Cyberfortress Wazuh Defend

A collection of Python utilities and build artifacts used to package and sign small Windows helper applications for interacting with Wazuh and endpoint workflows. This repository contains tools for isolation handling, application registration, threat removal helpers, and desktop notifications.

Overview

• Purpose: Provide small Windows utilities (built into executables) to assist with Wazuh incident handling and endpoint operations.
• Components: isolation, reg-app, remove-threat, send-noti, windows-noti, and supporting signing/packaging scripts.

Features

• Example build outputs included under src/build/ for reference.
• Scripts and spec files for packaging with PyInstaller/Nuitka.
• Helper artifacts and manifests for signtool under tools/signtool/.

Requirements

• Python 3.8+ to run source scripts.
• Windows SDK or signtool.exe for signing binaries (recommended for production use).
• Build tools (PyInstaller, Nuitka) if rebuilding executables from sources.

Quick start

1. Explore the source folders: isolation/, reg-app/, remove-threat/, and send-noti/.

2. Run a script directly with Python (example):

   python isolation/isolation.py

3. To produce an executable, run your packager of choice (PyInstaller, Nuitka). Use src/build/ outputs as guidance.

Signing

Signing is optional for local testing but recommended for distribution. The repository includes helper manifests in tools/signtool/ and a local password file under secrets/ for private workflows.

Typical signing command (Windows):

signtool sign /fd SHA256 /a /f <YourCert.pfx> /p

Adjust parameters to your certificate and environment.

Repository layout

• isolation/ — isolation helper sources.
• reg-app/ — application registration helper.
• remove-threat/ — threat removal helper.
• send-noti/, windows-noti/ — notification utilities.
• src/build/ — packaged build artifacts and packaging logs.
• tools/signtool/ — manifests and helper files for signing.
• secrets/ — local signing password (keep secure and out of VCS).

Development notes

• Remove or secure secrets/ before sharing the repository publicly.
• Rebuild executables in a clean, controlled environment to avoid accidental inclusion of sensitive data.

License

See LICENSE file for details.