Skip to content

Commit

Permalink
Add grammatical improvements to LME (#239)
Browse files Browse the repository at this point in the history
* Add a markdown file for dashboard descriptions, link new file in README.md (#138)

* Add a markdown file for dashboard descriptions

## 🗣 Description ##

<!-- Describe the "what" of your changes in detail. -->

Add dashboard-descriptions.md in /docs/markdown/reference.
Add a link to this file within the main README.md's table of contents.

### 💭 Motivation and context 

<!-- Why is this change required? -->
<!-- What problem does this change solve? How did you solve it? -->
<!-- Mention any related issue(s) here using appropriate keywords such -->
<!-- as "closes" or "resolves" to auto-close them on merge. -->

The LME repository does not have a location for dashboard descriptions.

## 🧪 Testing 

<!-- How did you test your changes? How could someone else test this PR? -->
<!-- Include details of your testing environment, and the tests you ran to -->
<!-- see how your change affects other areas of the code, etc. -->

N/A

## ✅ Pre-approval checklist ##

- [x] Changes are limited to a single goal **AND** 
      the title reflects this in a clear human readable format
- [x] I have read and agree to LME's [CONTRIBUTING.md](https://github.com/cisagov/LME/CONTRIBUTING.md) document.
- [x] The PR adheres to LME's requirements in [RELEASES.md](https://github.com/cisagov/LME/RELEASES.md#steps-to-submit-a-PR)
- [x] These code changes follow [cisagov code standards](https://github.com/cisagov/development-guide).
- [x] All relevant repo and/or project documentation has been updated to reflect the changes in this PR.

## ✅ Post-merge Checklist

- [x] Squash all commits into one PR level commit 
- [x] Delete the branch to keep down number of branches

* Update README.md to include dashboard-descriptions.md

* Update wording for computer software overview dashboard

* Fix some grammatical changes in dashboard-descriptions.md

* Release 1.3.1 merge into main  (#154)

* Update retention function to fix retention policy bug (#143)

* Updated troubleshooting guide to account for index management (#134)

* Update upgrading.md to account for 1.3.1 (#151)

* Update upgrading.md

* Update upgrading.md

---------

Co-authored-by: Andrew Arz <149685528+aarz-snl@users.noreply.github.com>

* Fixes dashboard update not importing on fresh install (#167) (#169)

* Fixes dashboard update not importing on fresh install
#165

* Update upgrading.md to include status on v1.3.2, along with revisions to the document overall

* remove step 4 from upgrading.md; add additional instructions for v1.3.2

---------

Co-authored-by: Clint Baxley <c.baxley-ctr@ecstech.com>
Co-authored-by: Clint Baxley <clint.baxley-ctr@ecstech.com>

* Add proof of concept selenium tests

* Correct the script name in the doc string

* User Security Selenium Tests for No Results Panels

* First full selenium test. Currently just User Security

* WIP User HR

* Completed all dashboards. Requires testing now

* Cut dev comments

Co-authored-by: Alden Hilton <106177711+adhilto@users.noreply.github.com>

* Debugging a couple unit tests that error out. Two left

* Install LME in the testbed from a single script (#150)

* Adding the configure scripts

* Add scripts to zip and copy to a container for downloading in the server

* Grab the expiry time properly in copy file

* Overwrite the blob if it exists

* Add the script to download file into DC

* Script that unzips the files in a container

* Adds username argument to download files

* Add script to run scripts in container

* Adds username argument to gpo script

* Modifies the url name in the client GPO

* Adds the functionality for chapter 1 and first half of chapter 2

* Imports the sysmon GPO

* Update the variables for sysmon gpo

* Name the scripts so they are grouped together in a listing

* Echos the file download url

* Expands the domain name correctly in create ou

* Write the url output of copy file to container to a different output stream

* Create a new LME folder for our scripts and files

* Set path for extract to lme

* Update paths for scripts to /lme

* Fix the wec server name setting

* Adds the scripts to install chapter 1 and 2

* Allows azure to download in linux and windows

* Adds linux install scripts.

