CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-05 22:14:44 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,115 Commits 12 Branches 3 Tags
0d7bfd1317e29f101cb2eaf4fdbea85caa3cc6d0
Commit Graph
135 Commits
Author SHA1 Message Date
Shirofune-Security 9238633041 test: run registry fixtures in explicit native shells and document evidence 2026-09-22 08:06:51 +09:00
Shirofune-Security 0d1adfb442 Integrate reviewed CLI, channel and native probe changes 2026-09-22 07:25:37 +09:00
Shirofune-Security c89a21f81b Integrate reviewed CLI, channels and AppLocker Script probe 2026-09-22 07:24:32 +09:00
Shirofune-Security f3bd83a521 Integrate reviewed CLI and native channel configuration changes 2026-09-22 07:23:48 +09:00
Shirofune-Security 6365402f16 Clarify unsupported common parameters and integrate native channel tests 2026-09-22 07:21:55 +09:00
Shirofune-Security 8bd7aa0c74 Verify effective native worker module path and complete fixture exit status 2026-09-21 23:07:16 +09:00
Shirofune-Security 2301bf1e85 Bind native listener adapter modules and normalize cross-engine context JSON 2026-09-21 23:03:17 +09:00
Shirofune-Security d832b1e090 Measure held-readback phase and refuse implementation targets before hashing 2026-09-21 22:51:50 +09:00
Shirofune-Security 03bc63e996 Respect inherited execution policy for the fixed file worker 2026-09-21 22:43:07 +09:00
Shirofune-Security ce7b49a5ac Bind observed native file paths and document exact read evidence 2026-09-21 22:40:50 +09:00
Shirofune-Security 4905f82eb5 Add reviewed WEC listener CLI contract and operator guide 2026-09-21 22:40:05 +09:00
Shirofune-Security 37e93e10eb Refuse stopped service dependencies before AppLocker CIM observation 2026-09-21 22:34:09 +09:00
Shirofune-Security 019f13b566 Merge branch 'feat/375-firewall-log-recovery' into feat/381-native-applocker-script-probe 
# Conflicts:
#	.github/workflows/release.yml
#	CHANGELOG-Japanese.md
#	CHANGELOG.md
#	website/docs/resources/changelog.ja.md
#	website/docs/resources/changelog.md
 2026-09-21 22:27:49 +09:00
Shirofune-Security ef64b08bd2 Document Script evidence boundaries and retain bounded startup diagnostics 2026-09-21 22:26:34 +09:00
Shirofune-Security 29bdc908c5 Integrate the reviewed native recovery and probe batch 2026-09-21 22:26:32 +09:00
Shirofune-Security f05f852286 Retain native channel preservation evidence and document acceptance limits 2026-09-21 22:26:15 +09:00
Shirofune-Security d0973a832d Integrate reviewed native probes and recovery commands 2026-09-21 22:25:37 +09:00
Shirofune-Security 3919ba5d4a Document supported CLI preview options 2026-09-21 22:25:02 +09:00
Shirofune-Security 8fed328442 Integrate the reviewed recovery and native probe batch 2026-09-21 22:23:25 +09:00
Shirofune-Security 2f442af4da Integrate reviewed recovery and failed-logon commands 2026-09-21 22:21:35 +09:00
Shirofune-Security c4e9e765ff Integrate reviewed event-log recovery and failed-logon changes 2026-09-21 22:20:02 +09:00
Shirofune-Security 89f520511b Merge dev after failed-logon probe integration 2026-09-21 22:13:52 +09:00
田中ザック Isaac Mathis 6d228fedef Add a native local failed-logon audit probe (#444) 
* Add native local nonexistent-account failed-logon probe

* Match actual MSV1 local authentication event package

* Refuse coerced identity and authentication receipt fields

* Preserve explicit UTC DateTime receipts on older PowerShell7

* Reject unknown failed-logon probe options before dispatch
 2026-09-21 22:13:20 +09:00
Shirofune-Security ab69ce3c4b Explain disabled transcription after interrupted recovery 2026-09-21 22:09:06 +09:00
Shirofune-Security 6bf4360362 Merge final dev and verify strict transcription recovery CLI 2026-09-21 18:22:31 +09:00
Shirofune-Security 9bc243a041 Integrate final reviewed development base for CAPI2 probe 2026-09-21 18:21:10 +09:00
Shirofune-Security e61056caba Merge final dev and preserve recovery and ingress command handlers 2026-09-21 18:21:06 +09:00
Shirofune-Security 3abe3018ba Merge branch 'dev' of https://github.com/Yamato-Security/WELA into feat/375-firewall-log-recovery 
# Conflicts:
#	.github/workflows/release.yml
#	CHANGELOG-Japanese.md
#	CHANGELOG.md
#	website/docs/resources/changelog.ja.md
#	website/docs/resources/changelog.md
 2026-09-21 18:20:57 +09:00
Shirofune-Security 22d3a13180 Reject coerced transcription recovery history discriminators 2026-09-21 18:19:57 +09:00
田中ザック Isaac Mathis 203fdfc942 Add reviewed scoped collector firewall ingress creation (#442) 
* Add reviewed scoped collector firewall ingress creation

