Cannot merge config file about sysmon-modular

[Neonsun77]

Francesco; I believe you should run the command as a single string:
.\Merge-SysmonXml.ps1 Merge-AllSysmonXml -Path ( Get-ChildItem '[0-9]*\*.xml') -AsString | Out-File sysmonconfig.xml

With that said, this command gives me no output (tried on 3 different computers) and generates a 0-byte sysmonconfig.xml output file. I see there are some required params in the script function, but even running just .\Merge-SysmonXml.ps1 Merge-AllSysmonXml provides no output - I'd expect an error about the missing params, but I get nothing. Tips appreciated. :)

[francescouk]

Geir, That was my first try! Then I thought to load first the module then execute the code... but also no luck. It seems that for some reason the error starts at this point of the code:

$doc = [xml]::new()

[Neonsun77]

Hm, do you have .NET 4.5 or newer installed? And what does $PSVersionTable give you?

[francescouk]

.NET 4.8

And my $PSVersionTable:

Name                           Value
----                           -----
PSVersion                      5.1.18362.628
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.18362.628
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

[Neonsun77]

Yeah, sorry, I got no ideas.

[lazind]

Hi, when I execute the merge command as noted, I get a 0 kb sysmonconfig.xml file, so nothing happens. However if I add Merge-AllSysmonXml -Path ( Get-ChildItem '[0-9]**.xml') -AsString | Out-File sysmonconfig.xml to the end of the script to call the Merge-AllSysmonXml function from inside the script, the function does seem to do it's job, and I get a file that's 338KB in size instead as compared to the sysmonconfig.xml which comes with the zip file. I haven't combed through the script very carefully but it doesn't understand calling the function externally.

[ravenousld3341]

Hi, when I execute the merge command as noted, I get a 0 kb sysmonconfig.xml file, so nothing happens. However if I add Merge-AllSysmonXml -Path ( Get-ChildItem '[0-9]**.xml') -AsString | Out-File sysmonconfig.xml to the end of the script to call the Merge-AllSysmonXml function from inside the script, the function does seem to do it's job, and I get a file that's 338KB in size instead as compared to the sysmonconfig.xml which comes with the zip file. I haven't combed through the script very carefully but it doesn't understand calling the function externally.

This isn't working for me either. I get the following error.

Merge-AllSysmonXml : Cannot bind argument to parameter 'Path' because it is null.

[Mangolinux]

when I run .\Merge-SysmonXml.ps1 Merge-AllSysmonXml -Path ( Get-ChildItem '[0-9]**.xml') -AsString | Out-File sysmonconfig.xml

I get a 0 kb sysmonconfig.xml file,

[canadianmuppet]

I am currently having the same issue with a 0 size config file. Running Win10,
[Edit]
Strangely enough I have the same issue when I try running the 10.4 branch as well.

[lazind]

It occurred to me to run the powershell command as two commands. So I ran the first line ->enter. Ran the second send line -> enter. This seemed to generate a roughly 380k file. Could the developer comment on this please?

On Tue, Jul 7, 2020 at 16:28 canadianmuppet ***@***.***> wrote: I am currently having the same issue with a 0 size config file. Running Win10, 2004 — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#40 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AF3OIIAXXSP5LAPLXT4KDEDR2OANFANCNFSM4KX5LWFQ> .

-- Dragan Lazin Systems Administrator Senior, ITS University of Michigan-Dearborn Tel: [phone] Email: [email protected]

[canadianmuppet]

Indeed, I feel a bit embarrassed now, because when I run it one after another it works for both 11 and 10.4 versions...awkward. PEBKC in my case.

[lazind]

I honestly took it as a formattic error and believed it was a one liner. I think the instructions could be a little clearer on running the command...

…

On Tue, Jul 7, 2020 at 5:38 PM canadianmuppet ***@***.***> wrote: Indeed, I feel a bit embarrassed now, because when I run it one after another it works for both 11 and 10.4 versions...awkward. PEBKC in my case. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#40 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AF3OIIB2SEW4VOBYDAZ5BSTR2OITRANCNFSM4KX5LWFQ> .

-- Dragan Lazin Systems Administrator Senior, ITS University of Michigan-Dearborn Tel: [phone] E-mail: [email protected]

[olafhartong]

glad it got resolved, I'll make a small adjustment to the readme file to make it more clear