* Adds winlogbeat installer

* emove garbage in update server name

* Tweak several scripts to get the scp of files_for_windows

* Adds installer script to run all the scripts

* Fixes the formatting method for az output

* Clean up the scripts and add documentation

* Fixes outputting format errors

* Fixes hanging on adding ls1 to domain

* Fix formatting errors on responses

* Update linux expect script for different prompts.

* Handle the reboot message for linux expect script

* Echos the file download url

* Create a new LME folder for our scripts and files

* Set path for extract to lme

* Update paths for scripts to /lme

* Update paths for scripts to /lme

* Fix the wec server name setting

* Adds the scripts to install chapter 1 and 2

* Allows azure to download in linux and windows

* Adds linux install scripts.

* Adds winlogbeat installer

* emove garbage in update server name

* Tweak several scripts to get the scp of files_for_windows

* Adds installer script to run all of the scripts

* Fixes the formatting method for az output

* Clean up the scripts and add documentation

* Fixes outputting format errors

* Fixes hanging on adding ls1 to domain

* Fix formatting errors on responses

* Update linux expect script for different prompts.

* Handle the reboot message for linux expect script

* Adds InstallTestbed instructions to Readme.md

* Modifies parameters to be pascal case

* ls1 not being set on DC1

* Adds Linux Only install to SetupTestbed

* Remove separate linux only script

* Update testing/Readme.md

Co-authored-by: Alden Hilton <106177711+adhilto@users.noreply.github.com>

* Make number of clients consisten between scripts

* Add ports for elk stack for testing

* Update readmes to change ResourceGroupName to ResourceGroup

* Adds a switch to install linux only

* Adds simple tests to check install

* Removes the error if the old configure zip is not found.

* Adds variables to linux tests run command

* Move credential extraction to lib for use by other scripts.

* Adds npm for other testing

* Adds latest version of nodejs for testing

* Make output.log readable for tests

* Add the -m parameter in the testing readme

* Download the latest version or a specified version

* Reboot for 1.3.0

* Notes that we could have different expect scripts

* Put back in the restart after all of the domain updates

* Scp uses ls1 instead of ls1.lme.local

* Up the timeout of the adding ls1.lme.local

* Up the timeout of the adding ls1.lme.local

* Fixes chmod of the output.log for tests

* Adds venv to the gitignore

* Adds the ability to pass a branch to the installer

* Remove node installer

* Change timeout in expect script for slow connections

* Make shell files executable

---------

Co-authored-by: Clint Baxley <clint.baxley-ctr@ecstech.com>
Co-authored-by: Alden Hilton <106177711+adhilto@users.noreply.github.com>

* Fix deploy.sh data retention failure error  (#190)

* Fix deploysh data retention failure (#179)

* Update deploy.sh

* Update deploy.sh

* Update deploy.sh

* Update deploy.sh

* Remove free (#188)

* changed the word free to no-cost or no-cost to users

* rephrased wording to 'which comes at no cost to users'

---------

Co-authored-by: Linda Lovero-Waterhouse <l.lovero-waterhouse@ecstech.com>

* Update upgrading.md with data retention failure resolution (#189)

---------

Co-authored-by: Andrew Arz <149685528+aarz-snl@users.noreply.github.com>
Co-authored-by: Linda Waterhouse <82845774+llwaterhouse@users.noreply.github.com>
Co-authored-by: Linda Lovero-Waterhouse <l.lovero-waterhouse@ecstech.com>

* Automatically Add Tags to Azure Resources (#186)

* Add tags to all Azure resource creations calls

---------

Co-authored-by: Clint Baxley <c.baxley-ctr@ecstech.com>

* Switched script to headless mode

* added switch for headless, detached, and debug mode. Bug where driver.quit does not close window.

* Refactored long line and added switch for debug mode

* Removed unnecessary comments

* Update pull_request_template.md (#198)

* Update pull_request_template.md

Moved Squash commits from post-merge to pre-merge.

