Recent changes to Home

WikiPage Home modified by khenkell

khenkell — Wed, 25 Apr 2012 19:37:37 -0000

--- v6 
+++ v7 
@@ -6,47 +6,47 @@
 Overview
 --------
 
-At its most basic level, SecPoshMon will be a collection of scripts running as scheduled tasks and using related powershell modules.  Reports and Alerts will be sent via email.  
-
-The underlying piece is the SPMServer which handles installing and removeing packages, monitoring the status, and providing common functions in a powershell module.  The SPM server may also handle some basic self integrity checking using external tools should you not have better tools available.
-
+At its most basic level, SecPoshMon will be one or more collection of scripts (SPM packages) running as scheduled tasks and using related powershell modules.  Reports and Alerts will be sent via email.  Events will be logged as to which scripts run when via a custom Event Log.
+
+The underlying piece is the SPMServer which handles installing and removing packages, monitoring the status, providing common functions in a powershell module, and providing access to some common variables.  The SPM server may also handle some basic self integrity checking using external tools should you not have better tools available.
+
 Packages are collections of scripts that are related.  Packages include scripts, a default schedule to run them, and any additional functions wrapped into a module.
 
 The Package Task is a single script set to run as recurring task.  The basic flow of the script is:
+
 1. Gather new data (for a specific purpose like "get a list of all applications")
-
 + Compare new data to the expected (read only) data.  Store deviations in a "needs investigation" array.
-
 + Compare new data to previous data.  Store deviations in a "needs investigation" array.
 + Send report
 + If anything is suspicious, send email alert.
 
+
 Components
 ==========
 
 
 Underlying Components
 ---------------------
 
 **Windows 2008 R2/Windows 7**
 
 SPM is targetting Windows 2008 and Windows 7 to run the system/scheduled tasks.  
 
 
 **Scheduled Tasks**
 
 SPM uses the builtin task scheduler included in Windows
 
 - SPM Has its own folder/container: 
     - \Task Scheduler\Task Scheduler Library\SecPoSHMon\
 
 **EventLogs**
 
 SPM  does all logging to the Windows Event Logs 
 
-- Has its own Event Log 
-- 1 Source for Server (SPMServer)
-- 1 source for each scheduled job (SPMJobName)
+- Has its own Event Log (SPMServer)
+- 1 Source for Server (SPMServer) 
+- 1 source for each scheduled job (SPMJobName) which will be registered during package installation
 - EventIDs 1-999 reserved for server
 - EventIDs 1000+ reserved for packaged content using published IDs.

WikiPage Home modified by khenkell

khenkell — Wed, 25 Apr 2012 19:30:57 -0000

--- v5 
+++ v6 
@@ -14,7 +14,9 @@
 
 The Package Task is a single script set to run as recurring task.  The basic flow of the script is:
 1. Gather new data (for a specific purpose like "get a list of all applications")
+
 + Compare new data to the expected (read only) data.  Store deviations in a "needs investigation" array.
+
 + Compare new data to previous data.  Store deviations in a "needs investigation" array.
 + Send report
 + If anything is suspicious, send email alert.

WikiPage Home modified by khenkell

khenkell — Wed, 25 Apr 2012 19:29:32 -0000

--- v4 
+++ v5 
@@ -1,65 +1,92 @@
-Design Overview
-===============
-
+SecPoshMon
+==========
+
 This page will go over the design of the SecPoshMon (SPM) system.  For the project plan, please see [ProjectPlan]
 
-Installer Script (New-SPMServerInstance.ps1)
---------------------------------------------
-
-The system will be self installing.  As the module will not be available, this will be a standalone script.
-
-
- See [InstallerScript]
-
-
-PowerShell Module
------------------
-
-The core of the system is a PowerShell V2 module containing all scripts required to setup and monitor the SPM system.  
-
-
-See [PowerShellModule]
-
-
-
-
-Packaged Content
-----------------
-
-Packaged Content (including the default content that will ship with the system) is a collection of scripts along with a schedule for running them.
-
-- Can be created as packages (zip?)
-- Set of default scripts with recommended schedules
-
-See [PackagedContentDesign]
-
-See also [PackagedContentSANS20CC]	
+Overview
+--------
+
+At its most basic level, SecPoshMon will be a collection of scripts running as scheduled tasks and using related powershell modules.  Reports and Alerts will be sent via email.  
+
+The underlying piece is the SPMServer which handles installing and removeing packages, monitoring the status, and providing common functions in a powershell module.  The SPM server may also handle some basic self integrity checking using external tools should you not have better tools available.
+
+Packages are collections of scripts that are related.  Packages include scripts, a default schedule to run them, and any additional functions wrapped into a module.
+
+The Package Task is a single script set to run as recurring task.  The basic flow of the script is:
+1. Gather new data (for a specific purpose like "get a list of all applications")
++ Compare new data to the expected (read only) data.  Store deviations in a "needs investigation" array.
++ Compare new data to previous data.  Store deviations in a "needs investigation" array.
++ Send report
++ If anything is suspicious, send email alert.
+
+Components
+==========
 
 
 Underlying Components
 ---------------------
 
 **Windows 2008 R2/Windows 7**
 
 SPM is targetting Windows 2008 and Windows 7 to run the system/scheduled tasks.  
 
