From a6cef75c126802ce59f657d6599e9a0f4bd6e988 Mon Sep 17 00:00:00 2001
From: Shirofune-Security
 <43838376+Shirofune-Security@users.noreply.github.com>
Date: Fri, 18 Sep 2026 22:00:52 +0900
Subject: [PATCH] Verify source attribution and prerequisites in native control
 results

---
 tests/NativeAuditControls.Tests.ps1 | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/tests/NativeAuditControls.Tests.ps1 b/tests/NativeAuditControls.Tests.ps1
index d2002dd5..34f815b3 100644
--- a/tests/NativeAuditControls.Tests.ps1
+++ b/tests/NativeAuditControls.Tests.ps1
@@ -8,12 +8,12 @@ function Assert-Equal($Actual, $Expected, [string]$Message) {
     $script:assertions++
 }
 $expected = @{
-    'Group Membership' = @{ Guid = '0CCE9249-69AE-11D9-BED3-505054503030'; Mask = 1 }
-    'Application Group Management' = @{ Guid = '0CCE9239-69AE-11D9-BED3-505054503030'; Mask = 3 }
-    'Authorization Policy Change' = @{ Guid = '0CCE9231-69AE-11D9-BED3-505054503030'; Mask = 1 }
-    'MPSSVC Rule-Level Policy Change' = @{ Guid = '0CCE9232-69AE-11D9-BED3-505054503030'; Mask = 3 }
-    'IPsec Driver' = @{ Guid = '0CCE9213-69AE-11D9-BED3-505054503030'; Mask = 3 }
-    'Kernel Object' = @{ Guid = '0CCE921F-69AE-11D9-BED3-505054503030'; Mask = 3 }
+    'Group Membership' = @{ Guid = '0CCE9249-69AE-11D9-BED3-505054503030'; Mask = 1; Source = 'ms-sct' }
+    'Application Group Management' = @{ Guid = '0CCE9239-69AE-11D9-BED3-505054503030'; Mask = 3; Source = 'cis-client' }
+    'Authorization Policy Change' = @{ Guid = '0CCE9231-69AE-11D9-BED3-505054503030'; Mask = 1; Source = 'cis-client' }
+    'MPSSVC Rule-Level Policy Change' = @{ Guid = '0CCE9232-69AE-11D9-BED3-505054503030'; Mask = 3; Source = 'ms-wef' }
+    'IPsec Driver' = @{ Guid = '0CCE9213-69AE-11D9-BED3-505054503030'; Mask = 3; Source = 'ms-audit' }
+    'Kernel Object' = @{ Guid = '0CCE921F-69AE-11D9-BED3-505054503030'; Mask = 3; Source = 'asd' }
 }
 $current = @{}
 foreach ($policy in $config.catalog) { $current[$policy.guid] = 0 }
@@ -24,7 +24,7 @@ foreach ($role in @('Client', 'MemberServer', 'DomainController', 'ADCS')) {
         Assert-Equal $row.Count 1 "$role/$name has exactly one plan row"
         Assert-Equal $row[0].guid $expected[$name].Guid "$role/$name canonical GUID"
         Assert-Equal $row[0].targetMask $expected[$name].Mask "$role/$name applies the intended mask"
-        Assert-Equal ($row[0].sourceIds.Count -gt 0) $true "$role/$name retains provenance"
+        Assert-Equal ($row[0].sourceIds -contains $expected[$name].Source) $true "$role/$name retains provenance"
     }
     $kernel = $plan.policies | Where-Object { $_.id -eq 'Kernel Object' }
     Assert-Equal ($kernel.prerequisites -match 'SACL') $true "$role kernel auditing reports object-SACL dependency"
@@ -56,6 +56,12 @@ $result = Invoke-WelaAuditProfilePlan -Plan $plan -ReadPolicy { $script:policySt
     $script:writes[$Guid] = $Mask
 } -ReadContext { [pscustomobject]@{ Role = 'Client'; Build = 26100 } } -Confirm:$false
 Assert-Equal $result.success $true 'Shared apply reports verified success with matching readback'
+$kernelResult = $result.results | Where-Object { $_.id -eq 'Kernel Object' }
+Assert-Equal ($kernelResult.prerequisites -match 'SACL') $true 'Apply result retains kernel SACL prerequisite'
+Assert-Equal ($kernelResult.sourceIds -contains 'asd') $true 'Apply result identifies ASD kernel requirement'
+Assert-Equal ($kernelResult.evidence -match 'ASD') $true 'Apply result retains source evidence'
+Assert-Equal $result.role 'Client' 'Apply result retains selected role'
+Assert-Equal $result.build 26100 'Apply result retains selected build'
 foreach ($name in $expected.Keys) {
     Assert-Equal $script:writes[$expected[$name].Guid] $expected[$name].Mask "Apply requests correct $name mask"
 }