* overriding default PR template for preferred LME template

* overriding default PR template for preferred LME template

* updating issue template to shorten the template

---------

Co-authored-by: mreeve-snl <mreeve@sandia.gov>

* Python testbed setup (#183)

* Add simple tests for http requests

* Add an env file to gitignore

* Remove unneeded pip install

* Hide pytest_cache

* Add pycache to gitignore

* Adds dev containers for vscode

* Adds testing information for vscode

* Uses .env file for tests if present

* Adds env example file

* Modify development container name

* Adds readme for the testing environment

* Add simple tests for http requests

* Add an env file to gitignore

* Remove unneeded pip install

* Adds dev containers for vscode

* Adds testing information for vscode

* Uses .env file for tests if present

* Adds env example file

* Modify development container name

* Adds readme for the testing environment

* Create helpers and conftest for python tests

* Setup for using test explorer in the dev environment

* Adding azure shell requirements to docker image

* Adding Python API tests

* Merges additional tests

* Made changes to fix tests that were failing

* Separate linux only tests from others

* Create a workflow for building test environments

* Make the docker user be the same as the vbox user id

* Set up to run the installer in docker

* Pick up different fs types in data_retention

* Change the build path for building lme container

* Install lme after build

* Make lme installer executable

* Set up the build for tests

* Add the cluster workflow for github actions

---------

Co-authored-by: Clint Baxley <clint.baxley-ctr@ecstech.com>
Co-authored-by: Rishi <rishi.aggarwal@associates.cisa.dhs.gov>

* Update PULL_REQUEST_TEMPLATE.md (#206)

Added instruction to select Issue in Development area so that the corresponding Issue is automatically closed when the PR is merged.

* Made changes to facilitate HTML Reports on test execution  (#211)

* Made changes to requirements.txt, ReadMe and gitignore to facilitate HTML reporting

* Fixed Typos on Readme

* Fixed Typos on Readme

* removed tags flag from nsg because it was preventing some rules from being created (#214)

Co-authored-by: Linda Lovero-Waterhouse <l.lovero-waterhouse@ecstech.com>

* Update PULL_REQUEST_TEMPLATE.md (#217)

Using keywords like "fixes" or "closes"  only auto-closes the corresponding issue if the PR is going to be merged into main.  

For PR's merged into release branches, we need to add the issue to the development box in the right sidebar in order to auto-close the issue.  

Added some documentation to clarify this.

* Create new workflow for automating the release process (#199)