 
 **Scheduled Tasks**
 
 SPM uses the builtin task scheduler included in Windows
 
 - SPM Has its own folder/container: 
     - \Task Scheduler\Task Scheduler Library\SecPoSHMon\
 
 **EventLogs**
 
 SPM  does all logging to the Windows Event Logs 
 
 - Has its own Event Log 
 - 1 Source for Server (SPMServer)
 - 1 source for each scheduled job (SPMJobName)
 - EventIDs 1-999 reserved for server
 - EventIDs 1000+ reserved for packaged content using published IDs.
+
+
+PowerShell Module
+-----------------
+
+The core of the system is a PowerShell V2 module containing all scripts required to setup and monitor the SPM system.  
+
+
+See [PowerShellModule]
+
+
+
+Packaged Content
+----------------
+
+Packaged Content (including the default content that will ship with the system) is a collection of scripts along with a schedule for running them.
+
+- Can be created as packages (zip?)
+- Set of default scripts with recommended schedules
+
+There will be 2 packages at release:
+
+1. SPMPAK_ServerSelfCheck
++ SPMPAK_SANS20CSC 
+
+See [PackagedContentDesign]
+
+See also [PackagedContentSANS20CC]	
+
+
+
+Installer Script (New-SPMServerInstance.ps1)
+--------------------------------------------
+
+The system will be self installing.  As the built in module will not be available, this will be a standalone script.
+
+
+ See [InstallerScript]
+
+
 
 [[project_admins]]
 [[download_button]]

WikiPage Home modified by khenkell

khenkell — Tue, 24 Apr 2012 21:33:56 -0000

--- v3 
+++ v4 
@@ -6,49 +6,50 @@
 Installer Script (New-SPMServerInstance.ps1)
 --------------------------------------------
 
-The system will be self installing.  The install script should be able to:
-
-- Copy the powershell module into the appropriate directories
-- Create directory in Program files
-- Copy all required files
-- Option to Add module to user's Profile
-- Copy documentation
-
+The system will be self installing.  As the module will not be available, this will be a standalone script.
+
+
  See [InstallerScript]
 
 
 PowerShell Module
 -----------------
 
 The core of the system is a PowerShell V2 module containing all scripts required to setup and monitor the SPM system.  
 
 
 See [PowerShellModule]
 
 
 
 
 Packaged Content
 ----------------
 
 Packaged Content (including the default content that will ship with the system) is a collection of scripts along with a schedule for running them.
 
 - Can be created as packages (zip?)
 - Set of default scripts with recommended schedules
 
-	
+See [PackagedContentDesign]
+
+See also [PackagedContentSANS20CC]	
 
 
 Underlying Components
 ---------------------
 
+**Windows 2008 R2/Windows 7**
+
+SPM is targetting Windows 2008 and Windows 7 to run the system/scheduled tasks.  
+
+
 **Scheduled Tasks**
 
-SPM uses the builtin task scheduler included in Windows 2008+ and Windows Vista+. 
+SPM uses the builtin task scheduler included in Windows
 
 - SPM Has its own folder/container: 
     - \Task Scheduler\Task Scheduler Library\SecPoSHMon\
-
 
 **EventLogs**

WikiPage Home modified by khenkell

khenkell — Tue, 24 Apr 2012 21:14:10 -0000

--- v2 
+++ v3 
@@ -1,78 +1,29 @@
 Design Overview
 ===============
 
-This page will go over the design of the system.  For the project plan, please see [ProjectPlan]
-
+This page will go over the design of the SecPoshMon (SPM) system.  For the project plan, please see [ProjectPlan]
+
 Installer Script (New-SPMServerInstance.ps1)
 --------------------------------------------
 
 The system will be self installing.  The install script should be able to:
 
 - Copy the powershell module into the appropriate directories
 - Create directory in Program files
 - Copy all required files
 - Option to Add module to user's Profile
 - Copy documentation
 
  See [InstallerScript]
 
 
 PowerShell Module
 -----------------
 
 The core of the system is a PowerShell V2 module containing all scripts required to setup and monitor the SPM system.  
 
