Zafer Balkan zbalkan

Wazuh pain points

After I started to use Wazuh, around June 2022, I came across many pain points. Here, I recorded and grouped some of them together. There is no specific order, neither alphabetical nor by importance.

	$environments = @([EnvironmentVariableTarget]::Machine, [EnvironmentVariableTarget]::User)

	foreach ($e in $environments)
	{
	$path = ([Environment]::GetEnvironmentVariable('Path', $e)).Split(';', [StringSplitOptions]::RemoveEmptyEntries)
	$pathList = [System.Collections.Generic.List[string]]::new()
	foreach ($p in $path)
	{
	if(Test-Path -Path $p)
	{

	#Requires -RunAsAdministrator

	<#
	.Synopsis
	Generates Sysmon Archive file quota for `File Delete` events to help managing the size.
	.DESCRIPTION
	Based on: https://blog.nviso.eu/2022/06/30/enforcing-a-sysmon-archive-quota/
	.INPUTS
	None. Cmdlet does not accept pipe values.
	.OUTPUTS

	$officeFolder = Get-ChildItem -Path 'C:\Program Files\Microsoft Office\' -Filter Office* \| Select-Object -ExpandProperty Name
	$currentPath = 'C:\Program Files\Microsoft Office\'+$officeFolder+'\OneNote'
	$newPath = 'C:\Program Files\Microsoft Office\'+$officeFolder+'\OneNoteOLD'
	Rename-Item $currentPath $newPath


	$drivers = pnputil /enum-drivers
	$drivers -split '\r?\n' \| select-string -Pattern "prnms006.inf" -Context 1,0 \| % {
	$pubName = $_.Context.PreContext[0]
	}

	# Personal .nanorc config
	# Based on https://bash-prompt.net/guides/nanorc-settings/

	# Non-default settings
	set atblanks # wrap line at blanks.
	set cutfromcursor # CTRL+K cuts from cursor position to end of line.
	#set nohelp # Disable the help information (CTRL+G to view the help screen).
	set softwrap # Enable softwrap of lines.
	set suspend # Enables CTRL+Z to suspend nano.
	#set tabsize 4 # Sets tab-to-spaces size to 4.

	<#
	.Synopsis
	Script for creating WMI Filters for use with Group Policy Manager.
	.DESCRIPTION
	The Script will create several WMI Filters for filtering based on:
	- Processor Architecture.
	- If the Hosts is a Virtual Machine
	- Operating System Version.
	- Type of Operating System.
	- If Java is installed

Zafer Balkan zbalkan

Wazuh pain points

Table of Contents

Keybase proof

	<#
	.Synopsis
	Time-based One-Time Password Algorithm (RFC 6238)
	.DESCRIPTION
	Based on the script of Jon Friesen - https://gist.github.com/jonfriesen/234c7471c3e3199f97d5
	.EXAMPLE
	Get-OTP -Secret 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567' # Default OTP length is 6 digits and period is 30 seconds
	.EXAMPLE
	totp -Secret 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567' # you can use totp or otp alias
	.EXAMPLE