feat(dfir): add hayabusa forensic workflow integration

windows/deploy-domain-users.ps1

@@ -23,6 +23,9 @@ param(
     [bool]$IncidentCaptureEnabled = $true,
     [bool]$IncidentScreenshotEnabled = $true,
     [string]$IncidentArtifactsRoot,
+    [string]$EvtxExportRoot,
+    [int]$EvtxRetentionDays = 14,
+    [string[]]$EvtxChannels = @(),
     [bool]$LogonMarkerEnabled = $true,
     [string]$AwHostname,
     [string]$CustomRulesPath,
@@ -60,6 +63,7 @@ $policyClientSource = Join-Path $PSScriptRoot 'dlp-policy-client.ps1'
 $emailCollectorSource = Join-Path $PSScriptRoot 'email-outbound-collector.ps1'
 $fileCollectorSource = Join-Path $PSScriptRoot 'file-operations-collector.ps1'
 $sessionCollectorSource = Join-Path $PSScriptRoot 'worktime-session-collector.ps1'
+$evtxExportScriptSource = Join-Path $PSScriptRoot 'export-evtx-for-hayabusa.ps1'
 $exampleRulesSource = Join-Path $PSScriptRoot 'web-category-rules.example.json'
 $examplePolicySource = Join-Path $PSScriptRoot 'dlp-policy.example.json'
 
@@ -78,6 +82,7 @@ $assetResult = Copy-ActivityWatchCollectorAssets `
     -EmailCollectorScriptSource $emailCollectorSource `
     -FileCollectorScriptSource $fileCollectorSource `
     -SessionCollectorScriptSource $sessionCollectorSource `
+    -EvtxExportScriptSource $evtxExportScriptSource `
     -ExampleRulesSource $exampleRulesSource `
     -ExamplePolicySource $examplePolicySource `
     -StateRoot $StateRoot `
@@ -101,6 +106,7 @@ $config = New-ActivityWatchDeploymentConfig `
     -EmailCollectorScript $assetResult.EmailCollectorScript `
     -FileCollectorScript $assetResult.FileCollectorScript `
     -SessionCollectorScript $assetResult.SessionCollectorScript `
+    -EvtxExportScript $assetResult.EvtxExportScript `
     -RulesPath $assetResult.ActiveRules `
     -PolicyPath $assetResult.ActivePolicy `
     -PollSeconds $PollSeconds `
@@ -113,6 +119,9 @@ $config = New-ActivityWatchDeploymentConfig `
     -IncidentCaptureEnabled $IncidentCaptureEnabled `
     -IncidentScreenshotEnabled $IncidentScreenshotEnabled `
     -IncidentArtifactsRoot $IncidentArtifactsRoot `
+    -EvtxExportRoot $EvtxExportRoot `
+    -EvtxRetentionDays $EvtxRetentionDays `
+    -EvtxChannels $EvtxChannels `
     -LogonMarkerEnabled $LogonMarkerEnabled `
     -AwHostname $AwHostname `
     -PolicyMode $PolicyMode `