392 Commits
Author SHA1 Message Date
Shirofune-SecurityandClaude Opus 5.5 2bcf316316 Allow process-commandline Configure -DryRun through the global guard
process-commandline (#471) forwards -DryRun to Invoke-WelaProcessCommandline
and its CLI test expects `-ProcessCommandlineAction Configure -DryRun` to be
accepted, but the command was never added to the global -DryRun allow-list,
so the guard refused it before dispatch. The process-commandline workflow has
failed on dev since #471 merged. Plan/Audit with -DryRun remain refused by the
command's dedicated guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-23 12:39:30 +09:00
Shirofune-Security b3de1d0211 release: mark 3.0.0 as dev release 2026-09-23 09:07:08 +09:00
Shirofune-Security 0fc386bd3c release: bump WELA to 3.0.0 and show banner version 2026-09-23 09:03:51 +09:00
Shirofune-Security f180ca72ae Merge latest dev before registry probe merge 2026-09-22 18:16:38 +09:00
Shirofune-Security 92f2be18de Merge latest dev before process command-line merge 2026-09-22 18:15:57 +09:00
Shirofune-Security d20be8ff51 Merge latest dev before registry probe merge 2026-09-22 18:14:25 +09:00
Shirofune-Security f73c96e44c Merge latest dev before process command-line merge 2026-09-22 18:14:15 +09:00
Shirofune-Security c56a6f14d6 Merge latest dev before PowerShell logging merge 2026-09-22 18:14:07 +09:00
Shirofune-Security 3db5d73180 Merge latest dev before process command-line integration 2026-09-22 18:13:26 +09:00
Shirofune-Security dee12fa965 Merge latest dev before PowerShell logging integration 2026-09-22 18:13:17 +09:00
Shirofune-Security 7966529cc5 Merge latest dev before WMI descendants integration 2026-09-22 18:13:07 +09:00
Shirofune-Security ea8b4f152c Merge latest dev before registry probe integration 2026-09-22 18:12:57 +09:00
Shirofune-Security 66162232b6 Integrate reviewed logging and recovery base for WMI tree safeguards 2026-09-22 15:08:52 +09:00
Shirofune-Security 81c01330b8 Merge final reviewed dev sources and preserve literal CLI arguments 2026-09-22 15:08:26 +09:00
Shirofune-Security 7e1b076254 Integrate approved dev command and recovery additions 2026-09-22 15:07:44 +09:00
Shirofune-Security 2b992f06e6 Integrate approved dev command and recovery additions 2026-09-22 15:07:20 +09:00
Shirofune-Security bfa286bf7d Integrate reviewed WMI recovery with combined dev auditing batch 2026-09-22 15:06:51 +09:00
Shirofune-Security e584345df3 Integrate approved native recovery PRs before dev merge 2026-09-22 15:05:40 +09:00
Shirofune-Security 2b270042e7 Stack leaf-file recovery and preserve scoped NTLM dry-run integration 2026-09-22 15:03:17 +09:00
Shirofune-Security 16f9e69844 Stack native DNS probe on intended-reader recovery and approved dev 2026-09-22 14:59:41 +09:00
Shirofune-Security 4ab4c275a5 Preserve positional bindings and propagate native fixture failures 2026-09-22 14:57:47 +09:00
Shirofune-Security 9575c8204d Add fixed current-user registry value audit probe 2026-09-22 14:55:12 +09:00
Shirofune-Security 75c978b9a2 Preserve legacy positional CLI parameter bindings 2026-09-22 14:54:58 +09:00
Shirofune-Security 8546d319eb Reject unexplained descendant changes and unrelated WMI command arguments 2026-09-22 14:45:06 +09:00
Shirofune-Security ab45d03f15 Add reviewed removal of one proven parent-only WMI audit ACE 2026-09-22 14:43:33 +09:00
Shirofune-Security 3f613ea19c Add scoped Windows PowerShell logging policy and native validation 2026-09-22 14:37:38 +09:00
Shirofune-Security aa4630dda9 Add scoped native 4688 command-line policy configuration 2026-09-22 14:34:05 +09:00