* Avoid Windows Clear-Item alias in native ingress fixture

* Handle native nullable package scope and retain bounded filter evidence

* Match native firewall network spelling in collector prerequisites
 2026-09-21 18:19:30 +09:00
Shirofune-Security fa720f1454 Bind the reviewed native host gate and context dependency 2026-09-21 18:17:23 +09:00
Shirofune-Security 83ab9c8752 Require running firewall providers before recovery observations 2026-09-21 18:15:02 +09:00
Shirofune-Security e068bd8f52 Merge dev and preserve independent recovery and WEC commands 2026-09-21 18:11:29 +09:00
Shirofune-Security 07e3d37265 Merge branch 'dev' of https://github.com/Yamato-Security/WELA into feat/375-firewall-log-recovery 
# Conflicts:
#	.github/workflows/release.yml
#	CHANGELOG-Japanese.md
#	CHANGELOG.md
#	website/docs/resources/changelog.ja.md
#	website/docs/resources/changelog.md
 2026-09-21 18:09:42 +09:00
田中ザック Isaac Mathis 9d03a19082 Activate native SMB audit runtime switches explicitly (#441) 
* Add explicit native SMB runtime audit activation

* Select explicit PowerShell workflow shells and link PR changelog

* Clear expected refusal child exit codes after assertions

* Retain native SMB command provenance in capability diagnostics

* Bind SMB command guards to observed native CDXML module identities
 2026-09-21 18:09:10 +09:00
Shirofune-Security d590e8226a Merge branch 'dev' of https://github.com/Yamato-Security/WELA into feat/375-firewall-log-recovery 
# Conflicts:
#	.github/workflows/release.yml
#	CHANGELOG-Japanese.md
#	CHANGELOG.md
#	website/docs/resources/changelog.ja.md
#	website/docs/resources/changelog.md
 2026-09-21 18:04:28 +09:00
Shirofune-Security 1572d2b128 Pin observed CAPI2 XML and require existing running services 2026-09-21 18:03:42 +09:00
Shirofune-Security a5f674e3f8 Sign public certificate without copying its ephemeral private key 2026-09-21 17:56:04 +09:00
Shirofune-Security 43683b7aa3 Link guarded recovery from firewall configuration guide 2026-09-21 17:55:50 +09:00
田中ザック Isaac Mathis b4fb77da02 Review and apply existing WEC subscription enable/disable (#440) 
* Add reviewed existing WEC subscription state transitions

* Validate WEC destination and retain failed activation state
 2026-09-21 17:54:55 +09:00
Shirofune-Security afc748188d Merge branch 'dev' of https://github.com/Yamato-Security/WELA into feat/375-firewall-log-recovery 
# Conflicts:
#	.github/workflows/release.yml
#	CHANGELOG-Japanese.md
#	CHANGELOG.md
#	website/docs/resources/changelog.ja.md
#	website/docs/resources/changelog.md
 2026-09-21 17:52:42 +09:00
Shirofune-Security 23f88776bf Add guarded single-profile firewall logging recovery 2026-09-21 17:52:23 +09:00
Shirofune-Security 718ef8c91d Add fixed offline CAPI2 chain source probe 2026-09-21 17:51:31 +09:00
Shirofune-Security 1ea0687616 Merge dev and preserve recovery and IPsec release guides 2026-09-21 17:49:46 +09:00
Shirofune-Security 63b65e2447 Add reviewed native transcription policy recovery 2026-09-21 17:48:32 +09:00
田中ザック Isaac Mathis b7e649185b Gate conditional IPsec auditing on native prerequisite evidence (#439) 
* Gate conditional stronger-profile IPsec auditing on native evidence

* Use supported literal shells in native prerequisite matrix

* Retain native IPsec fixture diagnostics and allow inactive rule omission

* Expose exact native rule fields when prerequisite classification fails

* Recognize native inactive IPsec rules without granting applicability

* Restore standalone regression loading and valid owned IPsec auth defaults
 2026-09-21 17:42:53 +09:00
Shirofune-Security d1d40b4a25 Add reviewed recovery of completed event-log size and retention changes 2026-09-21 17:42:52 +09:00
田中ザック Isaac Mathis 7cd2eb9dbf Use precise native UTC for WMI probe event intervals (#438) 2026-09-21 17:30:16 +09:00
田中ザック Isaac Mathis fd7a7924aa Verify actual current-token access to built-in event channels (#432) 
* Add actual current-token native channel read evidence

* Use supported workflow shells and link channel-read changelogs

* Handle real event exceptions and bind loaded token helper to source

* Capture query-token interval after evidence and metadata preparation

* Retain native child process exit evidence across PowerShell engines

* Bound native reader fixture pipe draining and child termination

* Preserve native errors from attributed channel query statuses
 2026-09-21 09:18:46 +09:00
田中ザック Isaac Mathis c6da22a2ad Resume a reviewed pending AD CS auditing restart (#431) 
* Add reviewed recovery for a pending AD CS auditing restart

* Link pending CA restart recovery changelogs to PR 431
 2026-09-21 09:16:39 +09:00