Calling Powershell scripts from MQL?

[GurdipS5]

Hi,
I have just come across Mondoo and it looks great. I saw I can write custom checks with Powershell (or rather, MQL that calls Powershell). Is it possible, however, for the MQL to call an external Powershell script?

My infra is on prem Windows servers.

[chris-rock]

Welcome @GurdipS5

Great question. You can test then when you run the cnspec shell. When you embed the powershell code, it looks like that:

cnspec> powershell("Write-Host 'Hello, World!'").stdout
powershell.stdout: "Hello, World!
"

Assuming you have a local file test.ps1

Write-Host 'Hello, World!'

Then you can just call the script

cnspec> powershell("./test.ps1").stdout
powershell.stdout: "Hello, World!
"

For production use I would recommend using absolute paths. In the second case the powershell script is not distributed via the policy itself and you would need to make sure the powershell script is available at all machines.

[GurdipS5]

Yeah I will be testing this. Just discovered Mondoo late last night lol. Great tool there aren't many policy as code tools for Windows I was thinking Pester.

…

On Thu, 23 Mar 2023, 12:18 Christoph Hartmann, ***@***.***> wrote: Welcome @GurdipS5 <https://github.com/GurdipS5> Great question. You can test then when you run the cnspec shell. When you embed the powershell code, it looks like that: cnspec> powershell("Write-Host 'Hello, World!'").stdout powershell.stdout: "Hello, World! " Assuming you have a local file test.ps1 Write-Host 'Hello, World!' Then you can just call the script cnspec> powershell("./test.ps1").stdout powershell.stdout: "Hello, World! " For production use I would recommend using absolute paths. In the second case the powershell script is not distributed via the policy itself and you would need to make sure the powershell script is available at all machines. — Reply to this email directly, view it on GitHub <#1096 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AU2JXHAWRHJYGQQSQQMGXUTW5Q5RLANCNFSM6AAAAAAWFB7GTQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[GurdipS5]

And the scripts will be distributed via Octopus Deploy and in git so that will contrl that.

[chris-rock]

Nice

[chris-rock]

We have a lot of Windows users using cnspec in production to secure their Windows server and Windows client fleet. Here is our Windows Security policy https://github.com/mondoohq/cnspec-policies/blob/main/core/mondoo-windows-security.mql.yaml and our Windows Workstation Security Policy https://github.com/mondoohq/cnspec-policies/blob/main/core/mondoo-windows-workstation-security.mql.yaml

We also have support for all CIS Benchmarks if you need that.

[GurdipS5]

Awesome. I'd add I'm using iis so that's a focus. Server 2022.

…

On Thu, 23 Mar 2023, 12:23 Christoph Hartmann, ***@***.***> wrote: We have a lot of Windows users using cnspec in production to secure their Windows server and Windows client fleet. Here is our Windows Security policy https://github.com/mondoohq/cnspec-policies/blob/main/core/mondoo-windows-security.mql.yaml and our Windows Workstation Security Policy https://github.com/mondoohq/cnspec-policies/blob/main/core/mondoo-windows-workstation-security.mql.yaml We also have support for all CIS Benchmarks if you need that. — Reply to this email directly, view it on GitHub <#1096 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AU2JXHCYCWM5EMHP4PSAZPTW5Q6CVANCNFSM6AAAAAAWFB7GTQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>