Shirofune-Security b556b82ebc Integrate native DNS probe with current dev commands and release guides 2026-09-22 14:25:44 +09:00
Shirofune-Security 3ba8a45d80 Integrate current native auditing commands with transcript verification 2026-09-22 14:24:29 +09:00
Shirofune-Security 0ef22f20fa Merge dev and preserve leaf-file SACL recovery integration 2026-09-22 14:24:24 +09:00
Shirofune-Security 2fef35da23 Integrate reviewed native auditing commands with OneSettings validation 2026-09-22 14:23:33 +09:00
Shirofune-Security 005b249c3b Integrate reviewed filesystem and WEF query changes with scoped NTLM auditing 2026-09-22 14:23:24 +09:00
Shirofune-Security 353159615e fix: preserve omitted notification selection and document native OneSettings acceptance 2026-09-22 12:06:07 +09:00
Shirofune-Security b162c4e598 feat: configure selected incoming and domain NTLM audit policies 2026-09-22 12:03:11 +09:00
Shirofune-Security 54f9d6bf51 Add bounded native preflight for one selected WEF QueryList 2026-09-22 12:00:26 +09:00
Shirofune-Security 70a812556d Merge commit '29f03e352823af81b35869659928a94e70df4cf9' into feat/373-registry-sacl-recovery
# Conflicts:
#	.gitattributes
#	.github/workflows/release.yml
#	CHANGELOG-Japanese.md
#	CHANGELOG.md
#	website/docs/resources/changelog.ja.md
#	website/docs/resources/changelog.md
2026-09-22 11:43:28 +09:00
Shirofune-Security 559a9d1b82 Merge commit '008a8c80b9820318be8d9f833c6adf31c2dbf9a9' into feat/362-scoped-outgoing-ntlm
# Conflicts:
#	.github/workflows/release.yml
#	CHANGELOG-Japanese.md
#	CHANGELOG.md
#	website/docs/resources/changelog.ja.md
#	website/docs/resources/changelog.md
2026-09-22 11:42:30 +09:00
Shirofune-Security 530b49f26b feat: checkpoint reviewed native registry SACL recovery 2026-09-22 10:11:02 +09:00
Shirofune-Security 0777a5d0f8 Add scoped outgoing NTLM audit configuration with native acceptance 2026-09-22 10:09:37 +09:00
Shirofune-Security af88b87e01 Fix native collector subscription inventory and Unicode readback 2026-09-22 09:46:28 +09:00
Shirofune-Security dc7867b6bc Merge commit 'ffe4ed473414438d5465156e15b62796393daf80' into feat/368-reviewed-wec-authorization
# Conflicts:
#	.gitattributes
#	.github/workflows/release.yml
#	CHANGELOG-Japanese.md
#	CHANGELOG.md
#	website/docs/resources/changelog.ja.md
#	website/docs/resources/changelog.md
2026-09-22 09:35:07 +09:00
Shirofune-Security 0ff81052e6 Merge commit '39e8ce1' into feat/367-reviewed-channel-recovery
# Conflicts:
#	.gitattributes
#	.github/workflows/release.yml
#	CHANGELOG-Japanese.md
#	CHANGELOG.md
#	website/docs/resources/changelog.ja.md
#	website/docs/resources/changelog.md
2026-09-22 07:53:01 +09:00
Shirofune-Security 0c51232a40 Add reviewed recovery of one completed native channel operation 2026-09-22 07:52:16 +09:00
Shirofune-Security 0051f8c662 Review and update only source SID authorization on disabled WEC subscriptions 2026-09-22 07:50:50 +09:00
Shirofune-Security 0d1adfb442 Integrate reviewed CLI, channel and native probe changes 2026-09-22 07:25:37 +09:00
Shirofune-Security c89a21f81b Integrate reviewed CLI, channels and AppLocker Script probe 2026-09-22 07:24:32 +09:00
Shirofune-Security f3bd83a521 Integrate reviewed CLI and native channel configuration changes 2026-09-22 07:23:48 +09:00
Shirofune-Security 6365402f16 Clarify unsupported common parameters and integrate native channel tests 2026-09-22 07:21:55 +09:00
Shirofune-Security d832b1e090 Measure held-readback phase and refuse implementation targets before hashing 2026-09-21 22:51:50 +09:00
Shirofune-Security 4905f82eb5 Add reviewed WEC listener CLI contract and operator guide 2026-09-21 22:40:05 +09:00