 
 See [PowerShellModule]
-
-*New-SPMScheduledTask*
-
-- Select Script
-- Input Parameters
-- Select Schedule 
-- Create EventLog
-- Register Sources
-- Get credential
-- Schedule Task
-- Remove-SPMScheduledTask
-- Remove Scheduled Task
-- Export Event Log(s)
-- Remove Event Log
-
-
-*Get-SPMScheduledTask*
-
-- Gets a list of scheduled tasks under the SPM container
-
-
-*Invoke-SPMScheduledTask*
-
-- Runs the scheduled task now
-
-
-*New-SPMServerConfiguration*
-
-- Initial setup of configuration
-- Can overwrite exsiting configuration
-
-
-*Get-SPMServerConfiguration*
-
-- Gets the current configuration
-
-
-*Set-SPMServerConfiguration*
-
-- Modifies one or more attributes on the server configuration
-
-*New-SPMPackageConfiguration*
-
-- Takes a package of scripts and configures acording to the included schedule configuration file.
-
-
-*Remove SPMPackageConfiguration*
-
-- Takes a package of scripts and removes all scheduled tasks generated from that package.

WikiPage Home modified by khenkell

khenkell — Tue, 24 Apr 2012 21:12:54 -0000

--- v1 
+++ v2 
@@ -1,8 +1,113 @@
-Welcome to your wiki!
-
-This is the default page, edit it as you see fit. To add a new page simply reference it within brackets, e.g.: [SamplePage].
-
-The wiki uses [Markdown](/p/secposhmon/wiki/markdown_syntax/) syntax.
+Design Overview
+===============
+
+This page will go over the design of the system.  For the project plan, please see [ProjectPlan]
+
+Installer Script (New-SPMServerInstance.ps1)
+--------------------------------------------
+
+The system will be self installing.  The install script should be able to:
+
+- Copy the powershell module into the appropriate directories
+- Create directory in Program files
+- Copy all required files
+- Option to Add module to user's Profile
+- Copy documentation
+
+ See [InstallerScript]
+
+
+PowerShell Module
+-----------------
+
+The core of the system is a PowerShell V2 module containing all scripts required to setup and monitor the SPM system.  
+
+
+See [PowerShellModule]
+
+*New-SPMScheduledTask*
+
+- Select Script
+- Input Parameters
+- Select Schedule 
+- Create EventLog
+- Register Sources
+- Get credential
+- Schedule Task
+- Remove-SPMScheduledTask
+- Remove Scheduled Task
+- Export Event Log(s)
+- Remove Event Log
+
+
+*Get-SPMScheduledTask*
+
+- Gets a list of scheduled tasks under the SPM container
+
+
+*Invoke-SPMScheduledTask*
+
+- Runs the scheduled task now
+
+
+*New-SPMServerConfiguration*
+
+- Initial setup of configuration
+- Can overwrite exsiting configuration
+
+
+*Get-SPMServerConfiguration*
+
+- Gets the current configuration
+
+
+*Set-SPMServerConfiguration*
+
+- Modifies one or more attributes on the server configuration
+
+*New-SPMPackageConfiguration*
+
+- Takes a package of scripts and configures acording to the included schedule configuration file.
+
+
+*Remove SPMPackageConfiguration*
+
+- Takes a package of scripts and removes all scheduled tasks generated from that package.
+
+
+
+
+Packaged Content
+----------------
+
+Packaged Content (including the default content that will ship with the system) is a collection of scripts along with a schedule for running them.
+
+- Can be created as packages (zip?)
+- Set of default scripts with recommended schedules
+
+	
+
+
+Underlying Components
+---------------------
+
+**Scheduled Tasks**
+
+SPM uses the builtin task scheduler included in Windows 2008+ and Windows Vista+. 
+
+- SPM Has its own folder/container: 
+    - \Task Scheduler\Task Scheduler Library\SecPoSHMon\
+
+
+**EventLogs**
+
+SPM  does all logging to the Windows Event Logs 
+
+- Has its own Event Log 
+- 1 Source for Server (SPMServer)
+- 1 source for each scheduled job (SPMJobName)
+- EventIDs 1-999 reserved for server
+- EventIDs 1000+ reserved for packaged content using published IDs.
 
 [[project_admins]]
 [[download_button]]

WikiPage Home modified by khenkell

khenkell — Tue, 24 Apr 2012 20:22:26 -0000

Welcome to your wiki! This is the default page, edit it as you see fit. To add a new page simply reference it within brackets, e.g.: [SamplePage]. The wiki uses [Markdown](/p/secposhmon/wiki/markdown_syntax/) syntax. [[project_admins]] [[download_button]]