WELA (Windows Event Log Auditor) ゑ羅
---
# WELAについて
**WELA（Windows Event Log Analyzer、ゑ羅）** は、Windowsイベントログの設定とログサイズを監査するツールです。
Windowsイベントログは、DFIR（デジタルフォレンジックおよびインシデント対応）に不可欠な情報源であり、システムの動作やセキュリティイベントを可視化します。
**しかし、デフォルト設定では、不十分なログサイズ、監査設定によって、脅威の検知漏れを引き起こす**可能性があります。
WELAはこうした課題を洗い出し、Windowsイベントログ設定改善のための実用的な提案を行います。
また、**実際のSigmaルールの検知範囲に基づいてWindowsイベントログ設定を評価**し、現状の設定で何が検知できるかを把握できます。
# 関連プロジェクト
* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings) Yamato SecurityのWindowsイベントログ設定ガイド
* [EventLog-Baseline-Guide](https://github.com/Yamato-Security/EventLog-Baseline-Guide) Sigmaルールと主要なガイドにおける検知ギャップを可視化するツール
* [WELA-RulesGenerator](https://github.com/Yamato-Security/WELA-RulesGenerator) WELAのSigmaルール関連設定ファイルを生成するためのツール
# 目次
- [WELAについて](#WELAについて)
- [関連プロジェクト](#関連プロジェクト)
- [目次](#目次)
- [スクリーンショット](#スクリーンショット)
- [機能](#機能)
- [前提要件](#前提要件)
- [ダウンロード](#ダウンロード)
- [WELAの実行](#WELAの実行)
- [コマンド一覧](#コマンド一覧)
- [コマンド使用例](#コマンド使用例)
- [audit-settings](#audit-settings)
- [audit-filesize](#audit-filesize)
- [update-rules](#update-rules)
- [Windowsイベントログの監査設定に関するその他の参考資料](#Windowsイベントログの監査設定に関するその他の参考資料)
- [貢献](#貢献)
- [不具合の報告](#不具合の報告)
- [ライセンス](#ライセンス)
- [貢献者](#貢献者)
- [謝辞](#ジャ時)
- [X](#X)
# スクリーンショット
## Startup
## audit-settings (stdout)
## audit-settings (gui)
## audit-settings (table)
## audit-filesize
# 機能
- Audit Windows Event Log Audit policy settings.
- Checking **based on the major Windows Event Log Audit configuration guides**.
- Checking Windows Event Log audit settings based on **real-world Sigma rule detectability**.
- Audit Windows Event Log file sizes and suggest the recommended size.
# 前提要件
* PowerShell 5.1+
* Run PowerShell with Administrator privileges
# ダウンロード
Please download the latest stable version of WELA from the [Releases](https://github.com/Yamato-Security/wela/releases) page.
# WELAの実行
1. Unzip the [release zip file](https://github.com/Yamato-Security/wela/releases).
2. Open PowerShell with **Administrator privileges**.
3. `./WELA.ps1 help` to run WELA.
# コマンド一覧
- `audit-settings`: Check Windows Event Log audit policy settings.
- `audit-filesize`: Check Windows Event Log file size.
- `update-rules`: Update WELA's Sigma rules config files.
# コマンド使用例
## audit-settings
`audit-settings` command checks the Windows Event Log audit policy settings and compares them with the recommended settings from [Yamato Security](https://github.com/Yamato-Security/EnableWindowsLogSettings), [Microsoft(Sever/Client)](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations), and [Australian Signals Directorate (ASD)](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding).
RuleCount indicates the number of [Sigma rules](https://github.com/SigmaHQ/sigma) that can detect events within that category.
#### `audit-settings` command examples
Check by YamatoSecurity(Default) recommend setting and save to CSV:
```
./WELA.ps1 audit-settings
```
Check by Australian Signals Directorate recommend setting and save to CSV:
```
./WELA.ps1 audit-settings -BaseLine ASD
```
Check by Microsoft recommend setting (Server) and Display results in GUI:
```
./WELA.ps1 audit-settings -BaseLine Microsoft_Server -OutType gui
```
Check by Microsoft recommend setting (Client) and Display results in Table format:
```
./WELA.ps1 audit-settings -BaseLine Microsoft_Client -OutType table
```
## audit-filesize
`audit-filesize` command checks the Windows Event Log file size and compares it with the recommended settings from **Yamato Security**.
#### `audit-filesize` command examples
Check Windows Event Log file size by YamatoSecurity recommended settings and save to CSV:
```
./WELA.ps1 audit-filesize
```
## update-rules
#### `update-rulese` command examples
Update WELA's Sigma rules config files:
```
./WELA.ps1 update-rules
```
# Windowsイベントログの監査設定に関するその他の参考資料
* [A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why](https://www.splunk.com/en_us/blog/security/windows-audit-policy-guide.html)
* [Audit Policy Recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations)
* [Configure audit policies for Windows event logs](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection)
* [EnableWindowsLogSettings](https://github.com/Yamato-Security/EnableWindowsLogSettings)
* [Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding)
* [mdecrevoisier/Windows-auditing-baseline](https://github.com/mdecrevoisier/Windows-auditing-baseline)
* [palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding/tree/master/group-policy-objects)
# 貢献
We would love any form of contribution.
Pull requests, rule creation, and sample logs are the best, but feature requests notifying us of bugs, etc... are also very welcome.
At the least, **if you like our tools and resources, then please give us a star on GitHub and show your support!**
# 不具合の報告
* Please submit any bugs you find [here.](https://github.com/Yamato-Security/wela/issues/new?assignees=&labels=bug&template=bug_report.md&title=%5Bbug%5D)
* This project is currently actively maintained, and we are happy to fix any bugs reported.
# ライセンス
* WELA is released under [MIT License](https://opensource.org/licenses/MIT)
# 貢献者
* Fukusuke Takahashi (core developer)
* Zach Mathis (project leader, tool design, testing, etc...) (@yamatosecurity)
# 謝辞
* [Australian Cyber Security Centre: Windows event logging and forwarding](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding)
* [Microsoft: Advanced security auditing FAQ](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq)
* [SigmaHQ](https://github.com/SigmaHQ/sigma)
# X
You can receive the latest news about WELA, rule updates, other Yamato Security tools, etc... by following us on X at [@SecurityYamato](https://twitter.com/SecurityYamato).