Cyberstudy
Supplementary — not from your PDF Intermediate ~45 min

Automate a daily security status report

Write a PowerShell script that collects key security settings on your own PC into a CSV, then schedule it. It's a small example of security automation and continuous monitoring.

Environment

Your own Windows PC with PowerShell. Task Scheduler for the scheduling step.

Before you start

  • Read Automation and Scripting (p.392), Automation and Orchestration Implementation (p.393) and Monitoring Systems and Applications (p.330).

You will

  • Collect security state in a script
  • Save a report with a timestamp
  • Schedule it to run automatically

Steps

  1. 1

    Create C:\SecReports and a script C:\SecReports\status.ps1.

  2. 2

    In the script, collect: Get-MpComputerStatus (real-time protection, signature age), Get-NetFirewallProfile (enabled per profile), Get-LocalGroupMember Administrators, and the last boot time from Get-CimInstance Win32_OperatingSystem.

  3. 3

    Build one object: [pscustomobject]@{ Time = Get-Date; RealTime = ...; FirewallOn = ...; Admins = ... }.

  4. 4

    Append it to a CSV: $row | Export-Csv C:\SecReports\status.csv -Append -NoTypeInformation.

  5. 5

    Run it by hand a couple of times and open the CSV.

  6. 6

    Schedule it daily in Task Scheduler: action powershell.exe -NoProfile -File C:\SecReports\status.ps1.

  7. 7

    Add one check that writes a warning line when real-time protection is off. That's a basic automated alert.

Check your understanding

  • ?Which benefits of automation from p.395 does this show?
  • ?What could go wrong if a script like this ran with more privileges than it needs?
  • ?How would a SIEM or orchestration tool take this further?