ PowerShell ด้วยสิทธิ์ของผู้ดูแลระบบ + +## การดาวน์โหลด + +โปรดดาวน์โหลด WELA เวอร์ชันเสถียรล่าสุดจากหน้า [Releases](https://github.com/Yamato-Security/wela/releases) + +## การเรียกใช้ WELA +1. แตกไฟล์ [release zip file](https://github.com/Yamato-Security/wela/releases) +2. เปิด PowerShell ด้วย **สิทธิ์ของผู้ดูแลระบบ** +3. `./WELA.ps1 help` เพื่อเรียกใช้ WELA และดูวิธีการใช้งานความช่วยเหลือ diff --git a/website/docs/getting-started/index.tr.md b/website/docs/getting-started/index.tr.md new file mode 100644 index 00000000..a4de1480 --- /dev/null +++ b/website/docs/getting-started/index.tr.md @@ -0,0 +1,14 @@ +# Başlarken + +## Ön Gereksinimler +* Windows PowerShell 5.1 veya PowerShell Core +* PowerShell'in Yönetici ayrıcalıklarıyla çalıştırılması + +## İndirmeler + +Lütfen WELA'nın en son kararlı sürümünü [Releases](https://github.com/Yamato-Security/wela/releases) sayfasından indirin. + +## WELA'yı Çalıştırma +1. [release zip dosyasını](https://github.com/Yamato-Security/wela/releases) çıkarın. +2. PowerShell'i **Yönetici ayrıcalıklarıyla** açın. +3. WELA'yı çalıştırmak ve yardım kullanımını görmek için `./WELA.ps1 help`. diff --git a/website/docs/getting-started/index.uk.md b/website/docs/getting-started/index.uk.md new file mode 100644 index 00000000..95b84d70 --- /dev/null +++ b/website/docs/getting-started/index.uk.md @@ -0,0 +1,14 @@ +# Початок роботи + +## Передумови +* Windows PowerShell 5.1 або PowerShell Core +* Запуск PowerShell з правами адміністратора + +## Завантаження + +Будь ласка, завантажте останню стабільну версію WELA зі сторінки [Releases](https://github.com/Yamato-Security/wela/releases). + +## Запуск WELA +1. Розпакуйте [release zip file](https://github.com/Yamato-Security/wela/releases). +2. Відкрийте PowerShell з **правами адміністратора**. +3. `./WELA.ps1 help`, щоб запустити WELA та переглянути довідку з використання. diff --git a/website/docs/getting-started/index.zh-TW.md b/website/docs/getting-started/index.zh-TW.md new file mode 100644 index 00000000..fcedbfa5 --- /dev/null +++ b/website/docs/getting-started/index.zh-TW.md @@ -0,0 +1,14 @@ +# 開始使用 + +## 先決條件 +* Windows PowerShell 5.1 或 PowerShell Core +* 以系統管理員權限執行 PowerShell + +## 下載 + +請從 [Releases](https://github.com/Yamato-Security/wela/releases) 頁面下載最新的穩定版 WELA。 + +## 執行 WELA +1. 解壓縮 [release zip 檔案](https://github.com/Yamato-Security/wela/releases)。 +2. 以**系統管理員權限**開啟 PowerShell。 +3. 執行 `./WELA.ps1 help` 來啟動 WELA 並檢視說明用法。 diff --git a/website/docs/index.ar.md b/website/docs/index.ar.md new file mode 100644 index 00000000..e726c048 --- /dev/null +++ b/website/docs/index.ar.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅)، الذي أنشأته +Yamato Security، هو أداة +لتدقيق إعدادات سجل أحداث Windows. تُعد سجلات أحداث Windows مصدرًا حيويًا +للمعلومات في DFIR — يساعدك WELA على التأكد من أنك تسجل بالفعل الأحداث المهمة. +

+ +
+[ابدأ الآن :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[مرجع الأوامر :material-console:](commands/index.md){ .md-button } +[عرض على GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## لماذا WELA؟ + +
+ +- :material-clipboard-check:{ .lg .middle } __تدقيق إعدادات سياسة السجل__ + + --- + + دقّق **إعدادات سياسة التدقيق** الخاصة بسجل أحداث Windows للتأكد من تسجيل الأحداث الصحيحة. + +- :material-book-check:{ .lg .middle } __مبني على الإرشادات__ + + --- + + يتحقق مقابل **إرشادات تكوين تدقيق سجل أحداث Windows الرئيسية**. + +- :material-shield-search:{ .lg .middle } __قابلية الاكتشاف بواسطة Sigma__ + + --- + + يقيّم إعداداتك مقابل **قابلية الاكتشاف الواقعية لقواعد Sigma** — هل ستلتقط سجلاتك الهجمات فعليًا؟ + +- :material-file-cog:{ .lg .middle } __تدقيق حجم الملف__ + + --- + + يدقق **أحجام ملفات** سجل أحداث Windows ويقترح الأحجام الموصى بها. + +- :material-cog-play:{ .lg .middle } __التكوين التلقائي__ + + --- + + طبّق سياسة التدقيق وأحجام ملفات السجل **الموصى بها** باستخدام أمر `configure`. + +- :material-chart-box:{ .lg .middle } __مخرجات مرنة__ + + --- + + اعرض النتائج في الطرفية، أو واجهة رسومية، أو جدول، أو كخريطة حرارية لـ **MITRE ATT&CK Navigator**. + +
+ +## روابط سريعة + +
+ +- __:material-book-open-variant: جديد هنا؟__ + + ابدأ بـ [نظرة عامة](overview/index.md)، ثم توجه إلى + [البدء](getting-started/index.md) لتثبيت WELA وتشغيله. + +- __:material-console-line: تعمل مع واجهة سطر الأوامر؟__ + + تصفّح [قائمة الأوامر](commands/index.md) ومرجع [استخدام الأوامر](commands/usage.md) + (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: تريد المزيد؟__ + + استكشف [المشاريع المصاحبة](resources/companion-projects.md)، و + [سجل التغييرات](resources/changelog.md)، وكيفية + [المساهمة](resources/contributing.md). + +
diff --git a/website/docs/index.de.md b/website/docs/index.de.md new file mode 100644 index 00000000..fa0b705f --- /dev/null +++ b/website/docs/index.de.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅), erstellt von +Yamato Security, ist ein Werkzeug zum +Überprüfen von Windows-Ereignisprotokolleinstellungen. Windows-Ereignisprotokolle sind eine entscheidende Informationsquelle +für DFIR — WELA hilft Ihnen sicherzustellen, dass Sie tatsächlich die Ereignisse aufzeichnen, die wichtig sind. +

+ +
+[Erste Schritte :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Befehlsreferenz :material-console:](commands/index.md){ .md-button } +[Auf GitHub ansehen :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## Warum WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __Überwachungsrichtlinieneinstellungen prüfen__ + + --- + + Überprüfen Sie die **Überwachungsrichtlinieneinstellungen** Ihrer Windows-Ereignisprotokolle, um zu bestätigen, dass die richtigen Ereignisse protokolliert werden. + +- :material-book-check:{ .lg .middle } __Auf Richtlinien basierend__ + + --- + + Prüft anhand der **wichtigsten Konfigurationsrichtlinien für die Überwachung von Windows-Ereignisprotokollen**. + +- :material-shield-search:{ .lg .middle } __Sigma-Erkennbarkeit__ + + --- + + Bewertet Ihre Einstellungen anhand der **realen Erkennbarkeit durch Sigma-Regeln** — werden Ihre Protokolle Angriffe tatsächlich erfassen? + +- :material-file-cog:{ .lg .middle } __Dateigrößenprüfung__ + + --- + + Prüft die **Dateigrößen** von Windows-Ereignisprotokollen und schlägt empfohlene Größen vor. + +- :material-cog-play:{ .lg .middle } __Automatische Konfiguration__ + + --- + + Wenden Sie die **empfohlene** Überwachungsrichtlinie und Protokolldateigrößen mit dem Befehl `configure` an. + +- :material-chart-box:{ .lg .middle } __Flexible Ausgabe__ + + --- + + Sehen Sie sich die Ergebnisse im Terminal, in einer GUI, in einer Tabelle oder als **MITRE ATT&CK Navigator**-Heatmap an. + +
+ +## Schnelllinks + +
+ +- __:material-book-open-variant: Neu hier?__ + + Beginnen Sie mit der [Übersicht](overview/index.md) und gehen Sie dann zu den + [Ersten Schritten](getting-started/index.md), um WELA zu installieren und auszuführen. + +- __:material-console-line: Arbeiten Sie mit der CLI?__ + + Durchsuchen Sie die [Befehlsliste](commands/index.md) und die Referenz zur [Befehlsverwendung](commands/usage.md) + (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: Gehen Sie weiter?__ + + Erkunden Sie die [Begleitprojekte](resources/companion-projects.md), das + [Änderungsprotokoll](resources/changelog.md) und wie Sie + [beitragen](resources/contributing.md) können. + +
diff --git a/website/docs/index.es.md b/website/docs/index.es.md new file mode 100644 index 00000000..e7238874 --- /dev/null +++ b/website/docs/index.es.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅), creado por +Yamato Security, es una herramienta para +auditar la configuración de los registros de eventos de Windows. Los registros de eventos de Windows son una fuente vital de +información para DFIR — WELA te ayuda a asegurarte de que realmente estás registrando los eventos que importan. +

+ +
+[Comenzar :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Referencia de comandos :material-console:](commands/index.md){ .md-button } +[Ver en GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## ¿Por qué WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __Auditar la configuración de la política de registro__ + + --- + + Audita la **configuración de la política de auditoría** de los registros de eventos de Windows para confirmar que se están registrando los eventos correctos. + +- :material-book-check:{ .lg .middle } __Basado en directrices__ + + --- + + Comprueba según las **principales directrices de configuración de auditoría de los registros de eventos de Windows**. + +- :material-shield-search:{ .lg .middle } __Detectabilidad de Sigma__ + + --- + + Evalúa tu configuración frente a la **detectabilidad de reglas Sigma del mundo real** — ¿tus registros realmente detectarán los ataques? + +- :material-file-cog:{ .lg .middle } __Auditoría del tamaño de archivos__ + + --- + + Audita los **tamaños de archivo** de los registros de eventos de Windows y sugiere tamaños recomendados. + +- :material-cog-play:{ .lg .middle } __Configuración automática__ + + --- + + Aplica la política de auditoría **recomendada** y los tamaños de archivo de registro con el comando `configure`. + +- :material-chart-box:{ .lg .middle } __Salida flexible__ + + --- + + Visualiza los resultados en la terminal, una GUI, una tabla o como un mapa de calor de **MITRE ATT&CK Navigator**. + +
+ +## Enlaces rápidos + +
+ +- __:material-book-open-variant: ¿Nuevo aquí?__ + + Comienza con la [Descripción general](overview/index.md), luego dirígete a + [Primeros pasos](getting-started/index.md) para instalar y ejecutar WELA. + +- __:material-console-line: ¿Trabajando con la CLI?__ + + Explora la [Lista de comandos](commands/index.md) y la referencia de [Uso de comandos](commands/usage.md) + (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: ¿Quieres ir más allá?__ + + Explora los [Proyectos complementarios](resources/companion-projects.md), el + [Registro de cambios](resources/changelog.md), y cómo + [contribuir](resources/contributing.md). + +
diff --git a/website/docs/index.fr.md b/website/docs/index.fr.md new file mode 100644 index 00000000..ed20d304 --- /dev/null +++ b/website/docs/index.fr.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅), créé par +Yamato Security, est un outil pour +auditer les paramètres des journaux d'événements Windows. Les journaux d'événements Windows sont une source d'informations essentielle +pour le DFIR — WELA vous aide à vous assurer que vous enregistrez réellement les événements qui comptent. +

+ +
+[Commencer :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Référence des commandes :material-console:](commands/index.md){ .md-button } +[Voir sur GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## Pourquoi WELA ? + +
+ +- :material-clipboard-check:{ .lg .middle } __Auditer les paramètres de la stratégie des journaux__ + + --- + + Auditez les **paramètres de la stratégie d'audit** de vos journaux d'événements Windows pour confirmer que les bons événements sont journalisés. + +- :material-book-check:{ .lg .middle } __Basé sur des recommandations__ + + --- + + Vérifie par rapport aux **principales recommandations de configuration d'audit des journaux d'événements Windows**. + +- :material-shield-search:{ .lg .middle } __Détectabilité Sigma__ + + --- + + Évalue vos paramètres par rapport à la **détectabilité réelle des règles Sigma** — vos journaux détecteront-ils réellement les attaques ? + +- :material-file-cog:{ .lg .middle } __Audit de la taille des fichiers__ + + --- + + Audite la **taille des fichiers** des journaux d'événements Windows et suggère des tailles recommandées. + +- :material-cog-play:{ .lg .middle } __Configuration automatique__ + + --- + + Appliquez la stratégie d'audit **recommandée** et les tailles des fichiers journaux avec la commande `configure`. + +- :material-chart-box:{ .lg .middle } __Sortie flexible__ + + --- + + Consultez les résultats dans le terminal, une interface graphique, un tableau, ou sous forme de carte de chaleur **MITRE ATT&CK Navigator**. + +
+ +## Liens rapides + +
+ +- __:material-book-open-variant: Vous débutez ?__ + + Commencez par l'[Aperçu](overview/index.md), puis dirigez-vous vers + [Premiers pas](getting-started/index.md) pour installer et exécuter WELA. + +- __:material-console-line: Vous travaillez avec la CLI ?__ + + Parcourez la [Liste des commandes](commands/index.md) et la référence d'[Utilisation des commandes](commands/usage.md) + (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: Aller plus loin ?__ + + Explorez les [Projets compagnons](resources/companion-projects.md), le + [Journal des modifications](resources/changelog.md), et comment + [contribuer](resources/contributing.md). + +
diff --git a/website/docs/index.hi.md b/website/docs/index.hi.md new file mode 100644 index 00000000..4fe07e2c --- /dev/null +++ b/website/docs/index.hi.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅), जिसे +Yamato Security द्वारा बनाया गया है, एक उपकरण है +Windows इवेंट लॉग सेटिंग्स के ऑडिट के लिए। Windows इवेंट लॉग DFIR के लिए जानकारी का +एक महत्वपूर्ण स्रोत हैं — WELA आपको यह सुनिश्चित करने में मदद करता है कि आप वास्तव में उन घटनाओं को रिकॉर्ड कर रहे हैं जो मायने रखती हैं। +

+ +
+[शुरू करें :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[कमांड संदर्भ :material-console:](commands/index.md){ .md-button } +[GitHub पर देखें :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## WELA क्यों? + +
+ +- :material-clipboard-check:{ .lg .middle } __ऑडिट लॉग पॉलिसी सेटिंग्स__ + + --- + + अपनी Windows इवेंट लॉग **ऑडिट पॉलिसी सेटिंग्स** का ऑडिट करें ताकि यह पुष्टि हो सके कि सही घटनाएं लॉग की जा रही हैं। + +- :material-book-check:{ .lg .middle } __दिशानिर्देशों पर आधारित__ + + --- + + **प्रमुख Windows इवेंट लॉग ऑडिट कॉन्फ़िगरेशन दिशानिर्देशों** के विरुद्ध जांच करता है। + +- :material-shield-search:{ .lg .middle } __Sigma पहचान क्षमता__ + + --- + + आपकी सेटिंग्स का **वास्तविक दुनिया की Sigma नियम पहचान क्षमता** के विरुद्ध मूल्यांकन करता है — क्या आपके लॉग वास्तव में हमलों को पकड़ पाएंगे? + +- :material-file-cog:{ .lg .middle } __फ़ाइल-आकार ऑडिटिंग__ + + --- + + Windows इवेंट लॉग **फ़ाइल आकारों** का ऑडिट करता है और अनुशंसित आकार सुझाता है। + +- :material-cog-play:{ .lg .middle } __स्वतः-कॉन्फ़िगर__ + + --- + + `configure` कमांड के साथ **अनुशंसित** ऑडिट पॉलिसी और लॉग फ़ाइल आकार लागू करें। + +- :material-chart-box:{ .lg .middle } __लचीला आउटपुट__ + + --- + + परिणामों को टर्मिनल, GUI, टेबल, या **MITRE ATT&CK Navigator** हीटमैप के रूप में देखें। + +
+ +## त्वरित लिंक + +
+ +- __:material-book-open-variant: यहां नए हैं?__ + + [Overview](overview/index.md) से शुरू करें, फिर WELA इंस्टॉल और चलाने के लिए + [Getting Started](getting-started/index.md) पर जाएं। + +- __:material-console-line: CLI के साथ काम कर रहे हैं?__ + + [Command List](commands/index.md) और [Command Usage](commands/usage.md) + संदर्भ ब्राउज़ करें (`audit-settings`, `audit-filesize`, `configure`, `update-rules`)। + +- __:material-puzzle: आगे बढ़ रहे हैं?__ + + [Companion Projects](resources/companion-projects.md), + [Changelog](resources/changelog.md), और + [योगदान](resources/contributing.md) कैसे करें, इसका अन्वेषण करें। + +
diff --git a/website/docs/index.id.md b/website/docs/index.id.md new file mode 100644 index 00000000..e55acc0b --- /dev/null +++ b/website/docs/index.id.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅), dibuat oleh +Yamato Security, adalah alat untuk +mengaudit pengaturan log peristiwa Windows. Log peristiwa Windows merupakan sumber +informasi yang vital bagi DFIR — WELA membantu Anda memastikan bahwa Anda benar-benar merekam peristiwa yang penting. +