* Update chapter4.md

* Update bug-or-error-report.md

Grammatical changes

* Update feature_request.md

grammatical changes

* Update PULL_REQUEST_TEMPLATE.md

punctuation changes

* Update Readme.md

grammatical changes

* Update chapter2.md

grammatical update

* Update chapter4.md

grammatical changes

* Update prerequisites.md

grammatical changes

* Update CONTRIBUTING.md

grammatical changes

* Update README.md

grammatical changes

* Update RELEASES.md

grammatical changes

* Update Readme.md

Grammtical changes

* Update Readme.md

more changes

* Update README.md

grammatical updates

* Update README.md

sentence updates

* Update CONTRIBUTING.md

changes

* Update RELEASES.md

comma changes

* Update RELEASES.md

grammar updates

* Update Readme.md

grammar changes

* Update chapter4.md

* Update faq.md

* Update troubleshooting.md

some small grammar changes

* Update prerequisites.md

verb changes

* Update chapter1.md

grammatical updates and changes

* Update guide_to_ous.md

updates

* Update chapter3.md

sentence structure changes and grammar updates

* Update resilience.md

removing passive voice

* Update filtering.md

sentence fixes

* Update retention.md

plural fixes

* Update other-logging.md

grammar changes

* Update backups.md

Grammatical changes

* Update certificates.md

grammar changes and sentence updates

* Update upgrading.md

sentence rewrites

* added modifications per Dan Cernoch

* small clarifications

* small clarifications added

* minor grammatical edits

* Update prerequisites.md

sentence changes

* Update chapter4.md

grammar updates and some changes

* Update troubleshooting.md

* Update CONTRIBUTING.md

* Update README.md

* Update Readme.md

* Update chapter1.md

* Update guide_to_ous.md

* Update chapter3.md

* Update upgrading.md

grammar fixes

* Update certificates.md

removing passive voice

* Update backups.md

removing passive voice

---------

Co-authored-by: Andrew Arz <149685528+aarz-snl@users.noreply.github.com>
Co-authored-by: Clint Baxley <c.baxley-ctr@ecstech.com>
Co-authored-by: Clint Baxley <clint.baxley-ctr@ecstech.com>
Co-authored-by: Alden Hilton <adhilto@sandia.gov>
Co-authored-by: unknown <admin.ackbar@LME.LOCAL>
Co-authored-by: Grant (SNL) <108766839+rgbrow1949@users.noreply.github.com>
Co-authored-by: Alden Hilton <106177711+adhilto@users.noreply.github.com>
Co-authored-by: Linda Waterhouse <82845774+llwaterhouse@users.noreply.github.com>
Co-authored-by: Linda Lovero-Waterhouse <l.lovero-waterhouse@ecstech.com>
Co-authored-by: Brown <rgbrow@sandia.gov>
Co-authored-by: mreeve-snl <mreeve@sandia.gov>
Co-authored-by: Rishi <rishi.aggarwal@associates.cisa.dhs.gov>
Co-authored-by: rishagg01 <149525835+rishagg01@users.noreply.github.com>
Co-authored-by: BDCISA <165040139+BDCISA@users.noreply.github.com>
Co-authored-by: Christopher Morris <145709060+cisamorris@users.noreply.github.com>
  • Loading branch information
16 people committed Jun 4, 2024
1 parent 008cba2 commit 61a1e68
Show file tree
Hide file tree
Showing 25 changed files with 207 additions and 212 deletions.
36 changes: 24 additions & 12 deletions .github/ISSUE_TEMPLATE/bug-or-error-report.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,24 +10,38 @@ assignees: ''
## **BEFORE CREATING THE ISSUE, CHECK THE FOLLOWING GUIDES**:
- [ ] [FAQ](https://github.com/cisagov/LME/blob/main/docs/markdown/reference/faq.md)
- [ ] [Troubleshooting](https://github.com/cisagov/LME/blob/main/docs/markdown/reference/troubleshooting.md)
- [ ] Search current/closed issues for similar questions, and utilize github/google search to see if an answer exists for the error I'm encountering.
- [ ] Search current/closed issues for similar questions and utilize github/google search to see if an answer exists for the error you are encountering.

If the above did not answer your question, proceed with creating an issue below:

## Describe the bug
<!-- A clear and concise description of what the bug is. -->
<!-- A clear and concise description of what the software flaw you are experiencing looks like, or what the behavior is. -->

## Expected behavior
A clear and concise description of what you expected to happen.

## To Reproduce
<!-- Steps to reproduce the behavior. These should be clear enough that our team can understand your running environment, software/operating system versions, and anything else we might need to debug the issue. -->
<!-- Steps to reproduce the behavior. These should be clear enough that our team can understand your running environment, software/operating system versions and anything else we might need to debug the issue. -->
<!-- Good examples can be found here: [Issue 1](https://github.com/cisagov/LME/issues/15) [Issue 2](https://github.com/cisagov/LME/issues/19). -->

### Please complete the following information
#### **Desktop:**
- OS: [e.g. Windows 10]
- Browser: [e.g. Firefox Version 104.0.1]
- Software version: [e.g. Sysmon v15.0, Winlogbeat 8.11.1]

#### **Setup**
- Are you running the LME machines in a virtual environment (i.e. Docker) or are you running natively on the machines?
- Which version of LME are you installing?
- Is this a first-time installation or are you upgrading? If upgrading, what was your previous version?

