EventLog-Baseline-Guide/.github/workflows/check-audit-asd.yml at 645b0cf35b7b4e7bde014ebc5927ad987c527a16 · Yamato-Security/EventLog-Baseline-Guide · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
name: Run WELA Audit(ASD)

on:
  schedule:
    - cron: '0 10 * * *'
  workflow_dispatch:

jobs:
  build:
    permissions:
      contents: write
    runs-on: windows-11-arm
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Checkout WELA repository
        uses: actions/checkout@v4
        with:
          repository: Yamato-Security/WELA
          path: WELA

      - name: Run auditpol command
        run: |
          auditpol /get /category:*

      - name: Run auditpol set command
        run: |
          cmd /c "auditpol /set /subcategory:{0CCE922B-69AE-11D9-BED3-505054503030} /success:disable /failure:disable"

      - name: Run configure bat(ASD)
        run: |
          cd bat
          ./ASD.bat

      - name: Run WELA.ps1 audit-settings(ASD)
        run: |
          cd WELA
          ./WELA.ps1 audit-settings -Baseline ASD

      - name: Move WELA result files (ASD)
        run: |
          cd WELA
          Copy-Item *.csv ../data/Australian_Signals_Directorate/ -Force

      - name: Delete WELA repo
        run: |
          Remove-Item -Recurse -Force WELA

      - name: Pull Git repo
        run: |
          git pull origin main

      - uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: Apply changes