+ +
+[Mulai :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Referensi Perintah :material-console:](commands/index.md){ .md-button } +[Lihat di GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## Mengapa WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __Audit pengaturan kebijakan log__ + + --- + + Audit **pengaturan kebijakan audit** log peristiwa Windows Anda untuk memastikan peristiwa yang tepat sedang dicatat. + +- :material-book-check:{ .lg .middle } __Berdasarkan pedoman__ + + --- + + Memeriksa terhadap **pedoman konfigurasi audit log peristiwa Windows yang utama**. + +- :material-shield-search:{ .lg .middle } __Keterdeteksian Sigma__ + + --- + + Mengevaluasi pengaturan Anda terhadap **keterdeteksian aturan Sigma di dunia nyata** — apakah log Anda benar-benar akan menangkap serangan? + +- :material-file-cog:{ .lg .middle } __Audit ukuran file__ + + --- + + Mengaudit **ukuran file** log peristiwa Windows dan menyarankan ukuran yang direkomendasikan. + +- :material-cog-play:{ .lg .middle } __Konfigurasi otomatis__ + + --- + + Terapkan kebijakan audit dan ukuran file log yang **direkomendasikan** dengan perintah `configure`. + +- :material-chart-box:{ .lg .middle } __Keluaran fleksibel__ + + --- + + Lihat hasil di terminal, GUI, tabel, atau sebagai peta panas **MITRE ATT&CK Navigator**. + +
+ +## Tautan cepat + +
+ +- __:material-book-open-variant: Baru di sini?__ + + Mulai dengan [Ikhtisar](overview/index.md), lalu lanjut ke + [Memulai](getting-started/index.md) untuk memasang dan menjalankan WELA. + +- __:material-console-line: Bekerja dengan CLI?__ + + Telusuri [Daftar Perintah](commands/index.md) dan referensi [Penggunaan Perintah](commands/usage.md) + (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: Ingin lebih jauh?__ + + Jelajahi [Proyek Pendamping](resources/companion-projects.md), + [Changelog](resources/changelog.md), dan cara + [berkontribusi](resources/contributing.md). + +
diff --git a/website/docs/index.ja.md b/website/docs/index.ja.md new file mode 100644 index 00000000..017b8150 --- /dev/null +++ b/website/docs/index.ja.md @@ -0,0 +1,100 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA（Windows Event Log Analyzer、ゑ羅）は、 +Yamato Security によって作られた、 +Windows イベントログの設定を監査するためのツールです。Windows イベントログは +DFIR における重要な情報源です。WELA は、本当に必要なイベントが記録されているかを確認するのに役立ちます。 +

+ +
+[はじめる :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[コマンド一覧 :material-console:](commands/index.md){ .md-button } +[GitHub で見る :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## WELA の特徴 + +
+ +- :material-clipboard-check:{ .lg .middle } __監査ポリシー設定の監査__ + + --- + + Windows イベントログの**監査ポリシー設定**を監査し、必要なイベントが記録されているか確認します。 + +- :material-book-check:{ .lg .middle } __ガイドラインに基づく確認__ + + --- + + 主要な Windows イベントログ監査設定の**ガイドライン**に基づいてチェックします。 + +- :material-shield-search:{ .lg .middle } __Sigma 検知可能性__ + + --- + + 実際の **Sigma ルールの検知可能性**に基づいて設定を評価します。ログで攻撃を検知できますか？ + +- :material-file-cog:{ .lg .middle } __ファイルサイズの監査__ + + --- + + Windows イベントログの**ファイルサイズ**を監査し、推奨サイズを提案します。 + +- :material-cog-play:{ .lg .middle } __自動設定__ + + --- + + `configure` コマンドで、**推奨**の監査ポリシーとログファイルサイズを適用します。 + +- :material-chart-box:{ .lg .middle } __柔軟な出力__ + + --- + + 結果をターミナル・GUI・テーブル、または **MITRE ATT&CK Navigator** のヒートマップで表示できます。 + +
+ +## クイックリンク + +
+ +- __:material-book-open-variant: はじめての方へ__ + + まずは[概要](overview/index.md)を読み、[はじめる](getting-started/index.md)で + WELA のインストールと実行を行いましょう。 + +- __:material-console-line: CLI を使う__ + + [コマンド一覧](commands/index.md)と[コマンド使用例](commands/usage.md) + （`audit-settings`・`audit-filesize`・`configure`・`update-rules`）をご覧ください。 + +- __:material-puzzle: さらに活用する__ + + [関連プロジェクト](resources/companion-projects.md)、[変更履歴](resources/changelog.md)、 + [貢献方法](resources/contributing.md)を見てみましょう。 + +
diff --git a/website/docs/index.ko.md b/website/docs/index.ko.md new file mode 100644 index 00000000..926eb100 --- /dev/null +++ b/website/docs/index.ko.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+Yamato Security가 만든 +WELA (Windows Event Log Analyzer, ゑ羅)는 +Windows 이벤트 로그 설정을 감사하기 위한 도구입니다. Windows 이벤트 로그는 DFIR에 필수적인 +정보 출처이며 — WELA는 여러분이 중요한 이벤트를 실제로 기록하고 있는지 확인하도록 도와줍니다. +

+ +
+[시작하기 :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[명령어 레퍼런스 :material-console:](commands/index.md){ .md-button } +[GitHub에서 보기 :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## 왜 WELA인가? + +
+ +- :material-clipboard-check:{ .lg .middle } __감사 로그 정책 설정__ + + --- + + 올바른 이벤트가 기록되고 있는지 확인하기 위해 Windows 이벤트 로그 **감사 정책 설정**을 감사합니다. + +- :material-book-check:{ .lg .middle } __가이드라인 기반__ + + --- + + **주요 Windows 이벤트 로그 감사 구성 가이드라인**을 기준으로 점검합니다. + +- :material-shield-search:{ .lg .middle } __Sigma 탐지 가능성__ + + --- + + **실제 환경의 Sigma 규칙 탐지 가능성**을 기준으로 설정을 평가합니다 — 여러분의 로그가 실제로 공격을 잡아낼 수 있을까요? + +- :material-file-cog:{ .lg .middle } __파일 크기 감사__ + + --- + + Windows 이벤트 로그 **파일 크기**를 감사하고 권장 크기를 제안합니다. + +- :material-cog-play:{ .lg .middle } __자동 구성__ + + --- + + `configure` 명령어로 **권장** 감사 정책과 로그 파일 크기를 적용합니다. + +- :material-chart-box:{ .lg .middle } __유연한 출력__ + + --- + + 결과를 터미널, GUI, 표, 또는 **MITRE ATT&CK Navigator** 히트맵으로 확인합니다. + +
+ +## 빠른 링크 + +
+ +- __:material-book-open-variant: 처음이신가요?__ + + [개요](overview/index.md)로 시작한 다음, + [시작하기](getting-started/index.md)로 이동하여 WELA를 설치하고 실행하세요. + +- __:material-console-line: CLI로 작업 중이신가요?__ + + [명령어 목록](commands/index.md)과 [명령어 사용법](commands/usage.md) + 레퍼런스(`audit-settings`, `audit-filesize`, `configure`, `update-rules`)를 살펴보세요. + +- __:material-puzzle: 더 깊이 알아보시려나요?__ + + [관련 프로젝트](resources/companion-projects.md), + [변경 이력](resources/changelog.md), 그리고 + [기여하기](resources/contributing.md) 방법을 살펴보세요. + +
diff --git a/website/docs/index.md b/website/docs/index.md new file mode 100644 index 00000000..bc832f59 --- /dev/null +++ b/website/docs/index.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅), created by +Yamato Security, is a tool for +auditing Windows event log settings. Windows event logs are a vital source of +information for DFIR — WELA helps you make sure you are actually recording the events that matter. +

+ +
+[Get Started :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Command Reference :material-console:](commands/index.md){ .md-button } +[View on GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## Why WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __Audit log policy settings__ + + --- + + Audit your Windows event log **audit policy settings** to confirm the right events are being logged. + +- :material-book-check:{ .lg .middle } __Based on guidelines__ + + --- + + Checks against the **major Windows event log audit configuration guidelines**. + +- :material-shield-search:{ .lg .middle } __Sigma detectability__ + + --- + + Evaluates your settings against **real-world Sigma rule detectability** — will your logs actually catch attacks? + +- :material-file-cog:{ .lg .middle } __File-size auditing__ + + --- + + Audits Windows event log **file sizes** and suggests recommended sizes. + +- :material-cog-play:{ .lg .middle } __Auto-configure__ + + --- + + Apply the **recommended** audit policy and log file sizes with the `configure` command. + +- :material-chart-box:{ .lg .middle } __Flexible output__ + + --- + + View results in the terminal, a GUI, a table, or as a **MITRE ATT&CK Navigator** heatmap. + +
+ +## Quick links + +
+ +- __:material-book-open-variant: New here?__ + + Start with the [Overview](overview/index.md), then head to + [Getting Started](getting-started/index.md) to install and run WELA. + +- __:material-console-line: Working with the CLI?__ + + Browse the [Command List](commands/index.md) and the [Command Usage](commands/usage.md) + reference (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: Going further?__ + + Explore the [Companion Projects](resources/companion-projects.md), the + [Changelog](resources/changelog.md), and how to + [contribute](resources/contributing.md). + +
diff --git a/website/docs/index.my.md b/website/docs/index.my.md new file mode 100644 index 00000000..11539972 --- /dev/null +++ b/website/docs/index.my.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅) ကို +Yamato Security မှ ဖန်တီးထားပြီး၊ ၎င်းသည် +Windows event log ဆက်တင်များကို စစ်ဆေးအတည်ပြုခြင်း အတွက် ကိရိယာတစ်ခုဖြစ်သည်။ Windows event log များသည် DFIR အတွက် အရေးကြီးသော +သတင်းအချက်အလက် ရင်းမြစ်တစ်ခုဖြစ်ပြီး — WELA သည် အရေးပါသော အဖြစ်အပျက်များကို သင်အမှန်တကယ် မှတ်တမ်းတင်နေကြောင်း သေချာစေရန် ကူညီပေးသည်။ +

+ +
+[စတင်အသုံးပြုရန် :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Command အကိုးအကား :material-console:](commands/index.md){ .md-button } +[GitHub တွင်ကြည့်ရှုရန် :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## WELA ကို ဘာကြောင့်ရွေးချယ်သင့်သနည်း။ + +
+ +- :material-clipboard-check:{ .lg .middle } __Log policy ဆက်တင်များကို စစ်ဆေးခြင်း__ + + --- + + မှန်ကန်သော အဖြစ်အပျက်များကို မှတ်တမ်းတင်နေကြောင်း အတည်ပြုရန် သင်၏ Windows event log **audit policy ဆက်တင်များ** ကို စစ်ဆေးပါ။ + +- :material-book-check:{ .lg .middle } __လမ်းညွှန်ချက်များအပေါ် အခြေခံထားသည်__ + + --- + + **အဓိက Windows event log audit configuration လမ်းညွှန်ချက်များ** နှင့်ညှိနှိုင်း၍ စစ်ဆေးပေးသည်။ + +- :material-shield-search:{ .lg .middle } __Sigma ဖြင့် ထောက်လှမ်းနိုင်စွမ်း__ + + --- + + သင်၏ ဆက်တင်များကို **လက်တွေ့ကမ္ဘာ Sigma rule ထောက်လှမ်းနိုင်စွမ်း** နှင့်ညှိနှိုင်း၍ အကဲဖြတ်ပေးသည် — သင်၏ log များသည် တိုက်ခိုက်မှုများကို အမှန်တကယ် ဖမ်းမိနိုင်ပါမည်လား။ + +- :material-file-cog:{ .lg .middle } __ဖိုင်အရွယ်အစား စစ်ဆေးခြင်း__ + + --- + + Windows event log **ဖိုင်အရွယ်အစားများ** ကို စစ်ဆေးပြီး အကြံပြုထားသော အရွယ်အစားများကို အကြံပြုပေးသည်။ + +- :material-cog-play:{ .lg .middle } __အလိုအလျောက် configure ပြုလုပ်ခြင်း__ + + --- + + **အကြံပြုထားသော** audit policy နှင့် log ဖိုင်အရွယ်အစားများကို `configure` command ဖြင့် အသုံးပြုပါ။ + +- :material-chart-box:{ .lg .middle } __ပြောင်းလွယ်ပြင်လွယ် output__ + + --- + + ရလဒ်များကို terminal၊ GUI၊ table တွင် သို့မဟုတ် **MITRE ATT&CK Navigator** heatmap အဖြစ် ကြည့်ရှုပါ။ + +
+ +## အမြန်လင့်ခ်များ + +
+ +- __:material-book-open-variant: ဤနေရာတွင် အသစ်လား။__ + + [Overview](overview/index.md) ဖြင့် စတင်ပြီးနောက် WELA ကို install ပြုလုပ်၍ run ရန် + [Getting Started](getting-started/index.md) သို့ ဆက်သွားပါ။ + +- __:material-console-line: CLI ဖြင့် အလုပ်လုပ်နေပါသလား။__ + + [Command List](commands/index.md) နှင့် [Command Usage](commands/usage.md) + အကိုးအကား (`audit-settings`, `audit-filesize`, `configure`, `update-rules`) ကို လှော်လှန်ကြည့်ပါ။ + +- __:material-puzzle: ပိုမိုဆက်လက်လေ့လာမည်လား။__ + + [Companion Projects](resources/companion-projects.md)၊ + [Changelog](resources/changelog.md) နှင့် + [contribute](resources/contributing.md) ပြုလုပ်နည်းကို လေ့လာပါ။ + +
diff --git a/website/docs/index.pt-BR.md b/website/docs/index.pt-BR.md new file mode 100644 index 00000000..376e8a48 --- /dev/null +++ b/website/docs/index.pt-BR.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+O WELA (Windows Event Log Analyzer, ゑ羅), criado pela +Yamato Security, é uma ferramenta para +auditar as configurações de log de eventos do Windows. Os logs de eventos do Windows são uma fonte vital de +informações para DFIR — o WELA ajuda você a garantir que está de fato registrando os eventos que importam. +

+ +
+[Começar :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Referência de Comandos :material-console:](commands/index.md){ .md-button } +[Ver no GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## Por que WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __Auditar configurações de política de log__ + + --- + + Audite as **configurações de política de auditoria** do log de eventos do Windows para confirmar que os eventos certos estão sendo registrados. + +- :material-book-check:{ .lg .middle } __Baseado em diretrizes__ + + --- + + Verifica em relação às **principais diretrizes de configuração de auditoria de log de eventos do Windows**. + +- :material-shield-search:{ .lg .middle } __Detectabilidade do Sigma__ + + --- + + Avalia suas configurações em relação à **detectabilidade real de regras Sigma** — seus logs realmente vão capturar ataques? + +- :material-file-cog:{ .lg .middle } __Auditoria de tamanho de arquivo__ + + --- + + Audita os **tamanhos de arquivo** do log de eventos do Windows e sugere tamanhos recomendados. + +- :material-cog-play:{ .lg .middle } __Configuração automática__ + + --- + + Aplique a política de auditoria e os tamanhos de arquivo de log **recomendados** com o comando `configure`. + +- :material-chart-box:{ .lg .middle } __Saída flexível__ + + --- + + Veja os resultados no terminal, em uma GUI, em uma tabela ou como um mapa de calor do **MITRE ATT&CK Navigator**. + +
+ +## Links rápidos + +
+ +- __:material-book-open-variant: Novo por aqui?__ + + Comece pela [Visão geral](overview/index.md) e, em seguida, vá para + [Primeiros passos](getting-started/index.md) para instalar e executar o WELA. + +- __:material-console-line: Trabalhando com a CLI?__ + + Navegue pela [Lista de Comandos](commands/index.md) e pela referência de + [Uso dos Comandos](commands/usage.md) (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: Indo mais além?__ + + Explore os [Projetos Complementares](resources/companion-projects.md), o + [Changelog](resources/changelog.md) e como + [contribuir](resources/contributing.md). + +
diff --git a/website/docs/index.th.md b/website/docs/index.th.md new file mode 100644 index 00000000..6504b082 --- /dev/null +++ b/website/docs/index.th.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅) สร้างโดย +Yamato Security เป็นเครื่องมือสำหรับ +ตรวจสอบการตั้งค่า Windows event log Windows event log เป็นแหล่ง +ข้อมูลที่สำคัญสำหรับ DFIR — WELA ช่วยให้คุณมั่นใจได้ว่าคุณกำลังบันทึกเหตุการณ์ที่มีความสำคัญอย่างแท้จริง +