#### **Desktop:** (Client Machines)
- OS: [e.g. Windows 10]
- Browser: [e.g. Firefox Version 104.0.1]
- Software version: [e.g. Sysmon v15.0]

#### **Domain Controller:**
- OS: [e.g. Windows Server]
- Browser: [e.g. Firefox Version 104.0.1]
- Software version: [e.g. Winlogbeat 8.11.1]

#### **Server:**
#### **ElasticSearch/Kibana Server:**
- OS: [e.g. Ubuntu 22.04]
- Software Versions:
- ELK: [e.g. 8.7.1]
Expand All @@ -45,14 +59,12 @@ lsb_release -a
```
for name in $(sudo docker ps -a --format '{{.Names}}'); do echo -e "\n\n\n-----------$name----------"; sudo docker logs $name | tail -n 20; done
```
Increase the number of lines if your issue is not present, or include a relevant log of the erroring container
Increase the number of lines if your issue is not present or include a relevant log of the erroring container
- Output of the relevant /var/log/cron_logs/ file

## Expected behavior
A clear and concise description of what you expected to happen.

## Screenshots **OPTIONAL**
If applicable, add screenshots to help explain your problem.

## Additional context
Add any other context about the problem here.
Add any other context about the problem or any unique environment information here.
2 changes: 1 addition & 1 deletion .github/ISSUE_TEMPLATE/feature_request.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ assignees: ''
---

**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
A clear and concise description of what the problem is. Ex. When I try ABC, this happens instead [...]

**Describe the solution you'd like**
A clear and concise description of what you want to happen.
Expand Down
25 changes: 9 additions & 16 deletions .github/PULL_REQUEST_TEMPLATE.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,42 +10,35 @@
<!-- Mention any related issue(s) here using appropriate keywords such -->
<!-- as "closes" or "resolves" to auto-close them on merge. -->
<!-- If this PR is *not* being merged into main, the related issues will not -->
<!-- be auto-closed, so you need to add the issue into the Development box -->
<!-- in the right sidebar -->
<!-- be auto-closed, so you need to close the issue manually -->

### 📷 Screenshots (DELETE IF UNAPPLICABLE)

## 🧪 Testing

<!-- How did you test your changes? How could someone else test this PR? -->
<!-- Include details of your testing environment, and the tests you ran to -->
<!-- Include details of your testing environment, and the tests you ran to. -->
<!-- see how your change affects other areas of the code, etc. -->

## ✅ Pre-approval checklist ##
- [ ] There is a [gitIssue](https://github.com/cisagov/LME/issues) that this PR resolves
- [ ] Git Issue that this PR solves has been selected in the Development section
- [ ] The PR's base branch has been modified to be the proper branch.
- [ ] Changes are limited to a single goal **AND**
<<<<<<< HEAD
the title reflects this in a clear human readable format for the release notes
=======
the title reflects this in a clear human readable format
- [ ] Issue that this PR solves has been selected in the Development section
>>>>>>> 34b2ff9 (Update PULL_REQUEST_TEMPLATE.md (#206))
- [ ] I have read and agree to LME's [CONTRIBUTING.md](https://github.com/cisagov/LME/CONTRIBUTING.md) document.
- [ ] The PR adheres to LME's requirements in [RELEASES.md](https://github.com/cisagov/LME/RELEASES.md#steps-to-submit-a-PR)
- [ ] These code changes follow [cisagov code standards](https://github.com/cisagov/development-guide).
- [ ] All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
- [ ] The PR is labeled with `feat` for an added new feature, `update` for an update, **OR** `fix` for a fix.
- [ ] The PR contains `Resolves #<issue #>` so that merging it closes out the corresponding issue. For example `Resolves #132`.


## ✅ Pre-merge Checklist

- [ ] All tests pass
- [ ] PR has been tested and the documentation for testing is above
- [ ] Squash and merge all commits into one PR level commit
- [ ] All tests pass.
- [ ] PR has been tested and the documentation for testing is above.
- [ ] Squash and merge all commits into one PR level commit.

