mirror of
https://github.com/Yamato-Security/WELA.git
synced 2026-10-23 22:53:00 +02:00
docs: fix issue coverage heading
This commit is contained in:
1 parent
f4cc10cbba
commit
03f553e169
1 file changed
+1
-1
@@ -69,6 +69,6 @@ Only relative files inside the bundle directory are read. Traversal, UNC paths,
|
||||
Use separate Windows 11, member-server, DC and member-server CA snapshots. Record build/patch, domain membership, roles, corpus/mapping hashes and backend version. Capture before state, apply an approved source profile, generate a benign operation corresponding to one explicitly selected full rule, save native XML, then capture after state. Confirm field normalization and source identity at the collector/backend, execute the exact translated query, retain its match and independently review the normalization. SACL-dependent rules require additional reviewed adapters; a file/AD/WMI policy toggle alone never closes that gap. Measure event volume, loss/backlog and overhead separately and preserve those records; this importer does not infer EPS or storage capacity.
|
||||
|
||||
Hosted CI uses synthetic fixtures and read-only Windows observations. It supplies no clean-image before/after matrix, genuine backend-query/ingestion result or end-to-end detection claim. Issue #387 remains open for those acceptance tests and for additional rule/parser adapters.
|
||||
+### Issue 387 coverage
|
||||
### Issue 387 coverage
|
||||
|
||||
Eligibility is reported as `Ready`, `Conditional`, `Blocked`, or `NotApplicable` from versioned native rule metadata and observed prerequisites. Channel enablement, SACLs, field availability, forwarding, and matching remain separate stages; native 4688 command-line limitations and Sysmon exclusions are explicit.
|
||||
Reference in new issue
Block a user