WDACConfig parse evtx log file

[ssentanoe]

Hi, is it possible for the WDACConfig to parse external evtx file?
I'm asking because we are targeting WDAC to a windows server 2022, and unfortunetaly, I can't install WDACConfig on windows server 2022. So, I'm using Win 11, but WDACConfig can't parse external file (yet)

I saw a discussion here mentioned that I should able to run WDACConfig on windows server: #120

do you have any precise version?

[HotCakeX]

Hi,
the next update of the WDACConfig module will add evtx file support to the ConvertTo-WDACPolicy cmdlet, for now it only supports local logs or MDE Advanced Hunting logs.

Until the update is released, you can try out WDAC Wizard that offers evtx log parsing.
https://webapp-wdac-wizard.azurewebsites.net/

[ssentanoe]

Hi,

Thank you for your information.
Will it have the same capability as what you showed on your youtube video: https://youtu.be/oyz0jFzOOGA?feature=shared&t=601 ?

That part is really helpful, because it is not possible in WDAC Wizard to know who invoke what.
And some of our installed application generated a tmp file, and execute that tmp file.

[HotCakeX]

I understand, yes, the experience will be the same. It's a unified workflow for local logs, etvx logs or MDE logs. All 3 sources support Code Integrity logs + App Locker logs, audit + blocked logs.

You will be able to see which executable is responsible for running a file that resulted in an Audit or Blocked event to be generated.

[ssentanoe]

that would be really awesome, looking forward to it!
No pressure, but any approximate ETA?

[HotCakeX]

Will be few days from now!

[HotCakeX]

Good news, the feature you requested is available now 🙂

Just run any of the module's cmdlets and it will auto-update it for you

https://github.com/HotCakeX/Harden-Windows-Security/releases/tag/WDACConfigv0.3.7

[ssentanoe]

thank you, I will test it today!

[HotCakeX]

You're welcome ^^ let me know how it goes!

[ssentanoe]

It works really nice!, I can generate supplemental policy really quickly!

I sometimes still use together with WDAC Wizard to remove policy / switch audit on-off.

But, overall, awesome job! thanks! If I found something that can be improved, I will let you know!

[HotCakeX]

Glad to know that ^^
sounds good!