Skip to content

Commit

Permalink
feat: add check to see if snort config exists in ossec.conf
Browse files Browse the repository at this point in the history
  • Loading branch information
MarantosGeorge committed Jan 29, 2025
1 parent a3aee91 commit 6844125
Showing 1 changed file with 10 additions and 1 deletion.
11 changes: 10 additions & 1 deletion scripts/windows/uninstall.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -118,13 +118,21 @@ function Uninstall-NpCap {
}

function Remove-Configuration {
# Restore the ossec.conf file if Snort-related changes were made
# Restore the ossec.conf file if Snort-related changes were made
InfoMessage "Removing Snort configuration from ossec.conf"

if (Test-Path -Path $ossecConfigPath) {
try {
[xml]$ossecConfig = Get-Content $ossecConfigPath -Raw
$snortNodes = $ossecConfig.ossec_config.localfile | Where-Object {
$_.log_format -eq "snort-full" -and $_.location -eq "C:\Snort\log\alert.ids"
}

if ($snortNodes.Count -eq 0) {
WarnMessage "No Snort configuration found in ossec.conf. Skipping removal."
return
}

foreach ($node in $snortNodes) {
$ossecConfig.ossec_config.RemoveChild($node) | Out-Null
}
Expand All @@ -138,6 +146,7 @@ function Remove-Configuration {
}
}


function Remove-ScheduledTask {

# Remove the Snort scheduled task
Expand Down

0 comments on commit 6844125

Please sign in to comment.