diff --git a/CHANGELOG-Japanese.md b/CHANGELOG-Japanese.md index b77a0ac6..9c16a16f 100644 --- a/CHANGELOG-Japanese.md +++ b/CHANGELOG-Japanese.md @@ -2,7 +2,13 @@ ## 2.2.0 [2026/xx/xx] - Dev Release -- バージョン対応 SMB 監査ポリシーの範囲とランタイム上の制限を文書化しました。 (#377) +- バージョン対応 OneSettings と Security 警告設定の範囲を文書化しました。 (#378) + +- イベントログのサイズ、保持モード、復旧に関する保護範囲を文書化しました。 (#379) + +- ネイティブ Security 4703 帰属証跡と、条件付きマッピングの範囲を文書化しました。 (#380) + +- ネイティブ AppLocker 準備状態の確認と、安全な監査専用ポリシー取込の範囲を文書化しました。 (#381) - バージョン付きオフライン Intune 監査エクスポートと、割り当てに関する制限を文書化しました。 (#1) diff --git a/CHANGELOG.md b/CHANGELOG.md index 03d288cc..6385a912 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,13 @@ ## 2.2.0 [2026/xx/xx] - Dev Release -- Document version-aware SMB audit policy scope and runtime limitations. (Related #377) +- Document version-aware OneSettings and Security warning configuration boundaries. (Related #378) + +- Document guarded event-log sizing, retention-mode, and recovery boundaries. (Related #379) + +- Document native Security 4703 attribution evidence and conditional mapping boundaries. (Related #380) + +- Document native AppLocker readiness checks and safe audit-only policy import boundaries. (Related #381) - Document the versioned offline Intune audit export and assignment limitations. (Related #1) diff --git a/docs/applocker-readiness.md b/docs/applocker-readiness.md index c5f3737b..ed3709ac 100644 --- a/docs/applocker-readiness.md +++ b/docs/applocker-readiness.md @@ -1,5 +1,9 @@ # Native AppLocker readiness +### Issue 381 coverage + +AppLocker readiness observes the effective policy, AppIDSvc, and native channels before any optional import. Only an operator-supplied audit-only policy may be imported; existing enforcement policies are preserved, and policy state is kept separate from event generation and Sigma eligibility. + `applocker-readiness` reports local and GP effective policy XML, each of the five rule collections, enforcement modes, rule counts, Application Identity (`AppIDSvc`) state/start mode and relevant AppLocker channel observations. A host with enabled channels but no rules reports `MissingGpPolicy`. Stopped/disabled services, missing channels, unavailable cmdlets and read errors remain explicit. `NotConfigured` with rules is treated as potential enforcement, never as disabled. ```powershell diff --git a/docs/eventlog-settings.md b/docs/eventlog-settings.md index 2b5dc129..a61a263d 100644 --- a/docs/eventlog-settings.md +++ b/docs/eventlog-settings.md @@ -1,5 +1,9 @@ # Event-log sizes and retention modes +### Issue 379 coverage + +Event-log sizing and retention changes are explicit per-channel controls with typed before/after evidence, mode preservation, and guarded recovery. Buffer size does not establish a retention duration, archive capacity, forwarding health, or absence of event loss. + `audit-filesize` and ordinary `configure` now use the same `config/eventlog_profiles.json` definitions. `-Profile` continues to select **advanced audit policy only**. Use the separate `-LogProfile` option with diff --git a/docs/native-onesettings-acceptance.md b/docs/native-onesettings-acceptance.md index acc2d93a..63a7d6a3 100644 --- a/docs/native-onesettings-acceptance.md +++ b/docs/native-onesettings-acceptance.md @@ -1,5 +1,9 @@ # Native public OneSettings configuration acceptance +### Issue 378 coverage + +OneSettings auditing and Security warning thresholds are configured only through explicit, version-aware workflows. Unsupported builds and absent controls are refused or reported, sibling values are preserved, and successful policy writes do not claim warning-event generation or telemetry collection. + The disposable acceptance fixture invokes the actual `WELA.ps1 audit-notifications` command under Windows PowerShell 5.1 and PowerShell 7. It verifies local configuration and the explicit Privacy channel dependency. It does not generate a OneSettings event or claim effective producer behavior, policy persistence, forwarding or Sigma readiness. Sysmon is excluded. ```powershell diff --git a/docs/native-token-right-attribution.md b/docs/native-token-right-attribution.md index df3a5093..9f885803 100644 --- a/docs/native-token-right-attribution.md +++ b/docs/native-token-right-attribution.md @@ -1,5 +1,9 @@ # Native Security 4703 audit attribution +### Issue 380 coverage + +Token-right attribution pins the canonical Security 4703 GUID and retains the competing historical mappings as conditional candidates. Native event XML, audit masks, token context, and cleanup evidence are required before attribution; a catalog match alone does not claim universal Windows coverage. + The disposable `Native Security 4703 audit attribution` workflow tests the two historical audit-subcategory candidates for event 4703 on standalone Windows Server 2022/2025 under Windows PowerShell 5.1 and PowerShell 7. It does not add a production probe, change WELA policy recommendations, remove historical mapping candidates or grant Sigma readiness. Microsoft's [Token Right Adjusted guidance](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-token-right-adjusted) and [advanced audit-policy reference](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/advanced-audit-policy-configuration) associate 4703 with token adjustment. The older [4703 event reference](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4703) names Authorization Policy Change. [WELA's mapping review](audit-catalog-mappings.md) retains both historical candidates as conditional. Native evidence below is specific to the recorded Windows build/UBR, provider manifest, engine and fixed operation. diff --git a/website/docs/resources/changelog.ja.md b/website/docs/resources/changelog.ja.md index ec6f9602..fe364091 100644 --- a/website/docs/resources/changelog.ja.md +++ b/website/docs/resources/changelog.ja.md @@ -5,7 +5,13 @@ ## 2.2.0 [2026/xx/xx] - Dev Release -- バージョン対応 SMB 監査ポリシーの範囲とランタイム上の制限を文書化しました。 (#377) +- バージョン対応 OneSettings と Security 警告設定の範囲を文書化しました。 (#378) + +- イベントログのサイズ、保持モード、復旧に関する保護範囲を文書化しました。 (#379) + +- ネイティブ Security 4703 帰属証跡と、条件付きマッピングの範囲を文書化しました。 (#380) + +- ネイティブ AppLocker 準備状態の確認と、安全な監査専用ポリシー取込の範囲を文書化しました。 (#381) - バージョン付きオフライン Intune 監査エクスポートと、割り当てに関する制限を文書化しました。 (#1) diff --git a/website/docs/resources/changelog.md b/website/docs/resources/changelog.md index ca796c1f..c7a2fe98 100644 --- a/website/docs/resources/changelog.md +++ b/website/docs/resources/changelog.md @@ -5,7 +5,13 @@ ## 2.2.0 [2026/xx/xx] - Dev Release -- Document version-aware SMB audit policy scope and runtime limitations. (Related #377) +- Document version-aware OneSettings and Security warning configuration boundaries. (Related #378) + +- Document guarded event-log sizing, retention-mode, and recovery boundaries. (Related #379) + +- Document native Security 4703 attribution evidence and conditional mapping boundaries. (Related #380) + +- Document native AppLocker readiness checks and safe audit-only policy import boundaries. (Related #381) - Document the versioned offline Intune audit export and assignment limitations. (Related #1)