+ +
+[เริ่มต้นใช้งาน :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[คู่มืออ้างอิงคำสั่ง :material-console:](commands/index.md){ .md-button } +[ดูบน GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## ทำไมต้อง WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __ตรวจสอบการตั้งค่านโยบายการบันทึก log__ + + --- + + ตรวจสอบ **การตั้งค่านโยบายการตรวจสอบ (audit policy)** ของ Windows event log เพื่อยืนยันว่ามีการบันทึกเหตุการณ์ที่ถูกต้อง + +- :material-book-check:{ .lg .middle } __อ้างอิงตามแนวทางมาตรฐาน__ + + --- + + ตรวจสอบเทียบกับ **แนวทางการกำหนดค่าการตรวจสอบ Windows event log หลัก ๆ** + +- :material-shield-search:{ .lg .middle } __ความสามารถในการตรวจจับของ Sigma__ + + --- + + ประเมินการตั้งค่าของคุณเทียบกับ **ความสามารถในการตรวจจับด้วยกฎ Sigma ในสถานการณ์จริง** — log ของคุณจะจับการโจมตีได้จริงหรือไม่? + +- :material-file-cog:{ .lg .middle } __ตรวจสอบขนาดไฟล์__ + + --- + + ตรวจสอบ **ขนาดไฟล์** ของ Windows event log และแนะนำขนาดที่เหมาะสม + +- :material-cog-play:{ .lg .middle } __กำหนดค่าอัตโนมัติ__ + + --- + + นำ **นโยบายการตรวจสอบและขนาดไฟล์ log ที่แนะนำ** ไปใช้ด้วยคำสั่ง `configure` + +- :material-chart-box:{ .lg .middle } __ผลลัพธ์ที่ยืดหยุ่น__ + + --- + + ดูผลลัพธ์ในเทอร์มินัล, GUI, ตาราง หรือในรูปแบบ heatmap ของ **MITRE ATT&CK Navigator** + +
+ +## ลิงก์ด่วน + +
+ +- __:material-book-open-variant: เพิ่งเริ่มต้นใช้งาน?__ + + เริ่มจาก [ภาพรวม](overview/index.md) จากนั้นไปที่ + [การเริ่มต้นใช้งาน](getting-started/index.md) เพื่อติดตั้งและรัน WELA + +- __:material-console-line: กำลังใช้งานผ่าน CLI?__ + + เรียกดู [รายการคำสั่ง](commands/index.md) และคู่มืออ้างอิง [การใช้งานคำสั่ง](commands/usage.md) + (`audit-settings`, `audit-filesize`, `configure`, `update-rules`) + +- __:material-puzzle: ต้องการเรียนรู้เพิ่มเติม?__ + + สำรวจ [โปรเจกต์ที่เกี่ยวข้อง](resources/companion-projects.md), + [บันทึกการเปลี่ยนแปลง](resources/changelog.md) และวิธีการ + [มีส่วนร่วม](resources/contributing.md) + +
diff --git a/website/docs/index.tr.md b/website/docs/index.tr.md new file mode 100644 index 00000000..8439f43c --- /dev/null +++ b/website/docs/index.tr.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+Yamato Security tarafından oluşturulan +WELA (Windows Event Log Analyzer, ゑ羅), +Windows olay günlüğü ayarlarını denetlemek için bir araçtır. Windows olay günlükleri DFIR için hayati bir +bilgi kaynağıdır — WELA, önemli olayları gerçekten kaydettiğinizden emin olmanıza yardımcı olur. +

+ +
+[Başlayın :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Komut Referansı :material-console:](commands/index.md){ .md-button } +[GitHub'da Görüntüle :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## Neden WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __Günlük ilkesi ayarlarını denetleyin__ + + --- + + Doğru olayların günlüğe kaydedildiğini doğrulamak için Windows olay günlüğü **denetim ilkesi ayarlarınızı** denetleyin. + +- :material-book-check:{ .lg .middle } __Yönergelere dayalı__ + + --- + + **Başlıca Windows olay günlüğü denetim yapılandırma yönergelerine** karşı kontrol eder. + +- :material-shield-search:{ .lg .middle } __Sigma tespit edilebilirliği__ + + --- + + Ayarlarınızı **gerçek dünya Sigma kuralı tespit edilebilirliğine** karşı değerlendirir — günlükleriniz saldırıları gerçekten yakalayacak mı? + +- :material-file-cog:{ .lg .middle } __Dosya boyutu denetimi__ + + --- + + Windows olay günlüğü **dosya boyutlarını** denetler ve önerilen boyutları önerir. + +- :material-cog-play:{ .lg .middle } __Otomatik yapılandırma__ + + --- + + `configure` komutuyla **önerilen** denetim ilkesini ve günlük dosyası boyutlarını uygulayın. + +- :material-chart-box:{ .lg .middle } __Esnek çıktı__ + + --- + + Sonuçları terminalde, bir GUI'de, bir tabloda veya bir **MITRE ATT&CK Navigator** ısı haritası olarak görüntüleyin. + +
+ +## Hızlı bağlantılar + +
+ +- __:material-book-open-variant: Buraya yeni mi geldiniz?__ + + [Genel Bakış](overview/index.md) ile başlayın, ardından WELA'yı kurmak ve çalıştırmak için + [Başlangıç](getting-started/index.md) bölümüne geçin. + +- __:material-console-line: CLI ile mi çalışıyorsunuz?__ + + [Komut Listesi](commands/index.md) ve [Komut Kullanımı](commands/usage.md) + referansına göz atın (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: Daha ileri mi gidiyorsunuz?__ + + [Tamamlayıcı Projeleri](resources/companion-projects.md), + [Değişiklik Günlüğünü](resources/changelog.md) ve nasıl + [katkıda bulunabileceğinizi](resources/contributing.md) keşfedin. + +
diff --git a/website/docs/index.uk.md b/website/docs/index.uk.md new file mode 100644 index 00000000..3210e4e1 --- /dev/null +++ b/website/docs/index.uk.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA (Windows Event Log Analyzer, ゑ羅), створений +Yamato Security, — це інструмент для +аудиту налаштувань журналу подій Windows. Журнали подій Windows є життєво важливим джерелом +інформації для DFIR — WELA допомагає переконатися, що ви дійсно записуєте події, які мають значення. +

+ +
+[Почати роботу :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[Довідник команд :material-console:](commands/index.md){ .md-button } +[Переглянути на GitHub :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## Чому WELA? + +
+ +- :material-clipboard-check:{ .lg .middle } __Аудит налаштувань політики журналювання__ + + --- + + Перевіряйте **налаштування політики аудиту** журналу подій Windows, щоб підтвердити, що журналюються правильні події. + +- :material-book-check:{ .lg .middle } __На основі рекомендацій__ + + --- + + Перевірка відповідно до **основних рекомендацій з налаштування аудиту журналу подій Windows**. + +- :material-shield-search:{ .lg .middle } __Виявлюваність Sigma__ + + --- + + Оцінює ваші налаштування за **реальною виявлюваністю правил Sigma** — чи дійсно ваші журнали виявлятимуть атаки? + +- :material-file-cog:{ .lg .middle } __Аудит розміру файлів__ + + --- + + Перевіряє **розміри файлів** журналу подій Windows та пропонує рекомендовані розміри. + +- :material-cog-play:{ .lg .middle } __Автоматичне налаштування__ + + --- + + Застосовуйте **рекомендовану** політику аудиту та розміри файлів журналу за допомогою команди `configure`. + +- :material-chart-box:{ .lg .middle } __Гнучкий вивід__ + + --- + + Переглядайте результати в терміналі, графічному інтерфейсі, у вигляді таблиці або як теплову карту **MITRE ATT&CK Navigator**. + +
+ +## Швидкі посилання + +
+ +- __:material-book-open-variant: Уперше тут?__ + + Почніть з [Огляду](overview/index.md), а потім перейдіть до + [Початку роботи](getting-started/index.md), щоб встановити та запустити WELA. + +- __:material-console-line: Працюєте з CLI?__ + + Перегляньте [Список команд](commands/index.md) та довідник + [Використання команд](commands/usage.md) (`audit-settings`, `audit-filesize`, `configure`, `update-rules`). + +- __:material-puzzle: Хочете більше?__ + + Ознайомтеся із [Супутніми проєктами](resources/companion-projects.md), + [Журналом змін](resources/changelog.md) та тим, як + [зробити внесок](resources/contributing.md). + +
diff --git a/website/docs/index.zh-TW.md b/website/docs/index.zh-TW.md new file mode 100644 index 00000000..810e9562 --- /dev/null +++ b/website/docs/index.zh-TW.md @@ -0,0 +1,101 @@ +--- +hide: + - navigation + - toc +--- + +
+ +![WELA](assets/screenshots/WELA-Logo.png){ .hb-logo } + +

+WELA（Windows Event Log Analyzer，ゑ羅）由 +Yamato Security 開發，是一款用於 +稽核 Windows 事件記錄檔設定的工具。Windows 事件記錄檔是 DFIR 至關重要的 +資訊來源——WELA 協助你確認自己確實記錄了重要的事件。 +

+ +
+[開始使用 :material-rocket-launch:](getting-started/index.md){ .md-button .md-button--primary } +[指令參考 :material-console:](commands/index.md){ .md-button } +[在 GitHub 上檢視 :fontawesome-brands-github:](https://github.com/Yamato-Security/WELA){ .md-button } +
+ +

