<?xml version="1.0" encoding="utf-8"?>
<Page
    x:Class="AppControlManager.Pages.CreatePolicy"
    xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
    xmlns:local="using:AppControlManager.Pages"
    xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
    xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
    xmlns:ui="using:CommunityToolkit.WinUI"
    xmlns:win="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
    xmlns:controls="using:CommunityToolkit.WinUI.Controls"
    mc:Ignorable="d">

    <Page.Resources>
        <!--  These styles can be referenced to create a consistent SettingsPage layout  -->

        <!--  Spacing between cards  -->
        <x:Double x:Key="SettingsCardSpacing">4</x:Double>

        <!--  Style (inc. the correct spacing) of a section header  -->
        <Style x:Key="SettingsSectionHeaderTextBlockStyle"
           BasedOn="{StaticResource BodyStrongTextBlockStyle}"
           TargetType="TextBlock">
            <Style.Setters>
                <Setter Property="Margin" Value="1,30,0,6" />
            </Style.Setters>
        </Style>
    </Page.Resources>

    <ScrollViewer>
        <Grid>
            <Grid.RowDefinitions>
                <RowDefinition Height="Auto" />
                <RowDefinition Height="*" />
            </Grid.RowDefinitions>


            <controls:WrapPanel Grid.Row="0" VerticalSpacing="4" HorizontalSpacing="4" Orientation="Vertical" Margin="6,10,6,10">

                <TextBlock
TextWrapping="WrapWholeWords"
Style="{StaticResource BodyTextBlockStyle}">

<Span>
    Create <Italic>App Control for Business</Italic>
        <Run Foreground="{ThemeResource SystemAccentColor}">policies</Run>
    based on different templates and policy rule options.
    <Underline><Bold>Signed And Reputable</Bold></Underline> is great for new users.
     <Underline><Bold>Allow Microsoft</Bold></Underline> only allows files signed by Microsoft's certificates. <Underline><Bold>Default Windows</Bold></Underline> only allows files that come by default with Windows OS.
</Span>
                </TextBlock>

                <HyperlinkButton Content="Guide" NavigateUri="https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-App-Control-Policy" />

            </controls:WrapPanel>


            <StackPanel HorizontalAlignment="Stretch"
                        Spacing="{StaticResource SettingsCardSpacing}" Grid.Row="1" Margin="0,40,0,0">

                <win:StackPanel.ChildrenTransitions>
                    <win:EntranceThemeTransition FromVerticalOffset="50" />
                    <win:RepositionThemeTransition IsStaggeringEnabled="False" />
                </win:StackPanel.ChildrenTransitions>

                <!-- Allow Microsoft -->

                <controls:SettingsExpander x:Name="AllowMicrosoftSettings"
                           Description="This policy will allow any program and file that is signed by Microsoft certificates to be able to run and everything else will be blocked."
                           Header="Create Allow Microsoft Policy"
                           HeaderIcon="{ui:FontIcon Glyph=&#xE71D;}">

                    <controls:WrapPanel Orientation="Horizontal" HorizontalSpacing="6" VerticalSpacing="10">

                        <Button x:Name="AllowMicrosoftCreate" Content="Create"
            Style="{StaticResource AccentButtonStyle}" Margin="0,0,15,0" Click="AllowMicrosoftCreate_Click" />

                        <Button x:Name="AllowMicrosoftCreateAndDeploy" Content="Create And Deploy"
Style="{StaticResource AccentButtonStyle}" Click="AllowMicrosoftCreateAndDeploy_Click" Margin="0,0,15,0" />

                    </controls:WrapPanel>

                    <controls:SettingsExpander.Items>

                        <controls:SettingsCard Description="Indicates that the created/deployed policy will have (Enabled:Audit Mode) policy rule option and will generate audit logs instead of blocking files."
                               Header="Audit">
                            <ToggleSwitch x:Name="AllowMicrosoftAudit" Toggled="AllowMicrosoftAudit_Toggled" />

                        </controls:SettingsCard>

                        <controls:SettingsCard Description="Specifies the log size for Microsoft-Windows-CodeIntegrity/Operational events."
         Header="Log Size">