## ✅ Post-merge Checklist

- [ ] Delete the branch to keep down number of branches

- [ ] Delete the branch to keep down number of branches.
- [ ] The PR is labeled with `feat` for an added new feature, `update` for an update, **OR** `fix` for a fix.
- [ ] The PR contains `Resolves #<issue #>` so that merging it closes out the corresponding issue. For example `Resolves #132`.
16 changes: 8 additions & 8 deletions CONTRIBUTING.md
Original file line number Diff line number Diff line change
@@ -1,17 +1,17 @@
# Welcome #

We're so glad you're thinking about contributing to this open-source project! If you're unsure or hesitant to make a recommendation, just ask, submit the issue, or pull request. The worst that can happen is that you'll be politely asked to change something. We appreciate any sort of contribution(s), and don't want a wall of rules to stifle innovation.
Users are welcome to contribute to LME. If you're unsure or hesitant to make a recommendation, just ask, submit the issue or pull request. The LME team appreciates any sort of contribution, and does not want to stifle innovation.

Before contributing, we encourage you to read our CONTRIBUTING policy (you are here), our LICENSE, and our README, all of which are in this repository.
Before contributing, please read the CONTRIBUTING policy (you are here), LICENSE, and README, all of which are in this repository.

## Issues

If you want to report a bug or request a new feature, the most direct method is to [create an issue](https://github.com/cisagov/development-guide/issues) in this repository.
We recommend that you first search through existing issues (both open and closed) to check if your particular issue has already been reported.
We recommend that you first search through existing issues (both open and closed) to check if another users has reported your particular issue and there is already an answer.

If it has then you might want to add a comment to the existing issue.
If your question is in an existing issue, then you might want to add a comment to the existing issue.

If it hasn't then please create a new one.
If it hasn't, then please create a new one.

Please follow the provided template and fill out all sections. We have a `BUG` and `FEATURE REQUEST` Template

Expand All @@ -25,21 +25,21 @@ Example:

## Pull Requests (PR)

If you choose to submit a pull request, it will be required to pass various sanity checks in our continuous integration (CI) pipeline, before we merge it. Your pull request may fail these checks, and that's OK. If you want you can stop there and wait for us to make the necessary corrections to ensure your code passes the CI checks, you're more than within your rights; however, it helps our team greatly if you fix the issues found by our CI pipeline.
If you choose to submit a pull request, your pull request must pass various sanity checks in the continuous integration (CI) pipeline, before merging it. Your pull request may fail these checks, and that's OK. If you want, you can stop there and wait for us to make the necessary corrections to ensure your code passes the CI checks. It helps our community if you fix the issue found by our CI pipeline.

Below are some loose requirements we'd like all PR's to follow. Our release process is documented in [Releases](releases.md).

### Quality assurance and code reviews

All PRs will be tested, vetted, and reviewed by our team before being merged with the main code base. All should be pull requested into whatever the upcoming release branch is. Find that by searching for the highest SEMVER `release-X.Y.Z` branch or following our release documentation.
Our team will test, vet and review all PR's before our team merges a PR with the main code base. All code should be pull requested into the upcoming release branch. You can find that by searching for the highest SEMVER `release-X.Y.Z` branch or following our release documentation.

### Steps to submit a PR
- All PRs should request merges back into LME's *CLOSEST* Major or Minor upcoming release branch `release-X.Y.Z`. This will be viewable in the branch list on Github. You can also refer to our release documentation for guidance.
- If the PR corresponds to an issue we are already tracking on LME's public Github [project](https://github.com/orgs/cisagov/projects/68), please comment the PR in the issue, and we will update the issue.
- If the PR does not have an issue, please create a new issue and name your branch according to the conventions [here](#branch-naming-conventions). Add a human readable title describing the PR and how it fits into LME's project/code. If the PR follows our other requirements listed here, we'll add it into our public project linked previously.
- Add the label `feat` for an added new feature, `update` for an update, **or** `fix` for a fix.
- We'll work with you to mold it to our development goals/process, so your work can be merged into LME and your Github profile gets credit for the contributions.
- Before merging we request that all commits be squashed into one commit. This way your changes to the repository are tracked, but our `git log` history does not rapidly expand.
- Before merging, we request that all commits be squashed into one commit. This way your changes to the repository are tracked, but our `git log` history does not rapidly expand.
- Thanks for wanting to submit and develop improvements for LME!!