+ + + + + + + + +

+ +
+ +--- + +## 為什麼選擇 WELA？ + +
+ +- :material-clipboard-check:{ .lg .middle } __稽核記錄原則設定__ + + --- + + 稽核你的 Windows 事件記錄檔**稽核原則設定**，確認正確的事件確實有被記錄。 + +- :material-book-check:{ .lg .middle } __以指南為依據__ + + --- + + 對照**主要的 Windows 事件記錄檔稽核設定指南**進行檢查。 + +- :material-shield-search:{ .lg .middle } __Sigma 偵測能力__ + + --- + + 依據**真實世界的 Sigma 規則偵測能力**評估你的設定——你的記錄檔真的能捕捉到攻擊嗎？ + +- :material-file-cog:{ .lg .middle } __檔案大小稽核__ + + --- + + 稽核 Windows 事件記錄檔的**檔案大小**並建議建議的大小。 + +- :material-cog-play:{ .lg .middle } __自動設定__ + + --- + + 透過 `configure` 指令套用**建議的**稽核原則與記錄檔檔案大小。 + +- :material-chart-box:{ .lg .middle } __彈性的輸出__ + + --- + + 可在終端機、GUI、表格中檢視結果，或以 **MITRE ATT&CK Navigator** 熱圖呈現。 + +
+ +## 快速連結 + +
+ +- __:material-book-open-variant: 第一次使用？__ + + 先從[概覽](overview/index.md)開始，接著前往 + [開始使用](getting-started/index.md)來安裝並執行 WELA。 + +- __:material-console-line: 在使用 CLI 嗎？__ + + 瀏覽[指令清單](commands/index.md)以及[指令用法](commands/usage.md) + 參考（`audit-settings`、`audit-filesize`、`configure`、`update-rules`）。 + +- __:material-puzzle: 想更進一步？__ + + 探索[相關專案](resources/companion-projects.md)、 + [變更紀錄](resources/changelog.md)，以及如何 + [貢獻](resources/contributing.md)。 + +
diff --git a/website/docs/overview/features.ar.md b/website/docs/overview/features.ar.md new file mode 100644 index 00000000..48d82964 --- /dev/null +++ b/website/docs/overview/features.ar.md @@ -0,0 +1,6 @@ +# الميزات +- تدقيق إعدادات سياسة تدقيق سجل أحداث Windows. +- التحقق **استنادًا إلى الإرشادات الرئيسية لتهيئة تدقيق سجل أحداث Windows**. +- التحقق من إعدادات تدقيق سجل أحداث Windows استنادًا إلى **قابلية اكتشاف قواعد Sigma في العالم الحقيقي**. +- تدقيق أحجام ملفات سجل أحداث Windows واقتراح الحجم الموصى به. +- ضبط سياسة تدقيق سجل أحداث Windows الموصى بها وأحجام الملفات. diff --git a/website/docs/overview/features.de.md b/website/docs/overview/features.de.md new file mode 100644 index 00000000..6a79ef4a --- /dev/null +++ b/website/docs/overview/features.de.md @@ -0,0 +1,6 @@ +# Funktionen +- Überprüfung der Einstellungen für die Überwachungsrichtlinie des Windows-Ereignisprotokolls. +- Überprüfung **anhand der wichtigsten Konfigurationsrichtlinien für die Überwachung des Windows-Ereignisprotokolls**. +- Überprüfung der Überwachungseinstellungen des Windows-Ereignisprotokolls auf Grundlage der **Erkennbarkeit durch reale Sigma-Regeln**. +- Überprüfung der Dateigrößen des Windows-Ereignisprotokolls und Vorschläge für die empfohlene Größe. +- Festlegen der empfohlenen Überwachungsrichtlinie und Dateigrößen für das Windows-Ereignisprotokoll. diff --git a/website/docs/overview/features.es.md b/website/docs/overview/features.es.md new file mode 100644 index 00000000..0ee9f3da --- /dev/null +++ b/website/docs/overview/features.es.md @@ -0,0 +1,6 @@ +# Funcionalidades +- Auditoría de la configuración de la política de auditoría del registro de eventos de Windows. +- Comprobación **basada en las principales directrices de configuración de auditoría del registro de eventos de Windows**. +- Comprobación de la configuración de auditoría del registro de eventos de Windows basada en la **detectabilidad de reglas Sigma en el mundo real**. +- Auditoría de los tamaños de archivo del registro de eventos de Windows y sugerencias del tamaño recomendado. +- Establecimiento de la política de auditoría del registro de eventos de Windows y los tamaños de archivo recomendados. diff --git a/website/docs/overview/features.fr.md b/website/docs/overview/features.fr.md new file mode 100644 index 00000000..5edf3149 --- /dev/null +++ b/website/docs/overview/features.fr.md @@ -0,0 +1,6 @@ +# Fonctionnalités +- Audit des paramètres de la stratégie d'audit du journal d'événements Windows. +- Vérification **basée sur les principales directives de configuration d'audit du journal d'événements Windows**. +- Vérification des paramètres d'audit du journal d'événements Windows en fonction de la **détectabilité des règles Sigma dans des conditions réelles**. +- Audit de la taille des fichiers du journal d'événements Windows et suggestions concernant la taille recommandée. +- Définition de la stratégie d'audit recommandée et des tailles de fichiers du journal d'événements Windows. diff --git a/website/docs/overview/features.hi.md b/website/docs/overview/features.hi.md new file mode 100644 index 00000000..7e060995 --- /dev/null +++ b/website/docs/overview/features.hi.md @@ -0,0 +1,6 @@ +# विशेषताएँ +- Windows इवेंट लॉग ऑडिट पॉलिसी सेटिंग्स का ऑडिट करना। +- **प्रमुख Windows इवेंट लॉग ऑडिट कॉन्फ़िगरेशन दिशानिर्देशों के आधार पर** जाँच करना। +- **वास्तविक दुनिया की Sigma नियम पहचान-योग्यता के आधार पर** Windows इवेंट लॉग ऑडिट सेटिंग्स की जाँच करना। +- Windows इवेंट लॉग फ़ाइल आकारों का ऑडिट करना और अनुशंसित आकार के लिए सुझाव देना। +- अनुशंसित Windows इवेंट लॉग ऑडिट पॉलिसी और फ़ाइल आकार सेट करना। diff --git a/website/docs/overview/features.id.md b/website/docs/overview/features.id.md new file mode 100644 index 00000000..70ab2b2d --- /dev/null +++ b/website/docs/overview/features.id.md @@ -0,0 +1,6 @@ +# Fitur +- Mengaudit pengaturan kebijakan audit log peristiwa Windows. +- Memeriksa **berdasarkan panduan konfigurasi audit log peristiwa Windows yang utama**. +- Memeriksa pengaturan audit log peristiwa Windows berdasarkan **kemampuan deteksi aturan Sigma di dunia nyata**. +- Mengaudit ukuran file log peristiwa Windows dan memberikan saran ukuran yang direkomendasikan. +- Mengatur kebijakan audit log peristiwa Windows dan ukuran file yang direkomendasikan. diff --git a/website/docs/overview/features.ja.md b/website/docs/overview/features.ja.md new file mode 100644 index 00000000..4937b47a --- /dev/null +++ b/website/docs/overview/features.ja.md @@ -0,0 +1,6 @@ +# 機能 +- Windows Event Log Audit policyに対する評価 +- 主要なWindowsイベントログ監査設定ガイドに基づくチェック +- Windows Event Logの監査設定を、実際のSigmaルールの検知範囲に基づいて評価 +- Windows Event Logのファイルサイズを監査し、推奨サイズを提案 +- 推奨されるWindowsイベントログ監査ポリシーとファイルサイズの設定 diff --git a/website/docs/overview/features.ko.md b/website/docs/overview/features.ko.md new file mode 100644 index 00000000..08b01fd6 --- /dev/null +++ b/website/docs/overview/features.ko.md @@ -0,0 +1,6 @@ +# 기능 +- Windows 이벤트 로그 감사 정책 설정 감사. +- **주요 Windows 이벤트 로그 감사 구성 지침을 기반으로** 확인. +- **실제 Sigma 규칙 탐지 가능성을 기반으로** Windows 이벤트 로그 감사 설정 확인. +- Windows 이벤트 로그 파일 크기 감사 및 권장 크기 제안. +- 권장 Windows 이벤트 로그 감사 정책 및 파일 크기 설정. diff --git a/website/docs/overview/features.md b/website/docs/overview/features.md new file mode 100644 index 00000000..3b5b1526 --- /dev/null +++ b/website/docs/overview/features.md @@ -0,0 +1,6 @@ +# Features +- Auditing Windows event log audit policy settings. +- Checking **based on the major Windows event log audit configuration guidelines**. +- Checking Windows event log audit settings based on **real-world Sigma rule detectability**. +- Auditing of Windows event log file sizes and suggestions for the recommended size. +- Setting recommended Windows event log audit policy and file sizes. diff --git a/website/docs/overview/features.my.md b/website/docs/overview/features.my.md new file mode 100644 index 00000000..76717622 --- /dev/null +++ b/website/docs/overview/features.my.md @@ -0,0 +1,6 @@ +# အင်္ဂါရပ်များ +- Windows event log audit policy ဆက်တင်များကို စစ်ဆေးခြင်း။ +- **အဓိက Windows event log audit ပြင်ဆင်သတ်မှတ်မှု လမ်းညွှန်ချက်များကို အခြေခံ၍** စစ်ဆေးခြင်း။ +- **လက်တွေ့ကမ္ဘာ၏ Sigma rule ထောက်လှမ်းနိုင်စွမ်းကို အခြေခံ၍** Windows event log audit ဆက်တင်များကို စစ်ဆေးခြင်း။ +- Windows event log ဖိုင်အရွယ်အစားများကို စစ်ဆေးခြင်းနှင့် အကြံပြုထားသော အရွယ်အစားအတွက် အကြံပြုချက်များ။ +- အကြံပြုထားသော Windows event log audit policy နှင့် ဖိုင်အရွယ်အစားများကို သတ်မှတ်ခြင်း။ diff --git a/website/docs/overview/features.pt-BR.md b/website/docs/overview/features.pt-BR.md new file mode 100644 index 00000000..47bfdb07 --- /dev/null +++ b/website/docs/overview/features.pt-BR.md @@ -0,0 +1,6 @@ +# Recursos +- Auditoria das configurações de política de auditoria de logs de eventos do Windows. +- Verificação **com base nas principais diretrizes de configuração de auditoria de logs de eventos do Windows**. +- Verificação das configurações de auditoria de logs de eventos do Windows com base na **detectabilidade real das regras Sigma**. +- Auditoria dos tamanhos dos arquivos de logs de eventos do Windows e sugestões para o tamanho recomendado. +- Configuração da política de auditoria de logs de eventos do Windows e dos tamanhos de arquivo recomendados. diff --git a/website/docs/overview/features.th.md b/website/docs/overview/features.th.md new file mode 100644 index 00000000..accb0e22 --- /dev/null +++ b/website/docs/overview/features.th.md @@ -0,0 +1,6 @@ +# คุณสมบัติ +- การตรวจสอบการตั้งค่านโยบายการตรวจสอบ Windows event log +- การตรวจสอบ **โดยอิงตามแนวทางหลักในการกำหนดค่าการตรวจสอบ Windows event log** +- การตรวจสอบการตั้งค่าการตรวจสอบ Windows event log โดยอิงตาม **ความสามารถในการตรวจจับด้วยกฎ Sigma ในสภาพแวดล้อมจริง** +- การตรวจสอบขนาดไฟล์ Windows event log และคำแนะนำเกี่ยวกับขนาดที่แนะนำ +- การตั้งค่านโยบายการตรวจสอบ Windows event log และขนาดไฟล์ที่แนะนำ diff --git a/website/docs/overview/features.tr.md b/website/docs/overview/features.tr.md new file mode 100644 index 00000000..3a869556 --- /dev/null +++ b/website/docs/overview/features.tr.md @@ -0,0 +1,6 @@ +# Özellikler +- Windows olay günlüğü denetim politikası ayarlarının denetlenmesi. +- **Başlıca Windows olay günlüğü denetim yapılandırma kılavuzlarına dayalı** kontrol. +- Windows olay günlüğü denetim ayarlarının **gerçek dünya Sigma kuralı tespit edilebilirliğine** dayalı kontrolü. +- Windows olay günlüğü dosya boyutlarının denetlenmesi ve önerilen boyut için öneriler. +- Önerilen Windows olay günlüğü denetim politikasının ve dosya boyutlarının ayarlanması. diff --git a/website/docs/overview/features.uk.md b/website/docs/overview/features.uk.md new file mode 100644 index 00000000..13dff2b6 --- /dev/null +++ b/website/docs/overview/features.uk.md @@ -0,0 +1,6 @@ +# Можливості +- Аудит налаштувань політики аудиту журналу подій Windows. +- Перевірка **на основі основних рекомендацій щодо конфігурації аудиту журналу подій Windows**. +- Перевірка налаштувань аудиту журналу подій Windows на основі **реальної виявлюваності правил Sigma**. +- Аудит розмірів файлів журналу подій Windows та рекомендації щодо рекомендованого розміру. +- Налаштування рекомендованої політики аудиту журналу подій Windows та розмірів файлів. diff --git a/website/docs/overview/features.zh-TW.md b/website/docs/overview/features.zh-TW.md new file mode 100644 index 00000000..141801d8 --- /dev/null +++ b/website/docs/overview/features.zh-TW.md @@ -0,0 +1,6 @@ +# 功能特色 +- 稽核 Windows 事件日誌的稽核原則設定。 +- **依據主要的 Windows 事件日誌稽核設定指南**進行檢查。 +- 依據**實際的 Sigma 規則可偵測性**檢查 Windows 事件日誌的稽核設定。 +- 稽核 Windows 事件日誌的檔案大小，並提供建議大小的建議。 +- 設定建議的 Windows 事件日誌稽核原則與檔案大小。 diff --git a/website/docs/overview/index.ar.md b/website/docs/overview/index.ar.md new file mode 100644 index 00000000..fb97fc7f --- /dev/null +++ b/website/docs/overview/index.ar.md @@ -0,0 +1,6 @@ +# حول WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** هي أداة لتدقيق إعدادات سجل أحداث Windows. +تُعد سجلات أحداث Windows مصدرًا حيويًا للمعلومات في مجال التحقيقات الجنائية الرقمية والاستجابة للحوادث (DFIR)، حيث توفر رؤية واضحة لنشاط النظام وأحداث الأمان. +**لسوء الحظ، غالبًا ما تؤدي التكوينات الافتراضية إلى مشكلات مثل محدودية الاحتفاظ بالسجلات، وعدم كفاية سياسات التدقيق، والنقاط العمياء التي تقلل من القدرة على الكشف**. +تساعد WELA في الكشف عن نقاط الضعف هذه وتقدم توصيات عملية لتحسين إعدادات التدقيق وتعزيز رؤية الأمان. +كما تقوم WELA بتقييم تكوينات السجلات **استنادًا إلى تغطية قواعد Sigma في العالم الواقعي**، مما يتيح للمستخدمين تقييم ما يمكن أو لا يمكن اكتشافه ضمن الإعدادات الحالية. diff --git a/website/docs/overview/index.de.md b/website/docs/overview/index.de.md new file mode 100644 index 00000000..1971a424 --- /dev/null +++ b/website/docs/overview/index.de.md @@ -0,0 +1,6 @@ +# Über WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** ist ein Werkzeug zur Überprüfung von Windows-Ereignisprotokolleinstellungen. +Windows-Ereignisprotokolle sind eine wichtige Informationsquelle für Digital Forensics and Incident Response (DFIR) und bieten Einblick in Systemaktivitäten und Sicherheitsereignisse. +**Leider führen Standardkonfigurationen oft zu Problemen wie begrenzter Protokollaufbewahrung, unzureichenden Überwachungsrichtlinien und blinden Flecken, die die Erkennungsfähigkeit verringern**. +WELA hilft dabei, diese Schwachstellen aufzudecken und bietet praktische Empfehlungen zur Verbesserung der Überwachungseinstellungen und zur Erhöhung der Sicherheitstransparenz. +WELA bewertet außerdem Protokollkonfigurationen **auf Grundlage der realen Abdeckung durch Sigma-Regeln** und ermöglicht es Benutzern zu beurteilen, was unter den aktuellen Einstellungen erkannt werden kann und was nicht. diff --git a/website/docs/overview/index.es.md b/website/docs/overview/index.es.md new file mode 100644 index 00000000..254dbeca --- /dev/null +++ b/website/docs/overview/index.es.md @@ -0,0 +1,6 @@ +# Acerca de WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** es una herramienta para auditar la configuración del registro de eventos de Windows. +Los registros de eventos de Windows son una fuente vital de información para la investigación forense digital y la respuesta a incidentes (DFIR), ya que ofrecen visibilidad sobre la actividad del sistema y los eventos de seguridad. +**Lamentablemente, las configuraciones predeterminadas suelen provocar problemas como una retención de registros limitada, políticas de auditoría insuficientes y puntos ciegos que reducen la capacidad de detección**. +WELA ayuda a descubrir estas debilidades y ofrece recomendaciones prácticas para mejorar la configuración de auditoría y reforzar la visibilidad de seguridad. +WELA también evalúa las configuraciones de registros **basándose en la cobertura real de las reglas Sigma**, lo que permite a los usuarios evaluar qué se puede o no detectar con la configuración actual. diff --git a/website/docs/overview/index.fr.md b/website/docs/overview/index.fr.md new file mode 100644 index 00000000..ef175335 --- /dev/null +++ b/website/docs/overview/index.fr.md @@ -0,0 +1,6 @@ +# À propos de WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** est un outil d'audit des paramètres des journaux d'événements Windows. +Les journaux d'événements Windows sont une source d'information essentielle pour l'investigation numérique et la réponse aux incidents (DFIR), offrant une visibilité sur l'activité du système et les événements de sécurité. +**Malheureusement, les configurations par défaut entraînent souvent des problèmes tels qu'une rétention limitée des journaux, des stratégies d'audit insuffisantes et des angles morts qui réduisent les capacités de détection**. +WELA aide à révéler ces faiblesses et propose des recommandations pratiques pour améliorer les paramètres d'audit et renforcer la visibilité en matière de sécurité. +WELA évalue également les configurations de journalisation **en se basant sur la couverture réelle des règles Sigma**, permettant aux utilisateurs d'évaluer ce qui peut ou ne peut pas être détecté avec les paramètres actuels. diff --git a/website/docs/overview/index.hi.md b/website/docs/overview/index.hi.md new file mode 100644 index 00000000..79d2cdbb --- /dev/null +++ b/website/docs/overview/index.hi.md @@ -0,0 +1,6 @@ +# WELA के बारे में +**WELA (Windows Event Log Analyzer, ゑ羅)** Windows इवेंट लॉग सेटिंग्स का ऑडिट करने के लिए एक टूल है। +Windows इवेंट लॉग, Digital Forensics and Incident Response (DFIR) के लिए जानकारी का एक महत्वपूर्ण स्रोत हैं, जो सिस्टम गतिविधि और सुरक्षा घटनाओं में दृश्यता प्रदान करते हैं। +**दुर्भाग्य से, डिफ़ॉल्ट कॉन्फ़िगरेशन अक्सर सीमित लॉग प्रतिधारण, अपर्याप्त ऑडिट नीतियों, और ऐसे अंधे धब्बों जैसी समस्याओं को जन्म देते हैं जो पहचान क्षमता को कम कर देते हैं**। +WELA इन कमज़ोरियों को उजागर करने में मदद करता है और ऑडिट सेटिंग्स को बेहतर बनाने तथा सुरक्षा दृश्यता को बढ़ाने के लिए व्यावहारिक सिफारिशें प्रदान करता है। +WELA **वास्तविक दुनिया की Sigma नियम कवरेज के आधार पर** भी लॉग कॉन्फ़िगरेशन का आकलन करता है, जिससे उपयोगकर्ता मूल्यांकन कर सकते हैं कि वर्तमान सेटिंग्स के तहत क्या पता लगाया जा सकता है और क्या नहीं। diff --git a/website/docs/overview/index.id.md b/website/docs/overview/index.id.md new file mode 100644 index 00000000..40249ce6 --- /dev/null +++ b/website/docs/overview/index.id.md @@ -0,0 +1,6 @@ +# Tentang WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** adalah alat untuk mengaudit pengaturan log peristiwa Windows. +Log peristiwa Windows merupakan sumber informasi penting untuk Digital Forensics and Incident Response (DFIR), yang memberikan visibilitas terhadap aktivitas sistem dan peristiwa keamanan. +**Sayangnya, konfigurasi bawaan sering kali menimbulkan masalah seperti retensi log yang terbatas, kebijakan audit yang tidak memadai, serta titik buta yang mengurangi kemampuan deteksi**. +WELA membantu mengungkap kelemahan-kelemahan ini dan menawarkan rekomendasi praktis untuk meningkatkan pengaturan audit serta memperkuat visibilitas keamanan. +WELA juga menilai konfigurasi log **berdasarkan cakupan aturan Sigma di dunia nyata**, sehingga memungkinkan pengguna mengevaluasi apa yang dapat atau tidak dapat dideteksi dengan pengaturan saat ini. diff --git a/website/docs/overview/index.ja.md b/website/docs/overview/index.ja.md new file mode 100644 index 00000000..66eeb1de --- /dev/null +++ b/website/docs/overview/index.ja.md @@ -0,0 +1,6 @@ +# WELAについて +**WELA（Windows Event Log Analyzer、ゑ羅）** は、Windowsイベントログの設定とログサイズを監査するツールです。 +Windowsイベントログは、DFIR（デジタルフォレンジックおよびインシデント対応）に不可欠な情報源であり、システムの動作やセキュリティイベントを可視化します。 +**しかし、デフォルト設定では、不十分なログサイズ、監査設定によって、脅威の検知漏れを引き起こす**可能性があります。 +WELAはこうした課題を洗い出し、Windowsイベントログ設定改善のための実用的な提案を行います。 +また、**実際のSigmaルールの検知範囲に基づいてWindowsイベントログ設定を評価**し、現状の設定で何が検知できるかを把握できます。 diff --git a/website/docs/overview/index.ko.md b/website/docs/overview/index.ko.md new file mode 100644 index 00000000..342a1127 --- /dev/null +++ b/website/docs/overview/index.ko.md @@ -0,0 +1,6 @@ +# WELA 소개 +**WELA (Windows Event Log Analyzer, ゑ羅)** 는 Windows 이벤트 로그 설정을 감사하기 위한 도구입니다. +Windows 이벤트 로그는 디지털 포렌식 및 사고 대응(DFIR)을 위한 중요한 정보원으로, 시스템 활동과 보안 이벤트에 대한 가시성을 제공합니다. +**안타깝게도 기본 구성은 제한된 로그 보존, 불충분한 감사 정책, 탐지 능력을 저하시키는 사각지대와 같은 문제로 이어지는 경우가 많습니다**. +WELA는 이러한 취약점을 발견하고 감사 설정을 개선하며 보안 가시성을 강화하기 위한 실질적인 권장 사항을 제공합니다. +WELA는 또한 **실제 Sigma 규칙 커버리지를 기반으로** 로그 구성을 평가하여, 사용자가 현재 설정에서 무엇을 탐지할 수 있고 무엇을 탐지할 수 없는지 평가할 수 있도록 합니다. diff --git a/website/docs/overview/index.md b/website/docs/overview/index.md new file mode 100644 index 00000000..4698a44f --- /dev/null +++ b/website/docs/overview/index.md @@ -0,0 +1,6 @@ +# About WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** is a tool for auditing Windows event log settings. +Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events. +**Unfortunately, default configurations often lead to problems such as limited log retention, insufficient audit policies, and blind spots that reduce detection capability**. +WELA helps uncover these weaknesses and offers practical recommendations to improve audit settings and enhance security visibility. +WELA also assesses log configurations **based on real-world Sigma rule coverage**, allowing users to evaluate what can or cannot be detected under current the settings. diff --git a/website/docs/overview/index.my.md b/website/docs/overview/index.my.md new file mode 100644 index 00000000..fd8abdf1 --- /dev/null +++ b/website/docs/overview/index.my.md @@ -0,0 +1,6 @@ +# WELA အကြောင်း +**WELA (Windows Event Log Analyzer, ゑ羅)** သည် Windows event log ဆက်တင်များကို စစ်ဆေးရန် ကိရိယာတစ်ခုဖြစ်သည်။ +Windows event log များသည် Digital Forensics and Incident Response (DFIR) အတွက် အရေးပါသော သတင်းအချက်အလက် ရင်းမြစ်တစ်ခုဖြစ်ပြီး၊ စနစ်လုပ်ဆောင်ချက်နှင့် လုံခြုံရေးဆိုင်ရာ ဖြစ်ရပ်များကို မြင်နိုင်စေသည်။ +**ကံမကောင်းစွာဖြင့်၊ မူရင်းဖွဲ့စည်းမှုပုံစံများသည် log သိမ်းဆည်းမှု ကန့်သတ်ခြင်း၊ စစ်ဆေးရေးမူဝါဒ မလုံလောက်ခြင်းနှင့် ထောက်လှမ်းနိုင်စွမ်းကို လျှော့ချသည့် မမြင်နိုင်သောနေရာများ ကဲ့သို့သော ပြဿနာများကို မကြာခဏ ဖြစ်ပေါ်စေသည်**။ +WELA သည် ဤအားနည်းချက်များကို ဖော်ထုတ်ရန် ကူညီပေးပြီး စစ်ဆေးရေးဆက်တင်များ တိုးတက်စေရန်နှင့် လုံခြုံရေး မြင်နိုင်မှု မြှင့်တင်ရန်အတွက် လက်တွေ့ကျသော အကြံပြုချက်များကို ပေးသည်။ +WELA သည် log ဖွဲ့စည်းမှုပုံစံများကိုလည်း **လက်တွေ့ Sigma rule လွှမ်းခြုံမှုအပေါ် အခြေခံ၍** အကဲဖြတ်ပေးပြီး၊ သုံးစွဲသူများအား လက်ရှိဆက်တင်များအောက်တွင် မည်သည့်အရာကို ထောက်လှမ်းနိုင်သည် သို့မဟုတ် မထောက်လှမ်းနိုင်သည်ကို အကဲဖြတ်နိုင်စေသည်။ diff --git a/website/docs/overview/index.pt-BR.md b/website/docs/overview/index.pt-BR.md new file mode 100644 index 00000000..30be267a --- /dev/null +++ b/website/docs/overview/index.pt-BR.md @@ -0,0 +1,6 @@ +# Sobre o WELA +O **WELA (Windows Event Log Analyzer, ゑ羅)** é uma ferramenta para auditar as configurações de log de eventos do Windows. +Os logs de eventos do Windows são uma fonte vital de informações para a Forense Digital e Resposta a Incidentes (DFIR), proporcionando visibilidade sobre a atividade do sistema e os eventos de segurança. +**Infelizmente, as configurações padrão geralmente levam a problemas como retenção limitada de logs, políticas de auditoria insuficientes e pontos cegos que reduzem a capacidade de detecção**. +O WELA ajuda a revelar essas fragilidades e oferece recomendações práticas para melhorar as configurações de auditoria e aprimorar a visibilidade de segurança. +O WELA também avalia as configurações de log **com base na cobertura real das regras Sigma**, permitindo que os usuários avaliem o que pode ou não ser detectado com as configurações atuais. diff --git a/website/docs/overview/index.th.md b/website/docs/overview/index.th.md new file mode 100644 index 00000000..579b236d --- /dev/null +++ b/website/docs/overview/index.th.md @@ -0,0 +1,6 @@ +# เกี่ยวกับ WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** เป็นเครื่องมือสำหรับตรวจสอบการตั้งค่า Windows event log +Windows event log เป็นแหล่งข้อมูลที่สำคัญสำหรับ Digital Forensics and Incident Response (DFIR) ซึ่งช่วยให้มองเห็นกิจกรรมของระบบและเหตุการณ์ด้านความปลอดภัยได้ +**น่าเสียดายที่การกำหนดค่าเริ่มต้นมักนำไปสู่ปัญหาต่าง ๆ เช่น การเก็บรักษา log ที่จำกัด นโยบายการตรวจสอบที่ไม่เพียงพอ และจุดบอดที่ลดความสามารถในการตรวจจับ** +WELA ช่วยเปิดเผยจุดอ่อนเหล่านี้ และนำเสนอคำแนะนำเชิงปฏิบัติเพื่อปรับปรุงการตั้งค่าการตรวจสอบและเพิ่มการมองเห็นด้านความปลอดภัย +WELA ยังประเมินการกำหนดค่า log **โดยอ้างอิงจากความครอบคลุมของ Sigma rule ในสถานการณ์จริง** ทำให้ผู้ใช้สามารถประเมินได้ว่าสิ่งใดสามารถหรือไม่สามารถตรวจจับได้ภายใต้การตั้งค่าปัจจุบัน diff --git a/website/docs/overview/index.tr.md b/website/docs/overview/index.tr.md new file mode 100644 index 00000000..e95e06b9 --- /dev/null +++ b/website/docs/overview/index.tr.md @@ -0,0 +1,6 @@ +# WELA Hakkında +**WELA (Windows Event Log Analyzer, ゑ羅)**, Windows olay günlüğü ayarlarını denetlemek için bir araçtır. +Windows olay günlükleri, Dijital Adli Bilişim ve Olay Müdahalesi (DFIR) için hayati bir bilgi kaynağıdır ve sistem etkinliği ile güvenlik olaylarına görünürlük sağlar. +**Maalesef, varsayılan yapılandırmalar genellikle sınırlı günlük saklama süresi, yetersiz denetim politikaları ve tespit yeteneğini azaltan kör noktalar gibi sorunlara yol açar**. +WELA, bu zayıflıkları ortaya çıkarmaya yardımcı olur ve denetim ayarlarını iyileştirmek ve güvenlik görünürlüğünü artırmak için pratik öneriler sunar. +WELA ayrıca **gerçek dünya Sigma kuralı kapsamına dayalı olarak** günlük yapılandırmalarını değerlendirir ve kullanıcıların mevcut ayarlar altında nelerin tespit edilip edilemeyeceğini değerlendirmesine olanak tanır. diff --git a/website/docs/overview/index.uk.md b/website/docs/overview/index.uk.md new file mode 100644 index 00000000..d8a089e3 --- /dev/null +++ b/website/docs/overview/index.uk.md @@ -0,0 +1,6 @@ +# Про WELA +**WELA (Windows Event Log Analyzer, ゑ羅)** — це інструмент для аудиту налаштувань журналів подій Windows. +Журнали подій Windows є життєво важливим джерелом інформації для цифрової криміналістики та реагування на інциденти (DFIR), забезпечуючи видимість активності системи та подій безпеки. +**На жаль, конфігурації за замовчуванням часто призводять до таких проблем, як обмежений строк зберігання журналів, недостатні політики аудиту та сліпі зони, що знижують здатність до виявлення**. +WELA допомагає виявити ці слабкі місця та пропонує практичні рекомендації щодо покращення налаштувань аудиту та підвищення видимості безпеки. +WELA також оцінює конфігурації журналів **на основі реального покриття правилами Sigma**, дозволяючи користувачам оцінити, що може бути виявлено за поточних налаштувань, а що ні. diff --git a/website/docs/overview/index.zh-TW.md b/website/docs/overview/index.zh-TW.md new file mode 100644 index 00000000..b8b9057e --- /dev/null +++ b/website/docs/overview/index.zh-TW.md @@ -0,0 +1,6 @@ +# 關於 WELA +**WELA（Windows Event Log Analyzer，ゑ羅）** 是一套用於稽核 Windows 事件記錄設定的工具。 +Windows 事件記錄是數位鑑識與事件回應（DFIR）的重要資訊來源，能提供系統活動與安全事件的可視性。 +**遺憾的是，預設組態往往會導致諸多問題，例如記錄保存期限有限、稽核原則不足，以及降低偵測能力的盲點**。 +WELA 能協助找出這些弱點，並提供實用的建議，以改善稽核設定並強化安全可視性。 +WELA 也會**根據真實世界中的 Sigma 規則涵蓋範圍**來評估記錄組態，讓使用者能夠評估在目前設定下哪些可以偵測、哪些無法偵測。 diff --git a/website/docs/overview/screenshots.ar.md b/website/docs/overview/screenshots.ar.md new file mode 100644 index 00000000..6ce891d3 --- /dev/null +++ b/website/docs/overview/screenshots.ar.md @@ -0,0 +1,21 @@ +# لقطات الشاشة + +## قائمة المساعدة عند بدء التشغيل +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (مخرجات الطرفية) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (واجهة المستخدم الرسومية) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (جدول) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.de.md b/website/docs/overview/screenshots.de.md new file mode 100644 index 00000000..5e89e82f --- /dev/null +++ b/website/docs/overview/screenshots.de.md @@ -0,0 +1,21 @@ +# Screenshots + +## Startup-Hilfemenü +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (Terminalausgabe) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (Tabelle) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.es.md b/website/docs/overview/screenshots.es.md new file mode 100644 index 00000000..b1804bb6 --- /dev/null +++ b/website/docs/overview/screenshots.es.md @@ -0,0 +1,21 @@ +# Capturas de pantalla + +## Menú de ayuda de inicio +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (salida de terminal) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (tabla) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.fr.md b/website/docs/overview/screenshots.fr.md new file mode 100644 index 00000000..63b6ce69 --- /dev/null +++ b/website/docs/overview/screenshots.fr.md @@ -0,0 +1,21 @@ +# Captures d'écran + +## Menu d'aide au démarrage +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (sortie du terminal) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (interface graphique) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (tableau) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.hi.md b/website/docs/overview/screenshots.hi.md new file mode 100644 index 00000000..846bf242 --- /dev/null +++ b/website/docs/overview/screenshots.hi.md @@ -0,0 +1,21 @@ +# स्क्रीनशॉट + +## स्टार्टअप हेल्प मेनू +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (टर्मिनल आउटपुट) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (टेबल) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.id.md b/website/docs/overview/screenshots.id.md new file mode 100644 index 00000000..20609c1e --- /dev/null +++ b/website/docs/overview/screenshots.id.md @@ -0,0 +1,21 @@ +# Tangkapan Layar + +## Menu Bantuan Awal +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (keluaran terminal) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (tabel) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.ja.md b/website/docs/overview/screenshots.ja.md new file mode 100644 index 00000000..704badfd --- /dev/null +++ b/website/docs/overview/screenshots.ja.md @@ -0,0 +1,21 @@ +# スクリーンショット + +## スタートアップ +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (stdout) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (gui) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (table) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.ko.md b/website/docs/overview/screenshots.ko.md new file mode 100644 index 00000000..150c7848 --- /dev/null +++ b/website/docs/overview/screenshots.ko.md @@ -0,0 +1,21 @@ +# 스크린샷 + +## 시작 도움말 메뉴 +![WELA 시작](../assets/screenshots/startup.png) + +## audit-settings (터미널 출력) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (테이블) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.md b/website/docs/overview/screenshots.md new file mode 100644 index 00000000..ab392699 --- /dev/null +++ b/website/docs/overview/screenshots.md @@ -0,0 +1,21 @@ +# Screenshots + +## Startup Help Menu +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (terminal output) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (table) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.my.md b/website/docs/overview/screenshots.my.md new file mode 100644 index 00000000..a6c2eac3 --- /dev/null +++ b/website/docs/overview/screenshots.my.md @@ -0,0 +1,21 @@ +# စခရင်ရှော့များ + +## စတင်ချိန် အကူအညီ မီနူး +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (terminal output) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (table) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.pt-BR.md b/website/docs/overview/screenshots.pt-BR.md new file mode 100644 index 00000000..7f43c058 --- /dev/null +++ b/website/docs/overview/screenshots.pt-BR.md @@ -0,0 +1,21 @@ +# Capturas de tela + +## Menu de Ajuda Inicial +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (saída do terminal) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (tabela) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.th.md b/website/docs/overview/screenshots.th.md new file mode 100644 index 00000000..4055a00d --- /dev/null +++ b/website/docs/overview/screenshots.th.md @@ -0,0 +1,21 @@ +# ภาพหน้าจอ + +## เมนูช่วยเหลือเมื่อเริ่มต้น +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (เอาต์พุตในเทอร์มินัล) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (ตาราง) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.tr.md b/website/docs/overview/screenshots.tr.md new file mode 100644 index 00000000..375d6a76 --- /dev/null +++ b/website/docs/overview/screenshots.tr.md @@ -0,0 +1,21 @@ +# Ekran Görüntüleri + +## Başlangıç Yardım Menüsü +![WELA Başlangıç](../assets/screenshots/startup.png) + +## audit-settings (terminal çıktısı) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (GUI) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (tablo) +![WELA Tablo](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.uk.md b/website/docs/overview/screenshots.uk.md new file mode 100644 index 00000000..5b7534a7 --- /dev/null +++ b/website/docs/overview/screenshots.uk.md @@ -0,0 +1,21 @@ +# Знімки екрана + +## Меню довідки під час запуску +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings (вивід у терміналі) +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings (графічний інтерфейс) +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings (таблиця) +![WELA Table](../assets/screenshots/table.png) + +## audit-settings (mitre-attack-navigator) +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/overview/screenshots.zh-TW.md b/website/docs/overview/screenshots.zh-TW.md new file mode 100644 index 00000000..54cf9f24 --- /dev/null +++ b/website/docs/overview/screenshots.zh-TW.md @@ -0,0 +1,21 @@ +# 螢幕截圖 + +## 啟動說明選單 +![WELA Startup](../assets/screenshots/startup.png) + +## audit-settings（終端機輸出） +![WELA Stdout](../assets/screenshots/stdout.png) +## audit-settings（GUI） +![WELA GUI](../assets/screenshots/gui.png) + +## audit-settings（表格） +![WELA Table](../assets/screenshots/table.png) + +## audit-settings（mitre-attack-navigator） +![WELA Mitre Attack Navigator](../assets/screenshots/mitre.png) + +## audit-filesize +![WELA FileSize](../assets/screenshots/filesize.png) + +## configure +![WELA Configure](../assets/screenshots/configure.png) diff --git a/website/docs/resources/changelog.ja.md b/website/docs/resources/changelog.ja.md new file mode 100644 index 00000000..1721e887 --- /dev/null +++ b/website/docs/resources/changelog.ja.md @@ -0,0 +1,31 @@ +# 変更履歴 + +!!! info "情報" + このページはプロジェクトの [`CHANGELOG.md`](https://github.com/Yamato-Security/WELA/blob/main/CHANGELOG-Japanese.md) を反映したものです。ダウンロードは [リリースページ](https://github.com/Yamato-Security/WELA/releases) をご覧ください。 + +## 2.1.0 [2026/02/13] - Winter Release + +**バグ修正:** + +- 設定によりドメインコントローラのNetlogonが破損する可能性があった。 (#243) (@fukusuket) (この件を報告してくれた@feiglein74に感謝!) + +## 2.0.0 [2025/11/16] - CODE BLUE リリース + +**新機能:** + +- MITRE ATT&CK Navigatorヒートマップに対応した。 (#11) (@fukusuket) +- Windows設定を様々なベースラインに構成するための`configure`コマンドを追加した。 (#12) (@fukusuket) +- Defender for Identityの必要なログに対応した。 (#114) (@fukusuket) + +**バグ修正:** + +- ルールカウントの一部が正確ではなかった。 (#99) (@fukusuket) +- タスクスケジューラのログ設定が正確に報告されていなかった。 (#100 (@fukusuket)) + +## 1.0.0 [2025/05/20] - AUSCERT/SINCON リリース + +**新機能:** + +- `audit-settings`: Windows Event Log audit policy settingsをチェックする +- `audit-filesize`: Windows Event Logファイルサイズをチェックする +- `update-rules`: WELAのSigmaルール設定ファイルを更新する diff --git a/website/docs/resources/changelog.md b/website/docs/resources/changelog.md new file mode 100644 index 00000000..62467981 --- /dev/null +++ b/website/docs/resources/changelog.md @@ -0,0 +1,31 @@ +# Changelog + +!!! info + This page mirrors the project [`CHANGELOG.md`](https://github.com/Yamato-Security/WELA/blob/main/CHANGELOG.md). See the [Releases page](https://github.com/Yamato-Security/WELA/releases) for downloads. + +## 2.1.0 [2026/02/13] - Winter Release + +**Bug Fixes:** + +- Configuration might break Netlogon on Domain Controllers. (#243) (@fukusuket) (Thanks to @feiglein74 for reporting this!) + +## 2.0.0 [2025/11/16] - CODE BLUE Release + +**New Features:** + +- Support for MITRE ATT&CK Navigator heatmaps. (#11) (@fukusuket) +- Added a `configure` command to configure Windows settings to various baselines. (#12) (@fukusuket) +- Support for Defender for Identity required logs. (#114) (@fukusuket) + +**Bug Fixes:** + +- Some of the rule count was not accurate. (#99) (@fukusuket) +- TaskScheduler log settings were not accurately reported. (#100) (@fukusuket)) + +## 1.0.0 [2025/05/20] - AUSCERT/SINCON Release + +**New Features:** + +- `audit-settings`: Check Windows Event Log audit policy settings. +- `audit-filesize`: Check Windows Event Log file size. +- `update-rules`: Update WELA's Sigma rules config files. diff --git a/website/docs/resources/companion-projects.ar.md b/website/docs/resources/companion-projects.ar.md new file mode 100644 index 00000000..1fc5ed2b --- /dev/null +++ b/website/docs/resources/companion-projects.ar.md @@ -0,0 +1,5 @@ +# المشاريع المصاحبة + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): دليل Yamato Security لتهيئة سجل أحداث Windows. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): أداة لتصور فجوات الكشف في قواعد Sigma والأدلة الرئيسية. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): أداة لإنشاء ملفات التهيئة المتعلقة بقواعد Sigma الخاصة بـ WELA. diff --git a/website/docs/resources/companion-projects.de.md b/website/docs/resources/companion-projects.de.md new file mode 100644 index 00000000..b85acc55 --- /dev/null +++ b/website/docs/resources/companion-projects.de.md @@ -0,0 +1,5 @@ +# Begleitprojekte + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Yamato Securitys Konfigurationsleitfaden für das Windows-Ereignisprotokoll. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Ein Werkzeug zur Visualisierung von Erkennungslücken in Sigma-Regeln und wichtigen Leitfäden. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): Ein Werkzeug zur Erzeugung der Sigma-regelbezogenen Konfigurationsdateien von WELA. diff --git a/website/docs/resources/companion-projects.es.md b/website/docs/resources/companion-projects.es.md new file mode 100644 index 00000000..fe9d974d --- /dev/null +++ b/website/docs/resources/companion-projects.es.md @@ -0,0 +1,5 @@ +# Proyectos complementarios + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Guía de configuración del registro de eventos de Windows de Yamato Security. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Una herramienta para visualizar las brechas de detección en las reglas Sigma y las principales guías. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): Una herramienta para generar los archivos de configuración relacionados con las reglas Sigma de WELA. diff --git a/website/docs/resources/companion-projects.fr.md b/website/docs/resources/companion-projects.fr.md new file mode 100644 index 00000000..97e103a5 --- /dev/null +++ b/website/docs/resources/companion-projects.fr.md @@ -0,0 +1,5 @@ +# Projets associés + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) : Guide de configuration des journaux d'événements Windows de Yamato Security. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide) : Un outil pour visualiser les lacunes de détection dans les règles Sigma et les principaux guides. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator) : Un outil pour générer les fichiers de configuration liés aux règles Sigma de WELA. diff --git a/website/docs/resources/companion-projects.hi.md b/website/docs/resources/companion-projects.hi.md new file mode 100644 index 00000000..57b7a0c9 --- /dev/null +++ b/website/docs/resources/companion-projects.hi.md @@ -0,0 +1,5 @@ +# सहयोगी परियोजनाएँ + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Yamato Security की Windows Event Log कॉन्फ़िगरेशन गाइड। +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Sigma नियमों और प्रमुख गाइडों में पहचान की कमियों को दृश्यमान करने के लिए एक टूल। +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): WELA की Sigma नियम-संबंधित कॉन्फ़िग फ़ाइलें उत्पन्न करने के लिए एक टूल। diff --git a/website/docs/resources/companion-projects.id.md b/website/docs/resources/companion-projects.id.md new file mode 100644 index 00000000..0f7664ec --- /dev/null +++ b/website/docs/resources/companion-projects.id.md @@ -0,0 +1,5 @@ +# Proyek Pendamping + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Panduan Konfigurasi Windows Event Log dari Yamato Security. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Alat untuk memvisualisasikan celah deteksi pada aturan Sigma dan panduan-panduan utama. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): Alat untuk menghasilkan berkas konfigurasi terkait aturan Sigma WELA. diff --git a/website/docs/resources/companion-projects.ja.md b/website/docs/resources/companion-projects.ja.md new file mode 100644 index 00000000..172e38bd --- /dev/null +++ b/website/docs/resources/companion-projects.ja.md @@ -0,0 +1,5 @@ +# 関連プロジェクト + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) Yamato SecurityのWindowsイベントログ設定ガイド +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide) Sigmaルールと主要なガイドにおける検知ギャップを可視化するツール +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator) WELAのSigmaルール関連設定ファイルを生成するためのツール diff --git a/website/docs/resources/companion-projects.ko.md b/website/docs/resources/companion-projects.ko.md new file mode 100644 index 00000000..d0969fcb --- /dev/null +++ b/website/docs/resources/companion-projects.ko.md @@ -0,0 +1,5 @@ +# 관련 프로젝트 + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Yamato Security의 Windows 이벤트 로그 구성 가이드입니다. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Sigma 규칙 및 주요 가이드에서 탐지 공백을 시각화하는 도구입니다. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): WELA의 Sigma 규칙 관련 구성 파일을 생성하는 도구입니다. diff --git a/website/docs/resources/companion-projects.md b/website/docs/resources/companion-projects.md new file mode 100644 index 00000000..60c78661 --- /dev/null +++ b/website/docs/resources/companion-projects.md @@ -0,0 +1,5 @@ +# Companion Projects + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Yamato Security's Windows Event Log Configuration Guide. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): A tool to visualize detection gaps in Sigma rules and major guides. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): A tool for generating WELA's Sigma rule-related config files. diff --git a/website/docs/resources/companion-projects.my.md b/website/docs/resources/companion-projects.my.md new file mode 100644 index 00000000..266b0f43 --- /dev/null +++ b/website/docs/resources/companion-projects.my.md @@ -0,0 +1,5 @@ +# တွဲဖက်ပရောဂျက်များ + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Yamato Security ၏ Windows Event Log ဖွဲ့စည်းသတ်မှတ်ခြင်း လမ်းညွှန်။ +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Sigma rules နှင့် အဓိကလမ်းညွှန်များတွင် ထောက်လှမ်းမှု ကွာဟချက်များကို မြင်သာစေရန် ကိရိယာတစ်ခု။ +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): WELA ၏ Sigma rule နှင့်ဆက်စပ်သော config ဖိုင်များကို ထုတ်လုပ်ရန် ကိရိယာတစ်ခု။ diff --git a/website/docs/resources/companion-projects.pt-BR.md b/website/docs/resources/companion-projects.pt-BR.md new file mode 100644 index 00000000..591af180 --- /dev/null +++ b/website/docs/resources/companion-projects.pt-BR.md @@ -0,0 +1,5 @@ +# Projetos Complementares + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Guia de Configuração de Log de Eventos do Windows da Yamato Security. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Uma ferramenta para visualizar lacunas de detecção em regras Sigma e nos principais guias. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): Uma ferramenta para gerar os arquivos de configuração relacionados às regras Sigma do WELA. diff --git a/website/docs/resources/companion-projects.th.md b/website/docs/resources/companion-projects.th.md new file mode 100644 index 00000000..f154249c --- /dev/null +++ b/website/docs/resources/companion-projects.th.md @@ -0,0 +1,5 @@ +# โปรเจกต์ที่เกี่ยวข้อง + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): คู่มือการตั้งค่า Windows Event Log ของ Yamato Security +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): เครื่องมือสำหรับแสดงภาพช่องว่างของการตรวจจับในกฎ Sigma และคู่มือหลักต่าง ๆ +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): เครื่องมือสำหรับสร้างไฟล์ config ที่เกี่ยวข้องกับกฎ Sigma ของ WELA diff --git a/website/docs/resources/companion-projects.tr.md b/website/docs/resources/companion-projects.tr.md new file mode 100644 index 00000000..f750f083 --- /dev/null +++ b/website/docs/resources/companion-projects.tr.md @@ -0,0 +1,5 @@ +# Tamamlayıcı Projeler + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Yamato Security'nin Windows Olay Günlüğü Yapılandırma Kılavuzu. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Sigma kurallarındaki ve başlıca kılavuzlardaki tespit boşluklarını görselleştiren bir araç. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): WELA'nın Sigma kuralıyla ilgili yapılandırma dosyalarını oluşturmaya yönelik bir araç. diff --git a/website/docs/resources/companion-projects.uk.md b/website/docs/resources/companion-projects.uk.md new file mode 100644 index 00000000..07793e97 --- /dev/null +++ b/website/docs/resources/companion-projects.uk.md @@ -0,0 +1,5 @@ +# Супутні проєкти + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings): Посібник Yamato Security з налаштування журналу подій Windows. +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide): Інструмент для візуалізації прогалин у виявленні в правилах Sigma та основних посібниках. +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator): Інструмент для генерації конфігураційних файлів, пов'язаних із правилами Sigma для WELA. diff --git a/website/docs/resources/companion-projects.zh-TW.md b/website/docs/resources/companion-projects.zh-TW.md new file mode 100644 index 00000000..3c77039a --- /dev/null +++ b/website/docs/resources/companion-projects.zh-TW.md @@ -0,0 +1,5 @@ +# 相關專案 + +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings)：Yamato Security 的 Windows 事件記錄檔設定指南。 +* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide)：用於視覺化呈現 Sigma 規則與主要指南中偵測缺口的工具。 +* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator)：用於產生 WELA 的 Sigma 規則相關設定檔的工具。 diff --git a/website/docs/resources/contributing.ar.md b/website/docs/resources/contributing.ar.md new file mode 100644 index 00000000..648550fa --- /dev/null +++ b/website/docs/resources/contributing.ar.md @@ -0,0 +1,30 @@ +# المساهمة والدعم + +## المساهمات + +يسعدنا تلقي أي شكل من أشكال المساهمة. +طلبات السحب (Pull requests) هي الأفضل، لكن طلبات الميزات وإبلاغنا بالأخطاء وما إلى ذلك من خلال المشكلات (issues) مرحب بها أيضًا. + +على أقل تقدير، **إذا أعجبتك أدواتنا ومواردنا، فيرجى منحنا نجمة على GitHub وإظهار دعمك!** + +## إرسال الأخطاء + +* يرجى إرسال أي أخطاء تجدها [هنا.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* تتم صيانة هذا المشروع بنشاط حاليًا، ويسعدنا إصلاح أي أخطاء يتم الإبلاغ عنها. + +## الترخيص + +* يتم إصدار WELA بموجب [ترخيص MIT](https://opensource.org/licenses/MIT). + +## المساهمون + +* Fukusuke Takahashi (المطور الأساسي) +* Zach Mathis (قائد المشروع، تصميم الأدوات، الاختبار، وما إلى ذلك...) (@yamatosecurity) + +## شكر وتقدير + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.de.md b/website/docs/resources/contributing.de.md new file mode 100644 index 00000000..602acb42 --- /dev/null +++ b/website/docs/resources/contributing.de.md @@ -0,0 +1,30 @@ +# Mitwirken & Support + +## Beiträge + +Wir würden uns über jede Form von Beitrag freuen. +Pull Requests sind am besten, aber auch Feature-Anfragen, die uns über Bugs usw. mittels Issues informieren, sind sehr willkommen. + +Zumindest: **Wenn Ihnen unsere Tools und Ressourcen gefallen, dann geben Sie uns bitte einen Stern auf GitHub und zeigen Sie Ihre Unterstützung!** + +## Bug-Meldung + +* Bitte melden Sie alle gefundenen Bugs [hier.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* Dieses Projekt wird derzeit aktiv gepflegt, und wir beheben gemeldete Bugs gerne. + +## Lizenz + +* WELA wird unter der [MIT License](https://opensource.org/licenses/MIT) veröffentlicht. + +## Mitwirkende + +* Fukusuke Takahashi (Hauptentwickler) +* Zach Mathis (Projektleiter, Tool-Design, Tests usw.) (@yamatosecurity) + +## Danksagungen + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.es.md b/website/docs/resources/contributing.es.md new file mode 100644 index 00000000..ec80aa4c --- /dev/null +++ b/website/docs/resources/contributing.es.md @@ -0,0 +1,30 @@ +# Contribuciones y soporte + +## Contribuciones + +Nos encantaría recibir cualquier forma de contribución. +Las pull requests son lo mejor, pero las solicitudes de funciones que nos notifiquen errores, etc... a través de issues también son muy bienvenidas. + +Como mínimo, **si te gustan nuestras herramientas y recursos, ¡danos una estrella en GitHub y muestra tu apoyo!** + +## Envío de errores + +* Por favor, envía cualquier error que encuentres [aquí.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* Este proyecto se mantiene actualmente de forma activa, y estaremos encantados de corregir cualquier error reportado. + +## Licencia + +* WELA se publica bajo la [Licencia MIT](https://opensource.org/licenses/MIT). + +## Colaboradores + +* Fukusuke Takahashi (desarrollador principal) +* Zach Mathis (líder del proyecto, diseño de herramientas, pruebas, etc...) (@yamatosecurity) + +## Agradecimientos + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.fr.md b/website/docs/resources/contributing.fr.md new file mode 100644 index 00000000..023eafb2 --- /dev/null +++ b/website/docs/resources/contributing.fr.md @@ -0,0 +1,30 @@ +# Contribution et support + +## Contributions + +Nous serions ravis de recevoir toute forme de contribution. +Les pull requests sont idéales, mais les demandes de fonctionnalités, les signalements de bugs, etc. via les issues sont également les bienvenus. + +Au minimum, **si vous appréciez nos outils et nos ressources, alors n'hésitez pas à nous attribuer une étoile sur GitHub et à montrer votre soutien !** + +## Signalement de bugs + +* Veuillez signaler tout bug que vous trouvez [ici.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* Ce projet est actuellement activement maintenu, et nous serons heureux de corriger tout bug signalé. + +## Licence + +* WELA est distribué sous la [licence MIT](https://opensource.org/licenses/MIT). + +## Contributeurs + +* Fukusuke Takahashi (développeur principal) +* Zach Mathis (chef de projet, conception de l'outil, tests, etc.) (@yamatosecurity) + +## Remerciements + +* [Australian Cyber Security Centre : Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft : Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.hi.md b/website/docs/resources/contributing.hi.md new file mode 100644 index 00000000..07e25f32 --- /dev/null +++ b/website/docs/resources/contributing.hi.md @@ -0,0 +1,30 @@ +# योगदान और समर्थन + +## योगदान + +हम किसी भी प्रकार के योगदान का स्वागत करते हैं। +पुल रिक्वेस्ट सबसे अच्छे हैं, लेकिन इश्यू के माध्यम से बग्स आदि के बारे में हमें सूचित करने वाले फीचर रिक्वेस्ट का भी हम बहुत स्वागत करते हैं। + +कम से कम, **यदि आपको हमारे टूल और संसाधन पसंद आते हैं, तो कृपया GitHub पर हमें एक स्टार दें और अपना समर्थन दिखाएं!** + +## बग सबमिशन + +* कृपया अपने द्वारा पाए गए किसी भी बग को [यहाँ](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) सबमिट करें। +* यह प्रोजेक्ट वर्तमान में सक्रिय रूप से मेंटेन किया जा रहा है, और हमें रिपोर्ट किए गए किसी भी बग को ठीक करने में खुशी होगी। + +## लाइसेंस + +* WELA को [MIT License](https://opensource.org/licenses/MIT) के तहत जारी किया गया है। + +## योगदानकर्ता + +* Fukusuke Takahashi (कोर डेवलपर) +* Zach Mathis (प्रोजेक्ट लीडर, टूल डिज़ाइन, टेस्टिंग, आदि) (@yamatosecurity) + +## आभार + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.id.md b/website/docs/resources/contributing.id.md new file mode 100644 index 00000000..3b1b6106 --- /dev/null +++ b/website/docs/resources/contributing.id.md @@ -0,0 +1,30 @@ +# Kontribusi & Dukungan + +## Kontribusi + +Kami akan sangat senang menerima segala bentuk kontribusi. +Pull request adalah yang terbaik, tetapi permintaan fitur yang memberitahu kami tentang bug, dll... melalui issue juga sangat kami sambut. + +Setidaknya, **jika Anda menyukai alat dan sumber daya kami, mohon berikan kami bintang di GitHub dan tunjukkan dukungan Anda!** + +## Pengiriman Bug + +* Silakan kirimkan bug apa pun yang Anda temukan [di sini.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* Proyek ini saat ini dipelihara secara aktif, dan kami dengan senang hati memperbaiki bug apa pun yang dilaporkan. + +## Lisensi + +* WELA dirilis di bawah [MIT License](https://opensource.org/licenses/MIT). + +## Kontributor + +* Fukusuke Takahashi (pengembang inti) +* Zach Mathis (pemimpin proyek, desain alat, pengujian, dll...) (@yamatosecurity) + +## Ucapan Terima Kasih + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.ja.md b/website/docs/resources/contributing.ja.md new file mode 100644 index 00000000..3121fedd --- /dev/null +++ b/website/docs/resources/contributing.ja.md @@ -0,0 +1,30 @@ +# 貢献とサポート + +## 貢献 + +わたしたちは、どんな形でも貢献を歓迎します。 +プルリクエスト、ルール作成、サンプルログの提供が最も歓迎されますが、バグの報告や機能リクエストなども大歓迎です。 + +少なくとも、**私たちのツールやリソースが気に入ったら、GitHubでスターをつけて応援してください！** + +## 不具合の報告 + +* 不具合の報告は、[こちら](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D)からお願いします。 +* このプロジェクトは現在も積極的にメンテナンスされており、バグの報告や機能のリクエストは大歓迎です。 + +## ライセンス + +* WELAは、[MITライセンス](https://opensource.org/licenses/MIT)のもとでリリースされています。 + +## 貢献者 + +* Fukusuke Takahashi (コア開発者) +* Zach Mathis (プロジェクトリーダー, ツールデザイン, テスト,　など...) (@yamatosecurity) + +## 謝辞 + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## X diff --git a/website/docs/resources/contributing.ko.md b/website/docs/resources/contributing.ko.md new file mode 100644 index 00000000..1bb56795 --- /dev/null +++ b/website/docs/resources/contributing.ko.md @@ -0,0 +1,30 @@ +# 기여 및 지원 + +## 기여 + +어떤 형태의 기여라도 환영합니다. +풀 리퀘스트가 가장 좋지만, 이슈를 통해 버그 등을 알려주는 기능 요청도 매우 환영합니다. + +적어도, **저희 도구와 리소스가 마음에 드신다면 GitHub에서 별표를 눌러 지지를 보여주세요!