feat(aw-rus): sync deploy stack, install kit, and health checks

install-kit-awindows-20260427-211240/windows/deploy-domain-users.ps1

@@ -23,9 +23,23 @@ param(
     [bool]$IncidentCaptureEnabled = $true,
     [bool]$IncidentScreenshotEnabled = $true,
     [string]$IncidentArtifactsRoot,
+    [string]$EvtxExportRoot,
+    [int]$EvtxRetentionDays = 14,
+    [string[]]$EvtxChannels = @(),
     [bool]$LogonMarkerEnabled = $true,
+    [string]$AwHostname,
     [string]$CustomRulesPath,
-    [string]$CustomPolicyPath
+    [string]$CustomPolicyPath,
+    [ValidateSet('local', 'server')]
+    [string]$PolicyMode = 'local',
+    [bool]$PolicyEngineEnabled = $false,
+    [string]$PolicyEngineHost,
+    [int]$PolicyEnginePort = 5601,
+    [ValidateSet('http', 'https')]
+    [string]$PolicyEngineScheme = 'http',
+    [int]$PolicyRefreshSeconds = 300,
+    [string]$PolicyCachePath,
+    [switch]$IntegrationTestEnabled
 )
 
 Set-StrictMode -Version Latest
@@ -45,9 +59,11 @@ $launchScriptPath = Join-Path $StateRoot 'launch-watchers.ps1'
 $recoveryScriptPath = Join-Path $StateRoot 'recovery-loop.ps1'
 $collectorSource = Join-Path $PSScriptRoot 'browser-domains-native-collector.ps1'
 $endpointCollectorSource = Join-Path $PSScriptRoot 'dlp-endpoint-signals-collector.ps1'
+$policyClientSource = Join-Path $PSScriptRoot 'dlp-policy-client.ps1'
 $emailCollectorSource = Join-Path $PSScriptRoot 'email-outbound-collector.ps1'
 $fileCollectorSource = Join-Path $PSScriptRoot 'file-operations-collector.ps1'
 $sessionCollectorSource = Join-Path $PSScriptRoot 'worktime-session-collector.ps1'
+$evtxExportScriptSource = Join-Path $PSScriptRoot 'export-evtx-for-hayabusa.ps1'
 $exampleRulesSource = Join-Path $PSScriptRoot 'web-category-rules.example.json'
 $examplePolicySource = Join-Path $PSScriptRoot 'dlp-policy.example.json'
 
@@ -62,9 +78,11 @@ Get-ActivityWatchExecutableMap -InstallRoot $InstallRoot | Out-Null
 $assetResult = Copy-ActivityWatchCollectorAssets `
     -CollectorScriptSource $collectorSource `
     -EndpointCollectorScriptSource $endpointCollectorSource `
+    -PolicyClientScriptSource $policyClientSource `
     -EmailCollectorScriptSource $emailCollectorSource `
     -FileCollectorScriptSource $fileCollectorSource `
     -SessionCollectorScriptSource $sessionCollectorSource `
+    -EvtxExportScriptSource $evtxExportScriptSource `
     -ExampleRulesSource $exampleRulesSource `
     -ExamplePolicySource $examplePolicySource `
     -StateRoot $StateRoot `
@@ -84,9 +102,11 @@ $config = New-ActivityWatchDeploymentConfig `
     -LogsRoot $logsRoot `
     -CollectorScript $assetResult.CollectorScript `
     -EndpointCollectorScript $assetResult.EndpointCollectorScript `
+    -PolicyClientScript $assetResult.PolicyClientScript `
     -EmailCollectorScript $assetResult.EmailCollectorScript `
     -FileCollectorScript $assetResult.FileCollectorScript `
     -SessionCollectorScript $assetResult.SessionCollectorScript `
+    -EvtxExportScript $assetResult.EvtxExportScript `
     -RulesPath $assetResult.ActiveRules `
     -PolicyPath $assetResult.ActivePolicy `
     -PollSeconds $PollSeconds `
@@ -99,11 +119,23 @@ $config = New-ActivityWatchDeploymentConfig `
     -IncidentCaptureEnabled $IncidentCaptureEnabled `
     -IncidentScreenshotEnabled $IncidentScreenshotEnabled `
     -IncidentArtifactsRoot $IncidentArtifactsRoot `
+    -EvtxExportRoot $EvtxExportRoot `
+    -EvtxRetentionDays $EvtxRetentionDays `
+    -EvtxChannels $EvtxChannels `
     -LogonMarkerEnabled $LogonMarkerEnabled `
+    -AwHostname $AwHostname `
+    -PolicyMode $PolicyMode `
+    -PolicyEngineEnabled $PolicyEngineEnabled `
+    -PolicyEngineHost $PolicyEngineHost `
+    -PolicyEnginePort $PolicyEnginePort `
+    -PolicyEngineScheme $PolicyEngineScheme `
+    -PolicyRefreshSeconds $PolicyRefreshSeconds `
+    -PolicyCachePath $PolicyCachePath `
     -LaunchScriptPath $launchScriptPath `
     -RecoveryScriptPath $recoveryScriptPath `
     -UserTasks $taskDefinitions `
-    -PackageVersion $Version
+    -PackageVersion $Version `
+    -IntegrationTestEnabled:$IntegrationTestEnabled
 
 Write-ActivityWatchDeploymentConfig -Config $config -Path $configPath
 Remove-LegacyActivityWatchEntries