Add some examples

Add examples for CmdShell, PowerShell, Registry, WMI probe types.
This commit is contained in:
Altana Tsedenova
2020-07-15 18:49:09 +03:00
committed by GitHub
parent 19754f989b
commit 912423193d
4 changed files with 204 additions and 0 deletions
@@ -0,0 +1,46 @@
{
"schemaVersion": "1.0",
"name": "CmdShell check",
"version": "1.0.0",
"rules": [
{
"id": "DirectoryCheck",
"itemType": "definition",
"target": {
"type": "Server",
"platform": "Windows",
"engineEdition": "OnPremises",
"version": "[11.0,)"
},
"displayName": "CmdShell probe",
"description": "This is an example of cmdshell probe type. ",
"message": "Empty list",
"level": "Warning",
"condition": "@stdout",
"probes": [
"ListOfDirectoryFilesAndSubdirectories"
]
},
{
"id": ["DefaultRuleset"],
"itemType": "override",
"enabled": false
}
],
"probes": {
"ListOfDirectoryFilesAndSubdirectories": [
{
"type": "CmdShell",
"target": {
"type": "Server",
"platform": "Windows",
"engineEdition": "OnPremises",
"version": "[11.0,)"
},
"implementation": {
"command": "dir"
}
}
]
}
}
@@ -0,0 +1,47 @@
{
"schemaVersion": "1.0",
"name": "NO NAME",
"version": "1.0.0",
"rules": [
{
"id": "PowerShellVersion",
"itemType": "definition",
"target": {
"type": "Server",
"platform": "Windows",
"engineEdition": "OnPremises",
"version": "[11.0,)"
},
"displayName": "PowerShell host information",
"description": "Information about the PowerShell console host ",
"message": "Upgrade ps version to latest one. Current major version is @{Output.Version}, latest is @{latestVersion}.",
"level": "Warning",
"latestVersion": "7.0.2",
"condition": {
"eq": [
"@Output.Version",
"@latestVersion"
]
},
"probes": [
"PowershellHostInformation"
]
}
],
"probes": {
"PowershellHostInformation": [
{
"type": "PowerShell",
"target": {
"type": "Server",
"platform": "Windows",
"engineEdition": "OnPremises",
"version": "[11.0,)"
},
"implementation": {
"command": "Get-Host"
}
}
]
}
}
@@ -0,0 +1,52 @@
{
"schemaVersion": "1.0",
"name": "Registry check",
"version": "1.0.0",
"rules": [
{
"id": "ComputerNameRule",
"itemType": "definition",
"target": {
"type": "Server",
"platform": "Windows",
"engineEdition": "OnPremises",
"version": "[11.0,)"
},
"displayName": "Computer name",
"description": "Computer name couldn't be empty. ",
"message": "Set the computer name, because it couldn't be empty.",
"level": "Warning",
"condition": "@ComputerName",
"probes": [
"ComputerName"
]
},
{
"id": ["DefaultRuleset"],
"itemType": "override",
"enabled": false
}
],
"probes": {
"ComputerName": [
{
"type": "Registry",
"target": {
"type": "Server",
"platform": "Windows",
"engineEdition": "OnPremises",
"version": "[11.0,)"
},
"implementation": {
"query": {
"HKEY_LOCAL_MACHINE": {
"SYSTEM\\CurrentControlSet\\Control\\ComputerName\\ComputerName": [
"ComputerName"
]
}
}
}
}
]
}
}
@@ -0,0 +1,59 @@
{
"schemaVersion": "1.0",
"name": "WMI check",
"version": "1.0.0",
"rules": [
{
"id": "Win32Volume",
"itemType": "definition",
"target": {
"type": "Server",
"platform": "Windows",
"engineEdition": "OnPremises",
"version": "[11.0,)"
},
"displayName": "Block size",
"description": "This is an example of using WMI query.",
"message": "Format volume @{Output.Name} to recommended block size of 64KB. Current size is @{Output.BlockSize} bytes",
"level": "Warning",
"BlockSize": 65536,
"condition": {
"or": [
{
"not": "@Output.Name"
},
{
"eq": [
"@Output.BlockSize",
"@BlockSize"
]
}
]
},
"probes": [
"Win32Volumes"
]
},
{
"id": ["DefaultRuleset"],
"itemType": "override",
"enabled": false
}
],
"probes": {
"Win32Volumes": [
{
"type": "WMI",
"target": {
"type": "Server",
"platform": "Windows",
"engineEdition": "OnPremises",
"version": "[11.0,)"
},
"implementation": {
"query": "SELECT Name, BlockSize FROM Win32_Volume WHERE Capacity <> NULL"
}
}
]
}
}