trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

added pre and post checks for installations

Browse Source
This commit is contained in:
hhofs
2018-05-16 14:56:12 +02:00
parent 6f185b558a
commit 387682e809
15 changed files with 336 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
Vagrant/scripts/install-inputsconf.ps1
View File

@@ -1,16 +1,31 @@
# Purpose: Configures the inputs.conf for the Splunk forwarders on the Windows hosts
Write-Host "Setting up Splunk Inputs for Sysmon & osquery"
$inputsPath = "C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\inputs.conf"
$currentContent = get-content $inputsPath
$targetContent = get-content c:\vagrant\resources\splunk_forwarder\inputs.conf
Write-Host "Stopping the Splunk forwarder"
Stop-Service splunkforwarder
if ($currentContent -ne $targetContent)
{
Write-Host "Stopping the Splunk forwarder"
Stop-Service splunkforwarder
Write-Host "Deleting the default configuration"
Remove-Item $inputsPath
Write-Host "Deleting the default configuration"
Remove-Item $inputsPath
Write-Host "Copying over the custom configuration"
Copy-Item c:\vagrant\resources\splunk_forwarder\inputs.conf $inputsPath
Write-Host "Copying over the custom configuration"
Copy-Item c:\vagrant\resources\splunk_forwarder\inputs.conf $inputsPath
Write-Host "Starting the Splunk forwarder"
Start-Service splunkforwarder
Write-Host "Starting the Splunk forwarder"
Start-Service splunkforwarder
}
else
{
Write-Host "Splunk forwarder already configured. Moving on."
}
If ((Get-Service -name splunkforwarder).Status -ne "Running")
{
throw "splunkforwarder service was not running."
}
Write-Host "Splunk forwarder installation complete!"