## Public domain
Expand Down
24 changes: 12 additions & 12 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
[![Downloads](https://img.shields.io/github/downloads/cisagov/lme/total.svg)]()

# Logging Made Easy
Initially created by NCSC and now maintained by CISA, Logging Made Easy is a self-install tutorial for small organizations to gain a basic level of centralized security logging for Windows clients and provide functionality to detect attacks. It's the coming together of multiple open software platforms which come at no cost to users, where LME helps the reader integrate them together to produce an end-to-end logging capability. We also provide some pre-made configuration files and scripts, although there is the option to do it on your own.
CISA's Logging Made Easy has a self-install tutorial for organizations to gain a basic level of centralized security logging for Windows clients and provide functionality to detect attacks. LME is the integration of multiple open software platforms which come at no cost to users. LME helps users integrate software platforms together to produce an end-to-end logging capability. LME also provides some pre-made configuration files and scripts, although there is the option to do this on your own.

Logging Made Easy can:
- Show where administrative commands are being run on enrolled devices
Expand All @@ -20,28 +20,28 @@ Logging Made Easy can:

**LME is a 'homebrew' way of gathering logs and querying for attacks.**

We have done the hard work to make things simple. We will tell you what to download, which configurations to use and have created convenient scripts to auto-configure wherever possible.
The LME team simplified the process and created clear instruction on what to download and which configugrations to use, and created convinent scripts to auto configure when possible.

The current architecture is based upon Windows Clients, Microsoft Sysmon, Windows Event Forwarding and the ELK stack.
The current architecture is based on Windows Clients, Microsoft Sysmon, Windows Event Forwarding and the ELK stack.

We are **not** able to comment on or troubleshoot individual installations. If you believe you have have found an issue with the LME code or documentation please submit a [GitHub issue](https://github.com/cisagov/lme/issues). If you have a question about your installation, please visit [GitHub Discussions](https://github.com/cisagov/lme/discussions) to see if your issue has been addressed before.
LME is **not** able to comment on or troubleshoot individual installations. If you believe you have have found an issue with the LME code or documentation please submit a [GitHub issue](https://github.com/cisagov/lme/issues). If you have a question about your installation, please look through all open and closed issues to see if it has been addressed before. If not, then submit a GitHub issue using the Bug Template, ensuring that you provide all the requested information.

For general questions about LME and suggestions, please visit [GitHub Discussions](https://github.com/cisagov/lme/discussions) to add a discussion post.

## Who is Logging Made Easy for?

From single IT administrators with a handful of devices in their network to larger organizations.

LME is for you if:
LME is suited for for:

* You don’t have a [SOC](https://en.wikipedia.org/wiki/Information_security_operations_center), SIEM or any monitoring in place at the moment.
* You lack the budget, time or understanding to set up your own logging system.
* You recognize the need to begin gathering logs and monitoring your IT.
* You understand that LME has limitations and is better than nothing - but no match for a professional tool.
*Oganization without [SOC](https://en.wikipedia.org/wiki/Information_security_operations_center), SIEM or any monitoring in place at the moment.
* Organizations that lack the budget, time or understanding to set up a logging system.
* Organizations that that require gathering logs and monitoring IT
* Organizations that understand LMEs limitiation

If any, or all, of these criteria fit, then LME is a step in the right direction for you.

LME could also be useful for:

* Small isolated networks where corporate monitoring doesn’t reach.
LME is most useful for small isolated networks where corporate monitoring doesn’t reach.

## Overview
The LME architecture consists of 3 groups of computers, as summarized in the following diagram:
Expand Down
Loading

0 comments on commit 61a1e68

Please sign in to comment.