EventLog-Baseline-Guide/.github/workflows/check-audit-yamatosecurity.yml at 83f8d2364d5176bd2c207d29dce4c6f82e8b99f5 · Yamato-Security/EventLog-Baseline-Guide · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
name: Run WELA Audit(YamatoSecurity)

on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:

jobs:
  build:
    permissions:
      contents: write
    runs-on: windows-11-arm
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Checkout WELA repository
        uses: actions/checkout@v4
        with:
          repository: Yamato-Security/WELA
          path: WELA

      - name: Run auditpol command
        run: |
          auditpol /get /category:*

      - name: Run auditpol set command
        run: |
          cmd /c "auditpol /set /subcategory:{0CCE922B-69AE-11D9-BED3-505054503030} /success:disable /failure:disable"

      - name: Run WELA.ps1 audit-settings(YamatoSecurity)
        run: |
          cd WELA
          ./WELA.ps1 audit-settings -Baseline YamatoSecurity

      - name: Run WELA.ps1 audit-filesize(YamatoSecurity)
        run: |
          cd WELA
          ./WELA.ps1 audit-filesize -Baseline YamatoSecurity

      - name: Move WELA result files (Default)
        run: |
          cd WELA
          Copy-Item *.csv ../data/Windows_Default/ -Force

      - name: Delete WELA repo
        run: |
          Remove-Item -Recurse -Force WELA

      - name: Pull Git repo
        run: |
          git pull origin main

      - uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: Apply changes

      - name: Checkout WELA repository
        uses: actions/checkout@v4
        with:
          repository: Yamato-Security/WELA
          path: WELA

      - name: Run configure bat(YamatoSecurity)
        run: |
          cd bat
          ./YamatoSecurity.bat

      - name: Run WELA.ps1 audit-settings
        run: |
          cd WELA
          ./WELA.ps1 audit-settings -Baseline YamatoSecurity

      - name: Run WELA.ps1 audit-filesize
        run: |
          cd WELA
          ./WELA.ps1 audit-filesize -Baseline YamatoSecurity

      - name: Move WELA result files (YamatoSecurity)
        if: ${{ matrix.os == 'windows-2025' }}
        run: |
          cd WELA
          Copy-Item *.csv ../data/YamatoSecurity/ -Force

      - name: Delete WELA repo
        run: |
          Remove-Item -Recurse -Force WELA

      - name: Pull Git repo
        run: |
          git pull origin main

      - uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: Apply changes