From f5f565097cabb697dd661347a430d3b6b6dafa9c Mon Sep 17 00:00:00 2001 From: Shirofune-Security <43838376+Shirofune-Security@users.noreply.github.com> Date: Wed, 23 Sep 2026 07:37:13 +0900 Subject: [PATCH] docs: document native issue coverage --- CHANGELOG-Japanese.md | 2 ++ CHANGELOG.md | 2 ++ docs/native-token-right-attribution.md | 4 ++++ website/docs/resources/changelog.ja.md | 2 ++ website/docs/resources/changelog.md | 2 ++ 5 files changed, 12 insertions(+) diff --git a/CHANGELOG-Japanese.md b/CHANGELOG-Japanese.md index ebf3cb2e..1ad029ae 100644 --- a/CHANGELOG-Japanese.md +++ b/CHANGELOG-Japanese.md @@ -2,6 +2,8 @@ ## 2.2.0 [2026/xx/xx] - Dev Release +- ネイティブ Security 4703 帰属証跡と、条件付きマッピングの範囲を文書化しました。 (#380) + - バージョン付きオフライン Intune 監査エクスポートと、割り当てに関する制限を文書化しました。 (#1) - 明示的な GPO エクスポート範囲と、ドメイン展開に関する制限を文書化しました。 (#2) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4a273d1b..d76d2229 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,8 @@ ## 2.2.0 [2026/xx/xx] - Dev Release +- Document native Security 4703 attribution evidence and conditional mapping boundaries. (Related #380) + - Document the versioned offline Intune audit export and assignment limitations. (Related #1) - Document the explicit GPO export scope and its domain-deployment limitations. (Related #2) diff --git a/docs/native-token-right-attribution.md b/docs/native-token-right-attribution.md index df3a5093..9f885803 100644 --- a/docs/native-token-right-attribution.md +++ b/docs/native-token-right-attribution.md @@ -1,5 +1,9 @@ # Native Security 4703 audit attribution +### Issue 380 coverage + +Token-right attribution pins the canonical Security 4703 GUID and retains the competing historical mappings as conditional candidates. Native event XML, audit masks, token context, and cleanup evidence are required before attribution; a catalog match alone does not claim universal Windows coverage. + The disposable `Native Security 4703 audit attribution` workflow tests the two historical audit-subcategory candidates for event 4703 on standalone Windows Server 2022/2025 under Windows PowerShell 5.1 and PowerShell 7. It does not add a production probe, change WELA policy recommendations, remove historical mapping candidates or grant Sigma readiness. Microsoft's [Token Right Adjusted guidance](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-token-right-adjusted) and [advanced audit-policy reference](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/advanced-audit-policy-configuration) associate 4703 with token adjustment. The older [4703 event reference](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4703) names Authorization Policy Change. [WELA's mapping review](audit-catalog-mappings.md) retains both historical candidates as conditional. Native evidence below is specific to the recorded Windows build/UBR, provider manifest, engine and fixed operation. diff --git a/website/docs/resources/changelog.ja.md b/website/docs/resources/changelog.ja.md index d050f6c2..0c08b146 100644 --- a/website/docs/resources/changelog.ja.md +++ b/website/docs/resources/changelog.ja.md @@ -5,6 +5,8 @@ ## 2.2.0 [2026/xx/xx] - Dev Release +- ネイティブ Security 4703 帰属証跡と、条件付きマッピングの範囲を文書化しました。 (#380) + - バージョン付きオフライン Intune 監査エクスポートと、割り当てに関する制限を文書化しました。 (#1) - 明示的な GPO エクスポート範囲と、ドメイン展開に関する制限を文書化しました。 (#2) diff --git a/website/docs/resources/changelog.md b/website/docs/resources/changelog.md index 3e39476a..61eb0d02 100644 --- a/website/docs/resources/changelog.md +++ b/website/docs/resources/changelog.md @@ -5,6 +5,8 @@ ## 2.2.0 [2026/xx/xx] - Dev Release +- Document native Security 4703 attribution evidence and conditional mapping boundaries. (Related #380) + - Document the versioned offline Intune audit export and assignment limitations. (Related #1) - Document the explicit GPO export scope and its domain-deployment limitations. (Related #2)