1+ $ErrorActionPreference = ' Stop'
2+ Import-Module vm.common - Force - DisableNameChecking
3+ Import-Module powershell- yaml
4+
5+ # set configurations
6+ $toolName = " Suricata"
7+ $category = VM- Get-Category ($MyInvocation.MyCommand.Definition )
8+ $filetype = " MSI"
9+ $toolDir = Join-Path ${Env: ProgramFiles} $toolName
10+ $executablePath = Join-Path $toolDir " suricata.exe"
11+ $url = " https://www.openinfosecfoundation.org/download/windows/Suricata-7.0.8-1-64bit.msi"
12+ $sha256 = " 8bdd78d2978e4efc6d23ab1ced024342cac7d38afb152a6e3f70ac5182bd8cd4"
13+ $silentArgs = " /qn /norestart"
14+
15+ $packageArgs = @ {
16+ toolName = $toolName
17+ category = $category
18+ filetype = $filetype
19+ silentArgs = $silentArgs
20+ executablePath = $executablePath
21+ url = $url
22+ sha256 = $sha256
23+ consoleApp = $true
24+ }
25+
26+ # download msi file
27+ VM- Install-With - Installer @packageArgs
28+ VM- Assert-Path $executablePath
29+
30+ # delete default desktop shortcut
31+ try {
32+ $desktopShortcutPath = " ${Env: HomeDrive} \Users\*\Desktop\$toolName *.lnk"
33+ Remove-Item - Path $desktopShortcutPath - ErrorAction SilentlyContinue
34+ }
35+ catch {
36+ VM- Write-Log - Exception $_
37+ }
38+
39+ # rules configuration and download
40+ $rulesXmlPath = " $ ( Split-Path - parent $MyInvocation.MyCommand.Definition ) /rules.xml"
41+ $rulesXml = [xml ](Get-Content $rulesXmlPath )
42+
43+ $rulesDir = Join-Path $toolDir " rules" - Resolve
44+ $rulesConfigPath = Join-Path $toolDir " suricata.yaml" - Resolve
45+
46+ $rulesConfig = ConvertFrom-Yaml (Get-Content - Raw - Path $rulesConfigPath )
47+
48+ $failures = @ ()
49+ $rules = $rulesXml.rules.rule
50+
51+ $tempToolDir = Join-Path ${Env: TEMP} $toolName
52+ $tempToolDir += " .vm"
53+ $tempRuleDir = Join-Path $tempToolDir " rules"
54+
55+ foreach ($rule in $rules ) {
56+
57+ Write-Host " [+] Attempting to install rule: $ ( $rule.name ) "
58+
59+ $filePath = Join-Path $tempToolDir ([System.IO.Path ]::GetFileName($rule.url ))
60+
61+ try {
62+ Invoke-WebRequest - Uri $rule.url - OutFile $filePath
63+
64+ # If the file ends in .zip, unzip it
65+ if ($filePath -like ' *.zip'
66+
67+ Write-Host " ZIP file detected."
68+
69+ Get-ChocolateyUnzip - FileFullPath $filePath - Destination $tempRuleDir
70+
71+ # if rules are present in innerFolder of zip archive
72+ if ($rule.innerFolder ){
73+ $innerFolder = Join-Path $tempRuleDir $rule.innerFolder
74+
75+ Get-ChildItem - Path $innerFolder - File | ForEach-Object {
76+ Copy-Item - Path $_.FullName - Destination $tempRuleDir - Force
77+ }
78+ }
79+
80+ } elseif ($filePath -like ' *.rules'
81+
82+ Write-Host " Rules file detected. Moving to $tempRuleDir ..."
83+
84+ Move-Item - Path $filePath - Destination $tempRuleDir
85+
86+ } else {
87+ throw " `t [!] Unsupported file type: '$filePath '. Only .zip and .rule are allowed."
88+ }
89+ } catch {
90+ $failures += $rule.name
91+ }
92+ }
93+
94+ $allRuleFiles = Get-ChildItem - Path $tempRuleDir - Recurse - File - Filter * .rules
95+
96+ # move all rule files in temp rule folder to the suricata rule folder
97+ # add rules to `suricata.yaml`
98+ foreach ($ruleFile in $allRuleFiles ){
99+ Move-Item - Path $ruleFile.FullName - Destination $rulesDir - Force
100+ if (-not ($rulesConfig .' rule-files' -contains $ruleFile.Name )){
101+ $rulesConfig .' rule-files' += $ruleFile.Name
102+ }
103+ Write-Host " `t [+] Rule $ ( $ruleFile.Name ) added to $rulesDir ..."
104+ }
105+
106+ $rulesConfig | ConvertTo-Yaml | Set-Content - Path $rulesConfigPath
107+
108+ # display all errors
109+ if ($failures.Count -gt 0 ) {
110+ foreach ($module in $failures ) {
111+ VM- Write-Log " ERROR" " Failed to install rule: $ ( $rule.name ) "
112+ }
113+ exit 1
114+ }
0 commit comments