** + +## 버그 제출 + +* 발견한 버그는 [여기에서](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) 제출해 주세요. +* 이 프로젝트는 현재 활발히 유지 관리되고 있으며, 보고된 버그를 기꺼이 수정합니다. + +## 라이선스 + +* WELA는 [MIT License](https://opensource.org/licenses/MIT) 하에 배포됩니다. + +## 기여자 + +* Fukusuke Takahashi (핵심 개발자) +* Zach Mathis (프로젝트 리더, 도구 설계, 테스트 등) (@yamatosecurity) + +## 감사의 말 + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.md b/website/docs/resources/contributing.md new file mode 100644 index 00000000..6f47424f --- /dev/null +++ b/website/docs/resources/contributing.md @@ -0,0 +1,30 @@ +# Contributing & Support + +## Contributions + +We would love any form of contribution. +Pull requests are the best, but feature requests notifying us of bugs, etc... through issues are also very welcome. + +At the least, **if you like our tools and resources, then please give us a star on GitHub and show your support!** + +## Bug Submission + +* Please submit any bugs you find [here.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* This project is currently actively maintained, and we are happy to fix any bugs reported. + +## License + +* WELA is released under the [MIT License](https://opensource.org/licenses/MIT). + +## Contributors + +* Fukusuke Takahashi (core developer) +* Zach Mathis (project leader, tool design, testing, etc...) (@yamatosecurity) + +## Acknowledgements + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.my.md b/website/docs/resources/contributing.my.md new file mode 100644 index 00000000..dbffb162 --- /dev/null +++ b/website/docs/resources/contributing.my.md @@ -0,0 +1,30 @@ +# ပံ့ပိုးကူညီခြင်းနှင့် ပံ့ပိုးမှု + +## ပံ့ပိုးကူညီမှုများ + +မည်သည့်ပုံစံဖြင့်မဆို ပံ့ပိုးကူညီမှုကို ကျွန်ုပ်တို့ ကြိုဆိုပါသည်။ +Pull request များသည် အကောင်းဆုံးဖြစ်သော်လည်း၊ issue များမှတစ်ဆင့် bug များ စသည်တို့ကို ကျွန်ုပ်တို့အား အသိပေးသည့် feature တောင်းဆိုမှုများကိုလည်း အလွန်ကြိုဆိုပါသည်။ + +အနည်းဆုံးအားဖြင့်၊ **ကျွန်ုပ်တို့၏ tool များနှင့် အရင်းအမြစ်များကို သင်နှစ်သက်ပါက၊ ကျေးဇူးပြု၍ GitHub တွင် ကျွန်ုပ်တို့အား star ပေး၍ သင်၏ပံ့ပိုးမှုကို ပြသပါ!** + +## Bug တင်ပြခြင်း + +* သင်တွေ့ရှိသည့် မည်သည့် bug ကိုမဆို [ဤနေရာတွင်](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) ကျေးဇူးပြု၍ တင်ပြပါ။ +* ဤ project ကို လက်ရှိတွင် တက်ကြွစွာ ထိန်းသိမ်းနေပြီး၊ တင်ပြလာသည့် မည်သည့် bug ကိုမဆို ပြုပြင်ရန် ကျွန်ုပ်တို့ ဝမ်းသာပါသည်။ + +## လိုင်စင် + +* WELA ကို [MIT License](https://opensource.org/licenses/MIT) အောက်တွင် ထုတ်ဝေထားပါသည်။ + +## ပံ့ပိုးကူညီသူများ + +* Fukusuke Takahashi (core developer) +* Zach Mathis (project leader, tool design, testing, etc...) (@yamatosecurity) + +## ကျေးဇူးတင်လွှာ + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.pt-BR.md b/website/docs/resources/contributing.pt-BR.md new file mode 100644 index 00000000..d4acad38 --- /dev/null +++ b/website/docs/resources/contributing.pt-BR.md @@ -0,0 +1,30 @@ +# Contribuições e Suporte + +## Contribuições + +Adoraríamos qualquer forma de contribuição. +Pull requests são as melhores, mas solicitações de funcionalidades, nos notificando sobre bugs, etc... por meio de issues também são muito bem-vindas. + +No mínimo, **se você gosta das nossas ferramentas e recursos, então por favor nos dê uma estrela no GitHub e mostre seu apoio!** + +## Envio de Bugs + +* Por favor, envie quaisquer bugs que você encontrar [aqui.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* Este projeto está atualmente sendo mantido ativamente, e ficamos felizes em corrigir quaisquer bugs reportados. + +## Licença + +* O WELA é distribuído sob a [Licença MIT](https://opensource.org/licenses/MIT). + +## Contribuidores + +* Fukusuke Takahashi (desenvolvedor principal) +* Zach Mathis (líder do projeto, design da ferramenta, testes, etc...) (@yamatosecurity) + +## Agradecimentos + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.th.md b/website/docs/resources/contributing.th.md new file mode 100644 index 00000000..ef07d3e0 --- /dev/null +++ b/website/docs/resources/contributing.th.md @@ -0,0 +1,30 @@ +# การมีส่วนร่วมและการสนับสนุน + +## การมีส่วนร่วม + +เรายินดีรับการมีส่วนร่วมในทุกรูปแบบ +Pull request เป็นสิ่งที่ดีที่สุด แต่คำขอฟีเจอร์ การแจ้งบั๊กต่าง ๆ ผ่าน issue ก็เป็นที่ยินดีอย่างยิ่งเช่นกัน + +อย่างน้อยที่สุด **หากคุณชื่นชอบเครื่องมือและทรัพยากรของเรา โปรดให้ดาวเราบน GitHub และแสดงการสนับสนุนของคุณ!** + +## การส่งรายงานบั๊ก + +* โปรดส่งบั๊กใด ๆ ที่คุณพบ [ที่นี่](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* โปรเจกต์นี้กำลังอยู่ในระหว่างการดูแลรักษาอย่างต่อเนื่อง และเรายินดีที่จะแก้ไขบั๊กใด ๆ ที่ได้รับรายงาน + +## สัญญาอนุญาต + +* WELA เผยแพร่ภายใต้ [MIT License](https://opensource.org/licenses/MIT) + +## ผู้มีส่วนร่วม + +* Fukusuke Takahashi (นักพัฒนาหลัก) +* Zach Mathis (หัวหน้าโปรเจกต์, การออกแบบเครื่องมือ, การทดสอบ ฯลฯ) (@yamatosecurity) + +## กิตติกรรมประกาศ + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.tr.md b/website/docs/resources/contributing.tr.md new file mode 100644 index 00000000..bae0218b --- /dev/null +++ b/website/docs/resources/contributing.tr.md @@ -0,0 +1,30 @@ +# Katkıda Bulunma ve Destek + +## Katkılar + +Her türlü katkıyı memnuniyetle karşılarız. +En iyisi pull request'lerdir, ancak issue'lar aracılığıyla bizi hatalardan vb. haberdar eden özellik istekleri de çok hoş karşılanır. + +En azından, **araçlarımızı ve kaynaklarımızı beğeniyorsanız, lütfen GitHub'da bize bir yıldız verin ve desteğinizi gösterin!** + +## Hata Bildirimi + +* Bulduğunuz hataları lütfen [buradan](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) bildirin. +* Bu proje şu anda aktif olarak bakımı yapılan bir projedir ve bildirilen her hatayı düzeltmekten memnuniyet duyarız. + +## Lisans + +* WELA [MIT Lisansı](https://opensource.org/licenses/MIT) altında yayınlanmıştır. + +## Katkıda Bulunanlar + +* Fukusuke Takahashi (çekirdek geliştirici) +* Zach Mathis (proje lideri, araç tasarımı, test, vb...) (@yamatosecurity) + +## Teşekkürler + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.uk.md b/website/docs/resources/contributing.uk.md new file mode 100644 index 00000000..a2c1aa1b --- /dev/null +++ b/website/docs/resources/contributing.uk.md @@ -0,0 +1,30 @@ +# Внесок та підтримка + +## Внески + +Ми будемо раді будь-якій формі внеску. +Pull request — це найкраще, але запити на функції, повідомлення про помилки тощо через issues також дуже вітаються. + +Як мінімум, **якщо вам подобаються наші інструменти та ресурси, будь ласка, поставте нам зірочку на GitHub і виявіть свою підтримку!** + +## Подання повідомлень про помилки + +* Будь ласка, надсилайте будь-які помилки, які ви знайдете, [сюди.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D) +* Цей проєкт наразі активно підтримується, і ми будемо раді виправити будь-які повідомлені помилки. + +## Ліцензія + +* WELA випускається під [ліцензією MIT](https://opensource.org/licenses/MIT). + +## Учасники + +* Fukusuke Takahashi (основний розробник) +* Zach Mathis (керівник проєкту, дизайн інструментів, тестування тощо) (@yamatosecurity) + +## Подяки + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/contributing.zh-TW.md b/website/docs/resources/contributing.zh-TW.md new file mode 100644 index 00000000..2e2df32f --- /dev/null +++ b/website/docs/resources/contributing.zh-TW.md @@ -0,0 +1,30 @@ +# 貢獻與支援 + +## 貢獻 + +我們非常歡迎任何形式的貢獻。 +Pull request 是最好的方式，但透過 issue 通知我們功能需求、回報錯誤等也都非常歡迎。 + +至少，**如果您喜歡我們的工具與資源，請在 GitHub 上給我們一顆星，表達您的支持！** + +## 錯誤回報 + +* 請在[此處](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D)回報您發現的任何錯誤。 +* 本專案目前正積極維護中，我們很樂意修正任何回報的錯誤。 + +## 授權 + +* WELA 以 [MIT License](https://opensource.org/licenses/MIT) 釋出。 + +## 貢獻者 + +* Fukusuke Takahashi（核心開發者） +* Zach Mathis（專案負責人、工具設計、測試等）（@yamatosecurity） + +## 致謝 + +* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq) +* [SigmaHQ](https://github.com/SigmaHQ/sigma) + +## Twitter diff --git a/website/docs/resources/other-resources.ar.md b/website/docs/resources/other-resources.ar.md new file mode 100644 index 00000000..d9a6a807 --- /dev/null +++ b/website/docs/resources/other-resources.ar.md @@ -0,0 +1,9 @@ +# موارد أخرى متعلقة بإعدادات تدقيق سجل أحداث Windows + +* [نهج قائم على البيانات لسياسة التدقيق المتقدمة في Windows – ما الذي يجب تمكينه ولماذا](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [توصيات سياسة التدقيق](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [تكوين سياسات التدقيق لسجلات أحداث Windows](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [تسجيل أحداث Windows وإعادة توجيهها](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.de.md b/website/docs/resources/other-resources.de.md new file mode 100644 index 00000000..7e44e085 --- /dev/null +++ b/website/docs/resources/other-resources.de.md @@ -0,0 +1,9 @@ +# Weitere Ressourcen zu Audit-Einstellungen für Windows-Ereignisprotokolle + +* [A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Audit Policy Recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configure audit policies for Windows event logs](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.es.md b/website/docs/resources/other-resources.es.md new file mode 100644 index 00000000..dc6c8a2d --- /dev/null +++ b/website/docs/resources/other-resources.es.md @@ -0,0 +1,9 @@ +# Otros recursos relacionados con la configuración de auditoría del Registro de eventos de Windows + +* [A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Audit Policy Recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configure audit policies for Windows event logs](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.fr.md b/website/docs/resources/other-resources.fr.md new file mode 100644 index 00000000..d9910c1a --- /dev/null +++ b/website/docs/resources/other-resources.fr.md @@ -0,0 +1,9 @@ +# Autres ressources liées aux paramètres d'audit des journaux d'événements Windows + +* [Une approche fondée sur les données pour la stratégie d'audit avancée de Windows – Quoi activer et pourquoi](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Recommandations de stratégie d'audit](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configurer les stratégies d'audit pour les journaux d'événements Windows](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Journalisation et transfert des événements Windows](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.hi.md b/website/docs/resources/other-resources.hi.md new file mode 100644 index 00000000..f6e248c6 --- /dev/null +++ b/website/docs/resources/other-resources.hi.md @@ -0,0 +1,9 @@ +# अन्य Windows इवेंट लॉग ऑडिट सेटिंग्स से संबंधित संसाधन + +* [Windows एडवांस्ड ऑडिट पॉलिसी के लिए एक डेटा-संचालित दृष्टिकोण – क्या सक्षम करें और क्यों](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [ऑडिट पॉलिसी अनुशंसाएँ](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Windows इवेंट लॉग के लिए ऑडिट पॉलिसी कॉन्फ़िगर करें](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows इवेंट लॉगिंग और फ़ॉरवर्डिंग](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.id.md b/website/docs/resources/other-resources.id.md new file mode 100644 index 00000000..55c72fd0 --- /dev/null +++ b/website/docs/resources/other-resources.id.md @@ -0,0 +1,9 @@ +# Sumber Daya Terkait Pengaturan Audit Log Peristiwa Windows Lainnya + +* [A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Audit Policy Recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configure audit policies for Windows event logs](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.ja.md b/website/docs/resources/other-resources.ja.md new file mode 100644 index 00000000..53c960c2 --- /dev/null +++ b/website/docs/resources/other-resources.ja.md @@ -0,0 +1,9 @@ +# Windowsイベントログの監査設定に関するその他の参考資料 + +* [A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Audit Policy Recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configure audit policies for Windows event logs](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.ko.md b/website/docs/resources/other-resources.ko.md new file mode 100644 index 00000000..c371d595 --- /dev/null +++ b/website/docs/resources/other-resources.ko.md @@ -0,0 +1,9 @@ +# 기타 Windows 이벤트 로그 감사 설정 관련 자료 + +* [데이터 기반 Windows 고급 감사 정책 접근법 – 무엇을 활성화하고 왜 그래야 하는가](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [감사 정책 권장 사항](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Windows 이벤트 로그를 위한 감사 정책 구성](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows 이벤트 로깅 및 전달](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.md b/website/docs/resources/other-resources.md new file mode 100644 index 00000000..c7f8ba9a --- /dev/null +++ b/website/docs/resources/other-resources.md @@ -0,0 +1,9 @@ +# Other Windows Event Log Audit Settings Related Resources + +* [A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Audit Policy Recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configure audit policies for Windows event logs](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.my.md b/website/docs/resources/other-resources.my.md new file mode 100644 index 00000000..1c11cc7c --- /dev/null +++ b/website/docs/resources/other-resources.my.md @@ -0,0 +1,9 @@ +# အခြား Windows Event Log စစ်ဆေးရေးဆက်တင်များနှင့် သက်ဆိုင်သော အရင်းအမြစ်များ + +* [A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Audit Policy Recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configure audit policies for Windows event logs](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.pt-BR.md b/website/docs/resources/other-resources.pt-BR.md new file mode 100644 index 00000000..b9d7e82b --- /dev/null +++ b/website/docs/resources/other-resources.pt-BR.md @@ -0,0 +1,9 @@ +# Outros recursos relacionados às configurações de auditoria de logs de eventos do Windows + +* [Uma abordagem orientada a dados para a Política de Auditoria Avançada do Windows – O que habilitar e por quê](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Recomendações de Política de Auditoria](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configurar políticas de auditoria para logs de eventos do Windows](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Registro e encaminhamento de eventos do Windows](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.th.md b/website/docs/resources/other-resources.th.md new file mode 100644 index 00000000..417170f6 --- /dev/null +++ b/website/docs/resources/other-resources.th.md @@ -0,0 +1,9 @@ +# แหล่งข้อมูลอื่น ๆ ที่เกี่ยวข้องกับการตั้งค่าการตรวจสอบ Windows Event Log + +* [A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Audit Policy Recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Configure audit policies for Windows event logs](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.tr.md b/website/docs/resources/other-resources.tr.md new file mode 100644 index 00000000..6e8c126d --- /dev/null +++ b/website/docs/resources/other-resources.tr.md @@ -0,0 +1,9 @@ +# Windows Olay Günlüğü Denetim Ayarlarıyla İlgili Diğer Kaynaklar + +* [Windows Gelişmiş Denetim İlkesine Veri Odaklı Bir Yaklaşım – Neyi Etkinleştirmeli ve Neden](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Denetim İlkesi Önerileri](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Windows olay günlükleri için denetim ilkelerini yapılandırma](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows olay günlüğü kaydı ve iletme](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.uk.md b/website/docs/resources/other-resources.uk.md new file mode 100644 index 00000000..2664ccbd --- /dev/null +++ b/website/docs/resources/other-resources.uk.md @@ -0,0 +1,9 @@ +# Інші ресурси, пов'язані з налаштуваннями аудиту журналів подій Windows + +* [Підхід на основі даних до розширеної політики аудиту Windows – що ввімкнути та чому](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [Рекомендації щодо політики аудиту](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [Налаштування політик аудиту для журналів подій Windows](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Журналювання та пересилання подій Windows](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/resources/other-resources.zh-TW.md b/website/docs/resources/other-resources.zh-TW.md new file mode 100644 index 00000000..5076f6c9 --- /dev/null +++ b/website/docs/resources/other-resources.zh-TW.md @@ -0,0 +1,9 @@ +# 其他 Windows 事件記錄稽核設定相關資源 + +* [資料驅動的 Windows 進階稽核原則方法 – 該啟用什麼以及為什麼](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html) +* [稽核原則建議](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [為 Windows 事件記錄設定稽核原則](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection) +* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) +* [Windows 事件記錄與轉送](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding) +* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline) +* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects) diff --git a/website/docs/stylesheets/extra.css b/website/docs/stylesheets/extra.css new file mode 100644 index 00000000..1a0f30f5 --- /dev/null +++ b/website/docs/stylesheets/extra.css @@ -0,0 +1,125 @@ +/* ========================================================================= + Hayabusa docs — custom