1+ $ErrorActionPreference = ' Stop'
2+ Import-Module vm.common - Force - DisableNameChecking
3+
4+ try {
5+ # set configurations
6+ $toolName = ' suricata'
7+ $category = VM- Get-Category ($MyInvocation.MyCommand.Definition )
8+ $toolDir = Join-Path ${Env: ProgramFiles} $toolName
9+ $executablePath = Join-Path $toolDir " $toolName .exe"
10+ $exeUrl = " https://www.openinfosecfoundation.org/download/windows/Suricata-7.0.10-1-64bit.msi"
11+ $sha256 = " b32a6ca8a793a603a23de307c83831c874099f50bbcd2710ee8325d69a49fb44"
12+
13+ $packageArgs = @ {
14+ toolName = $toolName
15+ category = $category
16+ filetype = " MSI"
17+ silentArgs = " /qn /norestart"
18+ executablePath = $executablePath
19+ url = $exeUrl
20+ sha256 = $sha256
21+ consoleApp = $true
22+ }
23+
24+ VM- Install-With - Installer @packageArgs
25+
26+ # delete default desktop shortcut
27+ $desktopShortcutPath = " ${Env: HomeDrive} \Users\*\Desktop\$toolName *.lnk"
28+ Remove-Item - Path $desktopShortcutPath - ErrorAction SilentlyContinue
29+
30+ # rules configuration and download
31+ $rulesXmlPath = " $ ( Split-Path - parent $MyInvocation.MyCommand.Definition ) /rules.xml"
32+ $rulesXml = [xml ](Get-Content $rulesXmlPath )
33+ $rulesDir = Join-Path $toolDir " rules" - Resolve
34+ $rules = $rulesXml.rules.rule
35+
36+ # tempdir for rules been added
37+ # rules are added to tempdir before been added to default rule folder as other default rules exist in default folder
38+ # rules filenames are needed for adding to config files
39+ $tempToolDir = Join-Path ${Env: TEMP} " $toolName .vm"
40+ $tempRuleDir = Join-Path $tempToolDir " rules"
41+
42+ foreach ($rule in $rules ) {
43+ VM- Write-Log " INFO" " Attempting to install rule: $ ( $rule.name ) "
44+ $filePath = Join-Path $tempToolDir ([System.IO.Path ]::GetFileName($rule.url ))
45+
46+ # create rule specific temp folder
47+ $tempRuleSpecificFolder = Join-Path $tempRuleDir $rule.name
48+ if (-not (Test-Path - Path $tempRuleSpecificFolder )) {
49+ New-Item - Path $tempRuleSpecificFolder - ItemType Directory
50+ }
51+ try {
52+ Invoke-WebRequest - Uri $rule.url - OutFile $filePath - ErrorAction Stop
53+ # If the rule url is of a zip archive (collection of multiple rule files)
54+ if ($filePath -like ' *.zip'
55+ VM- Write-Log " INFO" " ZIP file detected."
56+ Get-ChocolateyUnzip - FileFullPath $filePath - Destination $tempRuleSpecificFolder | Out-Null
57+
58+ # if the rule url is for only one rules file
59+ } elseif ($filePath -like ' *.rules'
60+ VM- Write-Log " INFO" " Rules file detected. Moving to $tempRuleSpecificFolder ..."
61+ Move-Item - Path $filePath - Destination $tempRuleSpecificFolder
62+
63+ # any other types of url resource is unsupported
64+ } else {
65+ throw " Unsupported file type: '$filePath '. Only .zip and .rule are allowed."
66+ }
67+ } catch {
68+ VM- Write-Log " WARN" " Failed rule: $filePath . Cause: $ ( $_.Exception.Message ) "
69+ }
70+ }
71+
72+ $allRuleFiles = Get-ChildItem - Path $tempRuleDir - Recurse - File - Filter * .rules
73+
74+ $rulesConfigPath = Join-Path $toolDir " suricata.yaml" - Resolve
75+ $rulesConfig = Get-Content - Path $rulesConfigPath
76+
77+ # collect the list of all existent rules
78+ $rulesList = $rulesConfig -split " `n " | Where-Object { $_.Trim () -match ' \.rules$' | ForEach-Object { $_.TrimStart (' -'
79+
80+ # index of the location in the yaml where `rule-files:` is specified
81+ $ruleFilesIndex = $null
82+ for ($i = 0 ; $i -lt $rulesConfig.Count ; $i ++ ) {
83+ if ($rulesConfig [$i ] -match ' ^rule-files:$'
84+ $ruleFilesIndex = $i
85+ break
86+ }
87+ }
88+ # If `rule-files:` was not found, throw an error
89+ if ($null -eq $ruleFilesIndex ) {
90+ throw " Line with 'rule-files:' string not found in the config file."
91+ }
92+
93+ # move all rule files in temp rule folder to the suricata rule folder
94+ # add rules to `suricata.yaml`
95+ VM- Write-Log " INFO" " Moving rule-files to $rulesDir ..."
96+ foreach ($ruleFile in $allRuleFiles ){
97+ Move-Item - Path $ruleFile.FullName - Destination $rulesDir - Force
98+ if (-not ($rulesList -contains $ruleFile.Name )){
99+ $newRuleLine = " - $ ( $ruleFile.Name ) "
100+ # add rule to config file
101+ $rulesConfig = $rulesConfig [0 .. $ruleFilesIndex ] + $newRuleLine + $rulesConfig [($ruleFilesIndex + 1 ).. ($rulesConfig.Length - 1 )]
102+ VM- Write-Log " INFO" " [+] Rule-file $ ( $ruleFile.Name ) added to $rulesDir . Added rule-file reference to config file."
103+ }
104+ else {
105+ VM- Write-Log " INFO" " [+] Rule-file $ ( $ruleFile.Name ) added to $rulesDir . Rule-file reference already exist in config file."
106+ }
107+ }
108+
109+ # Save the updated content back to the file
110+ $rulesConfig | Set-Content - Path $rulesConfigPath
111+ }
112+ catch {
113+ VM- Write-Log - Exception $_
114+ }
0 commit comments