From 684412545af1559623d6ad2a1c07c6143d9c2a82 Mon Sep 17 00:00:00 2001
From: MarantosGeorge <marantosgeorge@gmail.com>
Date: Wed, 29 Jan 2025 09:49:16 +0200
Subject: [PATCH] feat: add check to see if snort config exists in ossec.conf

---
 scripts/windows/uninstall.ps1 | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/scripts/windows/uninstall.ps1 b/scripts/windows/uninstall.ps1
index b2e6ada..5a707af 100644
--- a/scripts/windows/uninstall.ps1
+++ b/scripts/windows/uninstall.ps1
@@ -118,13 +118,21 @@ function Uninstall-NpCap {
 }
 
 function Remove-Configuration {
-        # Restore the ossec.conf file if Snort-related changes were made
+    # Restore the ossec.conf file if Snort-related changes were made
+    InfoMessage "Removing Snort configuration from ossec.conf"
+    
     if (Test-Path -Path $ossecConfigPath) {
         try {
             [xml]$ossecConfig = Get-Content $ossecConfigPath -Raw
             $snortNodes = $ossecConfig.ossec_config.localfile | Where-Object {
                 $_.log_format -eq "snort-full" -and $_.location -eq "C:\Snort\log\alert.ids"
             }
+
+            if ($snortNodes.Count -eq 0) {
+                WarnMessage "No Snort configuration found in ossec.conf. Skipping removal."
+                return
+            }
+
             foreach ($node in $snortNodes) {
                 $ossecConfig.ossec_config.RemoveChild($node) | Out-Null
             }
@@ -138,6 +146,7 @@ function Remove-Configuration {
     }
 }
 
+
 function Remove-ScheduledTask {
 
     # Remove the Snort scheduled task