theme (falcon blue + amber) + ========================================================================= */ + +/* ---- Custom primary / accent palette (theme.palette primary: custom) ---- */ +[data-md-color-primary="custom"] { + --md-primary-fg-color: #163b6b; + --md-primary-fg-color--light: #2a5694; + --md-primary-fg-color--dark: #0e2747; + --md-primary-bg-color: #ffffff; + --md-primary-bg-color--light: #ffffffb3; +} + +[data-md-color-accent="custom"] { + --md-accent-fg-color: #e8851a; + --md-accent-fg-color--transparent:#e8851a1a; + --md-accent-bg-color: #ffffff; + --md-accent-bg-color--light: #ffffffb3; +} + +/* Light scheme: tasteful blue links */ +[data-md-color-scheme="default"] { + --md-typeset-a-color: #1d5fb8; +} + +/* Dark scheme: lighten header + links for contrast */ +[data-md-color-scheme="slate"] { + --md-primary-fg-color: #12233b; + --md-typeset-a-color: #6ea8fe; + --md-accent-fg-color: #ffa53b; +} + +/* ---- Top tabs: a touch bolder so main topics read as primary nav ---- */ +.md-tabs__link { + font-weight: 600; + opacity: 0.92; +} +.md-tabs__link--active { + opacity: 1; +} + +/* Subtle header gradient */ +.md-header { + background: linear-gradient(90deg, var(--md-primary-fg-color--dark), var(--md-primary-fg-color)); +} +.md-tabs { + background: var(--md-primary-fg-color); +} + +/* Slightly wider content for the dense command reference tables */ +.md-grid { + max-width: 68rem; +} + +/* ========================================================================= + Landing-page hero + ========================================================================= */ +.hb-hero { + text-align: center; + padding: 2.4rem 0 1.2rem; +} +.hb-hero img.hb-logo { + width: min(420px, 80%); + margin: 0 auto 1rem; +} +.hb-hero .hb-tagline { + font-size: 1.15rem; + line-height: 1.6; + max-width: 46rem; + margin: 0 auto 1.4rem; + color: var(--md-default-fg-color--light); +} +.hb-badges { + margin: 0.4rem 0 1.4rem; +} +.hb-badges img { + margin: 2px; + vertical-align: middle; +} +.hb-cta { + display: flex; + gap: 0.6rem; + justify-content: center; + flex-wrap: wrap; + margin-bottom: 1rem; +} +.hb-cta .md-button { + margin: 0.2rem; +} + +/* ========================================================================= + Grid cards (feature highlights on the home page) + ========================================================================= */ +.md-typeset .grid.cards > ul > li { + border-radius: 0.5rem; + transition: border-color 160ms ease, box-shadow 160ms ease, transform 160ms ease; +} +.md-typeset .grid.cards > ul > li:hover { + border-color: var(--md-accent-fg-color); + box-shadow: 0 4px 16px rgba(0, 0, 0, 0.10); + transform: translateY(-2px); +} +.md-typeset .grid.cards .lg.middle { + color: var(--md-accent-fg-color); +} + +/* ========================================================================= + Misc readability tweaks + ========================================================================= */ +/* Screenshots get a light frame + zoom affordance */ +.md-typeset img:not(.hb-logo):not(.twemoji):not([src*="img.shields.io"]):not([src*="badge"]) { + border-radius: 6px; + box-shadow: 0 1px 6px rgba(0, 0, 0, 0.18); +} + +/* Wrap wide tables instead of overflowing oddly */ +.md-typeset table:not([class]) { + display: table; + width: 100%; +} + +/* Inline code a little calmer */ +.md-typeset code { + border-radius: 4px; +} diff --git a/website/mkdocs.yml b/website/mkdocs.yml new file mode 100644 index 00000000..369471ec --- /dev/null +++ b/website/mkdocs.yml @@ -0,0 +1,393 @@ +# ============================================================================= +# WELA Documentation Site — Material for MkDocs +# ----------------------------------------------------------------------------- +# Hosted for free on GitHub Pages (see ../.github/workflows/docs.yml). +# Top tabs = main topics, left sidebar = subtopics. +# >>> If you fork/rename, update site_url, repo_url and repo_name below. <<< +# ============================================================================= + +site_name: WELA +site_description: >- + WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing Windows event log settings. +site_author: Yamato Security +site_url: https://yamato-security.github.io/WELA/ + +repo_url: https://github.com/Yamato-Security/WELA +repo_name: Yamato-Security/WELA +edit_uri: edit/main/website/docs/ + +copyright: >- + Copyright © Yamato Security — Documentation built with Material for MkDocs + +docs_dir: docs + +theme: + name: material + language: en + logo: assets/screenshots/WELA-Logo.png + favicon: assets/screenshots/WELA-Logo.png + icon: + repo: fontawesome/brands/github + font: + text: Inter + code: JetBrains Mono + palette: + - media: "(prefers-color-scheme: light)" + scheme: default + primary: custom + accent: custom + toggle: + icon: material/weather-night + name: Switch to dark mode + - media: "(prefers-color-scheme: dark)" + scheme: slate + primary: custom + accent: custom + toggle: + icon: material/weather-sunny + name: Switch to light mode + features: + - navigation.tabs + - navigation.tabs.sticky + - navigation.sections + - navigation.top + - navigation.footer + - navigation.tracking + - toc.follow + - search.suggest + - search.highlight + - search.share + - content.code.copy + - content.code.annotate + - content.tooltips + +extra_css: + - stylesheets/extra.css + +markdown_extensions: + - abbr + - admonition + - attr_list + - def_list + - footnotes + - md_in_html + - tables + - toc: + permalink: true + toc_depth: 3 + slugify: !!python/object/apply:pymdownx.slugs.slugify + kwds: + case: lower + - pymdownx.details + - pymdownx.highlight: + anchor_linenums: true + line_spans: __span + pygments_lang_class: true + - pymdownx.inlinehilite + - pymdownx.snippets + - pymdownx.superfences + - pymdownx.tabbed: + alternate_style: true + - pymdownx.tasklist: + custom_checkbox: true + - pymdownx.keys + - pymdownx.emoji: + emoji_index: !!python/name:material.extensions.emoji.twemoji + emoji_generator: !!python/name:material.extensions.emoji.to_svg + +plugins: + - search + - glightbox: + touchNavigation: true + loop: false + effect: zoom + width: 100% + auto_caption: false + - i18n: + docs_structure: suffix + fallback_to_default: true + reconfigure_material: true + reconfigure_search: true + languages: + - locale: en + default: true + name: English + build: true + - locale: ja + name: 日本語 + build: true + site_name: WELA ドキュメント + nav_translations: + Home: ホーム + Overview: 概要 + About WELA: WELAについて + Features: 機能 + Screenshots: スクリーンショット + Getting Started: はじめに + Commands: コマンド + Command List: コマンド一覧 + Command Usage: コマンド使用例 + Resources: リソース + Companion Projects: 関連プロジェクト + Other Resources: その他の参考資料 + Changelog: 変更履歴 + Contributing & Support: 貢献とサポート + - locale: zh-TW + name: 繁體中文 + build: true + nav_translations: + "Home": "首頁" + "Overview": "概觀" + "About WELA": "關於 WELA" + "Features": "功能特色" + "Screenshots": "螢幕截圖" + "Getting Started": "快速入門" + "Commands": "命令" + "Command List": "命令清單" + "Command Usage": "命令用法" + "Resources": "資源" + "Companion Projects": "相關專案" + "Other Resources": "其他資源" + "Changelog": "變更紀錄" + "Contributing & Support": "貢獻與支援" + - locale: ko + name: 한국어 + build: true + nav_translations: + "Home": "홈" + "Overview": "개요" + "About WELA": "WELA 소개" + "Features": "기능" + "Screenshots": "스크린샷" + "Getting Started": "시작하기" + "Commands": "명령어" + "Command List": "명령어 목록" + "Command Usage": "명령어 사용법" + "Resources": "리소스" + "Companion Projects": "관련 프로젝트" + "Other Resources": "기타 리소스" + "Changelog": "변경 이력" + "Contributing & Support": "기여 및 지원" + - locale: de + name: Deutsch + build: true + nav_translations: + "Home": "Startseite" + "Overview": "Übersicht" + "About WELA": "Über WELA" + "Features": "Funktionen" + "Screenshots": "Screenshots" + "Getting Started": "Erste Schritte" + "Commands": "Befehle" + "Command List": "Befehlsliste" + "Command Usage": "Befehlsverwendung" + "Resources": "Ressourcen" + "Companion Projects": "Begleitprojekte" + "Other Resources": "Weitere Ressourcen" + "Changelog": "Änderungsprotokoll" + "Contributing & Support": "Mitwirken & Support" + - locale: tr + name: Türkçe + build: true + nav_translations: + "Home": "Ana Sayfa" + "Overview": "Genel Bakış" + "About WELA": "WELA Hakkında" + "Features": "Özellikler" + "Screenshots": "Ekran Görüntüleri" + "Getting Started": "Başlarken" + "Commands": "Komutlar" + "Command List": "Komut Listesi" + "Command Usage": "Komut Kullanımı" + "Resources": "Kaynaklar" + "Companion Projects": "Tamamlayıcı Projeler" + "Other Resources": "Diğer Kaynaklar" + "Changelog": "Değişiklik Günlüğü" + "Contributing & Support": "Katkıda Bulunma ve Destek" + - locale: fr + name: Français + build: true + nav_translations: + "Home": "Accueil" + "Overview": "Aperçu" + "About WELA": "À propos de WELA" + "Features": "Fonctionnalités" + "Screenshots": "Captures d'écran" + "Getting Started": "Premiers pas" + "Commands": "Commandes" + "Command List": "Liste des commandes" + "Command Usage": "Utilisation des commandes" + "Resources": "Ressources" + "Companion Projects": "Projets associés" + "Other Resources": "Autres ressources" + "Changelog": "Journal des modifications" + "Contributing & Support": "Contribution et support" + - locale: es + name: Español + build: true + nav_translations: + "Home": "Inicio" + "Overview": "Visión general" + "About WELA": "Acerca de WELA" + "Features": "Características" + "Screenshots": "Capturas de pantalla" + "Getting Started": "Primeros pasos" + "Commands": "Comandos" + "Command List": "Lista de comandos" + "Command Usage": "Uso de comandos" + "Resources": "Recursos" + "Companion Projects": "Proyectos complementarios" + "Other Resources": "Otros recursos" + "Changelog": "Registro de cambios" + "Contributing & Support": "Contribución y soporte" + - locale: pt-BR + name: Português (Brasil) + build: true + nav_translations: + "Home": "Início" + "Overview": "Visão Geral" + "About WELA": "Sobre o WELA" + "Features": "Recursos" + "Screenshots": "Capturas de Tela" + "Getting Started": "Primeiros Passos" + "Commands": "Comandos" + "Command List": "Lista de Comandos" + "Command Usage": "Uso dos Comandos" + "Resources": "Recursos" + "Companion Projects": "Projetos Complementares" + "Other Resources": "Outros Recursos" + "Changelog": "Registro de Alterações" + "Contributing & Support": "Contribuição e Suporte" + - locale: uk + name: Українська + build: true + nav_translations: + "Home": "Головна" + "Overview": "Огляд" + "About WELA": "Про WELA" + "Features": "Можливості" + "Screenshots": "Знімки екрана" + "Getting Started": "Початок роботи" + "Commands": "Команди" + "Command List": "Список команд" + "Command Usage": "Використання команд" + "Resources": "Ресурси" + "Companion Projects": "Супутні проєкти" + "Other Resources": "Інші ресурси" + "Changelog": "Журнал змін" + "Contributing & Support": "Внесок і підтримка" + - locale: hi + name: हिन्दी + build: true + nav_translations: + "Home": "मुख्य पृष्ठ" + "Overview": "अवलोकन" + "About WELA": "WELA के बारे में" + "Features": "विशेषताएँ" + "Screenshots": "स्क्रीनशॉट" + "Getting Started": "शुरुआत करना" + "Commands": "कमांड" + "Command List": "कमांड सूची" + "Command Usage": "कमांड उपयोग" + "Resources": "संसाधन" + "Companion Projects": "सहयोगी परियोजनाएँ" + "Other Resources": "अन्य संसाधन" + "Changelog": "परिवर्तन सूची" + "Contributing & Support": "योगदान और सहायता" + - locale: id + name: Bahasa Indonesia + build: true + nav_translations: + "Home": "Beranda" + "Overview": "Ikhtisar" + "About WELA": "Tentang WELA" + "Features": "Fitur" + "Screenshots": "Tangkapan Layar" + "Getting Started": "Memulai" + "Commands": "Perintah" + "Command List": "Daftar Perintah" + "Command Usage": "Penggunaan Perintah" + "Resources": "Sumber Daya" + "Companion Projects": "Proyek Pendamping" + "Other Resources": "Sumber Daya Lainnya" + "Changelog": "Catatan Perubahan" + "Contributing & Support": "Kontribusi & Dukungan" + - locale: my + name: မြန်မာဘာသာ + build: true + nav_translations: + "Home": "ပင်မစာမျက်နှာ" + "Overview": "ခြုံငုံသုံးသပ်ချက်" + "About WELA": "WELA အကြောင်း" + "Features": "လုပ်ဆောင်ချက်များ" + "Screenshots": "မျက်နှာပြင်ဓာတ်ပုံများ" + "Getting Started": "စတင်အသုံးပြုခြင်း" + "Commands": "ညွှန်ကြားချက်များ" + "Command List": "ညွှန်ကြားချက်စာရင်း" + "Command Usage": "ညွှန်ကြားချက်အသုံးပြုပုံ" + "Resources": "အရင်းအမြစ်များ" + "Companion Projects": "ဆက်စပ်ပရောဂျက်များ" + "Other Resources": "အခြားအရင်းအမြစ်များ" + "Changelog": "ပြောင်းလဲမှုမှတ်တမ်း" + "Contributing & Support": "ပါဝင်ကူညီခြင်းနှင့် ပံ့ပိုးမှု" + - locale: th + name: ไทย + build: true + nav_translations: + "Home": "หน้าแรก" + "Overview": "ภาพรวม" + "About WELA": "เกี่ยวกับ WELA" + "Features": "คุณสมบัติ" + "Screenshots": "ภาพหน้าจอ" + "Getting Started": "เริ่มต้นใช้งาน" + "Commands": "คำสั่ง" + "Command List": "รายการคำสั่ง" + "Command Usage": "การใช้งานคำสั่ง" + "Resources": "แหล่งข้อมูล" + "Companion Projects": "โครงการที่เกี่ยวข้อง" + "Other Resources": "แหล่งข้อมูลอื่น ๆ" + "Changelog": "บันทึกการเปลี่ยนแปลง" + "Contributing & Support": "การมีส่วนร่วมและการสนับสนุน" + - locale: ar + name: العربية + build: true + nav_translations: + "Home": "الرئيسية" + "Overview": "نظرة عامة" + "About WELA": "حول WELA" + "Features": "الميزات" + "Screenshots": "لقطات الشاشة" + "Getting Started": "البدء" + "Commands": "الأوامر" + "Command List": "قائمة الأوامر" + "Command Usage": "استخدام الأوامر" + "Resources": "الموارد" + "Companion Projects": "المشاريع المصاحبة" + "Other Resources": "موارد أخرى" + "Changelog": "سجل التغييرات" + "Contributing & Support": "المساهمة والدعم" + +extra: + social: + - icon: fontawesome/brands/github + link: https://github.com/Yamato-Security/WELA + name: WELA on GitHub + - icon: fontawesome/brands/x-twitter + link: https://twitter.com/SecurityYamato + name: Yamato Security on X + +nav: + - Home: index.md + - Overview: + - About WELA: overview/index.md + - Features: overview/features.md + - Screenshots: overview/screenshots.md + - Getting Started: getting-started/index.md + - Commands: + - Command List: commands/index.md + - Command Usage: commands/usage.md + - Resources: + - Companion Projects: resources/companion-projects.md + - Other Resources: resources/other-resources.md + - Changelog: resources/changelog.md + - Contributing & Support: resources/contributing.md diff --git a/website/requirements.txt b/website/requirements.txt new file mode 100644 index 00000000..1f957055 --- /dev/null +++ b/website/requirements.txt @@ -0,0 +1,7 @@ +# Python dependencies for building the Hayabusa documentation site. +# Used by .github/workflows/docs.yml and for local previews: +# pip install -r website/requirements.txt +# mkdocs serve -f website/mkdocs.yml +mkdocs-material==9.7.6 +mkdocs-glightbox==0.5.2 +mkdocs-static-i18n==1.3.1 diff --git a/website/scripts/sync_changelog.py b/website/scripts/sync_changelog.py new file mode 100644 index 00000000..1e510381 --- /dev/null +++ b/website/scripts/sync_changelog.py @@ -0,0 +1,70 @@ +#!/usr/bin/env python3 +"""Regenerate the docs Changelog pages from the repo's CHANGELOG files. + +The Resources > Changelog pages mirror the root CHANGELOG.md / +CHANGELOG-Japanese.md. The docs deploy workflow runs this before `mkdocs build`; +the committed pages are a snapshot for local previews. + +Run from anywhere: python website/scripts/sync_changelog.py +""" +import os +import re + +ROOT = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))) +DOCS = os.path.join(ROOT, "website", "docs", "resources") + +NOTE_EN = ( + "!!! info\n" + " This page mirrors the project " + "[`CHANGELOG.md`](https://github.com/Yamato-Security/WELA/blob/main/CHANGELOG.md). " + "See the [Releases page](https://github.com/Yamato-Security/WELA/releases) for downloads." +) +NOTE_JA = ( + '!!! info "情報"\n' + " このページはプロジェクトの " + "[`CHANGELOG.md`](https://github.com/Yamato-Security/WELA/blob/main/CHANGELOG-Japanese.md) " + "を反映したものです。ダウンロードは " + "[リリースページ](https://github.com/Yamato-Security/WELA/releases) をご覧ください。" +) + +_LIST = re.compile(r'^([-*+]|\d{1,9}[.)])\s+\S') +_FENCE = re.compile(r'^\s*(```|~~~)') +_HEADING = re.compile(r'^#{1,6}\s') + + +def fix_tight_lists(text): + out, in_fence = [], False + for ln in text.split("\n"): + if _FENCE.match(ln): + in_fence = not in_fence + if not in_fence and _LIST.match(ln) and out: + p = out[-1] + if (p.strip() and not _LIST.match(p) and not _HEADING.match(p) + and not p.lstrip().startswith(">") and not p.lstrip().startswith("|") + and not re.match(r'^\s', p)): + out.append("") + out.append(ln) + return "\n".join(out) + + +def build(src, title, note, dest): + lines = open(src, encoding="utf-8").read().split("\n") + body = lines[1:] + while body and body[0].strip() == "": + body.pop(0) + content = f"# {title}\n\n{note}\n\n" + "\n".join(body) + content = fix_tight_lists(content).rstrip() + "\n" + with open(dest, "w", encoding="utf-8") as f: + f.write(content) + print("wrote", os.path.relpath(dest, ROOT)) + + +def main(): + build(os.path.join(ROOT, "CHANGELOG.md"), "Changelog", NOTE_EN, + os.path.join(DOCS, "changelog.md")) + build(os.path.join(ROOT, "CHANGELOG-Japanese.md"), "変更履歴", NOTE_JA, + os.path.join(DOCS, "changelog.ja.md")) + + +if __name__ == "__main__": + main()