                            <controls:WrapPanel Orientation="Horizontal">


                                <NumberBox x:Name="AllowMicrosoftLogSizeInput"
    Header="Enter a number for Log Size in MB"
    Value="2"
    SpinButtonPlacementMode="Inline"
    SmallChange="1"
    IsEnabled="False"
    LargeChange="10" Minimum="2" Maximum="1000000" Margin="0,0,30,0" ToolTipService.ToolTip="This is the Maximum Capacity of the Code Integrity Operational Log Size" />


                                <ToggleSwitch x:Name="AllowMicrosoftLogSizeInputEnabled" IsEnabled="False" Toggled="AllowMicrosoftLogSizeInputEnabled_Toggled" />

                            </controls:WrapPanel>


                        </controls:SettingsCard>



                        <controls:SettingsCard Description="Indicates that the created/deployed policy will have (Require EV Signers) policy rule option which will only allow kernel-mode drivers signed with an EV certificate to run."
         Header="Require EVSigners">
                            <ToggleSwitch x:Name="AllowMicrosoftRequireEVSigners" />
                        </controls:SettingsCard>

                        <controls:SettingsCard Description="Enables script enforcement for the policy which will severely limit the attack surface of PowerShell by requiring only scripts/modules signed and allowed in the Code Integrity policy to run."
         Header="Enable Script Enforcement">
                            <ToggleSwitch x:Name="AllowMicrosoftEnableScriptEnforcement" />
                        </controls:SettingsCard>

                        <controls:SettingsCard Description="Indicates that the created/deployed policy will have (Enabled:Boot Audit on Failure) and (Enabled:Advanced Boot Options Menu) policy rule options. Useful for testing the policy and having recovery options available when something goes wrong. Not recommended to be used in the final production-ready policy due to security reasons."
         Header="Test Mode">
                            <ToggleSwitch x:Name="AllowMicrosoftTestMode" />
                        </controls:SettingsCard>


                    </controls:SettingsExpander.Items>

                </controls:SettingsExpander>




                <!-- Default Windows -->

                <controls:SettingsExpander x:Name="DefaultWindowsSettings"
                           Description="This policy will allow files that come by default with Windows OS to run (including Office products) and everything else will be blocked."
                           Header="Create Default Windows Policy"
                           HeaderIcon="{ui:FontIcon Glyph=&#xE71D;}">

                    <controls:WrapPanel Orientation="Horizontal" HorizontalSpacing="6" VerticalSpacing="10">

                        <Button x:Name="DefaultWindowsCreate" Content="Create"
            Style="{StaticResource AccentButtonStyle}" Margin="0,0,15,0" Click="DefaultWindowsCreate_Click" />

                        <Button x:Name="DefaultWindowsCreateAndDeploy" Content="Create And Deploy"
Style="{StaticResource AccentButtonStyle}" Click="DefaultWindowsCreateAndDeploy_Click" Margin="0,0,15,0" />

                    </controls:WrapPanel>

                    <controls:SettingsExpander.Items>

                        <controls:SettingsCard Description="Indicates that the created/deployed policy will have (Enabled:Audit Mode) policy rule option and will generate audit logs instead of blocking files."
                               Header="Audit">

                            <ToggleSwitch x:Name="DefaultWindowsAudit" Toggled="DefaultWindowsAudit_Toggled" />

                        </controls:SettingsCard>

                        <controls:SettingsCard Description="Specifies the log size for Microsoft-Windows-CodeIntegrity/Operational events."
         Header="Log Size">

                            <controls:WrapPanel Orientation="Horizontal">


                                <NumberBox x:Name="DefaultWindowsLogSizeInput"
                    Header="Enter a number for Log Size in MB"
                    IsEnabled="False"
                    Value="2"
                    SpinButtonPlacementMode="Inline"
                    SmallChange="1"
                    LargeChange="10" Minimum="2" Maximum="1000000" Margin="0,0,30,0" ToolTipService.ToolTip="This is the Maximum Capacity of the Code Integrity Operational Log Size" />


                                <ToggleSwitch x:Name="DefaultWindowsLogSizeInputEnabled" IsEnabled="False" Toggled="DefaultWindowsLogSizeInputEnabled_Toggled" />

                            </controls:WrapPanel>


                        </controls:SettingsCard>



                        <controls:SettingsCard Description="Indicates that the created/deployed policy will have (Require EV Signers) policy rule option which will only allow kernel-mode drivers signed with an EV certificate to run."
         Header="Require EVSigners">
                            <ToggleSwitch x:Name="DefaultWindowsRequireEVSigners" />
                        </controls:SettingsCard>

                        <controls:SettingsCard Description="Enables script enforcement for the policy which will severely limit the attack surface of PowerShell by requiring only scripts/modules signed and allowed in the Code Integrity policy to run."
         Header="Enable Script Enforcement">
                            <ToggleSwitch x:Name="DefaultWindowsEnableScriptEnforcement" />
                        </controls:SettingsCard>

                        <controls:SettingsCard Description="Indicates that the created/deployed policy will have (Enabled:Boot Audit on Failure) and (Enabled:Advanced Boot Options Menu) policy rule options. Useful for testing the policy and having recovery options available when something goes wrong. Not recommended to be used in the final production-ready policy due to security reasons."
         Header="Test Mode">
                            <ToggleSwitch x:Name="DefaultWindowsTestMode" />
                        </controls:SettingsCard>


                    </controls:SettingsExpander.Items>

                </controls:SettingsExpander>




                <!-- Signed and Reputable -->

                <controls:SettingsExpander x:Name="SignedAndReputableSettings"
                           Description="This policy will allow any program and file that is signed by Microsoft certificates to be able to run. It will also use the Global Intelligence of the Microsoft's Intelligent Security Graph to automatically authorize reputable and signed files to run. Anything else will be blocked."
                           Header="Create Signed And Reputable Policy"
                           HeaderIcon="{ui:FontIcon Glyph=&#xE71D;}">

                    <controls:WrapPanel Orientation="Horizontal" HorizontalSpacing="6" VerticalSpacing="10">

                        <Button x:Name="SignedAndReputableCreate" Content="Create"
            Style="{StaticResource AccentButtonStyle}" Margin="0,0,15,0" Click="SignedAndReputableCreate_Click" />

                        <Button x:Name="SignedAndReputableCreateAndDeploy" Content="Create And Deploy"
Style="{StaticResource AccentButtonStyle}" Click="SignedAndReputableCreateAndDeploy_Click" Margin="0,0,15,0" />

                    </controls:WrapPanel>


                    <controls:SettingsExpander.Items>

                        <controls:SettingsCard Description="Indicates that the created/deployed policy will have (Enabled:Audit Mode) policy rule option and will generate audit logs instead of blocking files."
                               Header="Audit">

                            <ToggleSwitch x:Name="SignedAndReputableAudit" Toggled="SignedAndReputableAudit_Toggled" />

                        </controls:SettingsCard>


                        <controls:SettingsCard Description="Specifies the log size for Microsoft-Windows-CodeIntegrity/Operational events."
         Header="Log Size">

                            <controls:WrapPanel Orientation="Horizontal">


                                <NumberBox x:Name="SignedAndReputableLogSizeInput"
                        Header="Enter a number for Log Size in MB"
                        IsEnabled="False"
                        Value="2"
                        SpinButtonPlacementMode="Inline"
                        SmallChange="1"
                        LargeChange="10" Minimum="2" Maximum="1000000" Margin="0,0,30,0" ToolTipService.ToolTip="This is the Maximum Capacity of the Code Integrity Operational Log Size" />


                                <ToggleSwitch x:Name="SignedAndReputableLogSizeInputEnabled" IsEnabled="False" Toggled="SignedAndReputableLogSizeInputEnabled_Toggled" />

                            </controls:WrapPanel>


                        </controls:SettingsCard>



                        <controls:SettingsCard Description="Indicates that the created/deployed policy will have (Require EV Signers) policy rule option which will only allow kernel-mode drivers signed with an EV certificate to run."
         Header="Require EVSigners">
                            <ToggleSwitch x:Name="SignedAndReputableRequireEVSigners" />
                        </controls:SettingsCard>

                        <controls:SettingsCard Description="Enables script enforcement for the policy which will severely limit the attack surface of PowerShell by requiring only scripts/modules signed and allowed in the Code Integrity policy to run."
         Header="Enable Script Enforcement">
                            <ToggleSwitch x:Name="SignedAndReputableEnableScriptEnforcement" />
                        </controls:SettingsCard>

                        <controls:SettingsCard Description="Indicates that the created/deployed policy will have (Enabled:Boot Audit on Failure) and (Enabled:Advanced Boot Options Menu) policy rule options. Useful for testing the policy and having recovery options available when something goes wrong. Not recommended to be used in the final production-ready policy due to security reasons."
         Header="Test Mode">
                            <ToggleSwitch x:Name="SignedAndReputableTestMode" />
                        </controls:SettingsCard>


                    </controls:SettingsExpander.Items>

                </controls:SettingsExpander>


                <!-- Microsoft Recommended Driver Block Rules -->

                <controls:SettingsExpander x:Name="RecommendedDriverBlockRulesSettings"
                           Description="This policy will create the Microsoft Recommended Driver Block Rules."
                           Header="Create Microsoft Recommended Driver Block Rules"
                           HeaderIcon="{ui:FontIcon Glyph=&#xE71D;}">

                    <controls:SettingsExpander.ItemsHeader>
                        <InfoBar x:Name="RecommendedDriverBlockRulesInfoBar"
            BorderThickness="0"
            CornerRadius="0"
            IsIconVisible="True"
            IsOpen="False"
            IsClosable="False"
            Severity="Informational">
                        </InfoBar>
                    </controls:SettingsExpander.ItemsHeader>

                    <controls:WrapPanel Orientation="Horizontal" HorizontalSpacing="6" VerticalSpacing="10">

                        <Button x:Name="RecommendedDriverBlockRulesCreate" Content="Create" ToolTipService.ToolTip="Creates the Microsoft Recommended Drivers Block List XML file"
            Style="{StaticResource AccentButtonStyle}" Margin="0,0,15,0" Click="RecommendedDriverBlockRulesCreate_Click" />

                        <Button x:Name="RecommendedDriverBlockRulesCreateAndDeploy" Content="Create And Deploy" ToolTipService.ToolTip="Creates and Deploys the Microsoft Recommended Drivers Block List XML file"
Style="{StaticResource AccentButtonStyle}" Click="RecommendedDriverBlockRulesCreateAndDeploy_Click" Margin="0,0,15,0" />

                        <Button x:Name="RecommendedDriverBlockRulesScheduledAutoUpdate" Content="Auto Update" ToolTipService.ToolTip="Configures the Microsoft Recommended Drivers Block List to be automatically updated using a scheduled task"
Style="{StaticResource AccentButtonStyle}" Click="RecommendedDriverBlockRulesScheduledAutoUpdate_Click" Margin="0,0,15,0" />

                    </controls:WrapPanel>


                    <controls:SettingsExpander.Items>

                        <controls:SettingsCard Description="Information about the latest Microsoft Recommended Drivers Block Rules"
                               Header="Info">
                        </controls:SettingsCard>


                    </controls:SettingsExpander.Items>

                </controls:SettingsExpander>





                <!-- Microsoft Recommended User Mode Block Rules -->

                <controls:SettingsCard x:Name="RecommendedUserModeBlockRulesSettings"
                           Description="This policy will create the Microsoft Recommended User Mode Block Rules."
                           Header="Create Microsoft Recommended User Mode Block Rules"
                           HeaderIcon="{ui:FontIcon Glyph=&#xE71D;}">

                    <controls:WrapPanel Orientation="Horizontal" HorizontalSpacing="6" VerticalSpacing="10">

                        <Button x:Name="RecommendedUserModeBlockRulesCreate" Content="Create"
            Style="{StaticResource AccentButtonStyle}" Margin="0,0,15,0" Click="RecommendedUserModeBlockRulesCreate_Click" />

                        <Button x:Name="RecommendedUserModeBlockRulesCreateAndDeploy" Content="Create And Deploy"
Style="{StaticResource AccentButtonStyle}" Click="RecommendedUserModeBlockRulesCreateAndDeploy_Click" Margin="0,0,15,0" />

                    </controls:WrapPanel>


                </controls:SettingsCard>


            </StackPanel>

        </Grid>

    </ScrollViewer>
</Page>
