田中ザック Isaac Mathis
5ba53fbcfb
Validate native AppLocker EXE event generation with an opt-in probe ( #423 )
...
* Add native AppLocker EXE event validation probe
* Reference PR 423 in changelogs
* Isolate AppLocker native fixture and preserve prerequisite diagnostics
* Report an integer zero for an empty AppLocker policy
* Prepare disposable AppLocker probe policy without bypassing production importer guards
* Retain bounded native AppLocker channel diagnostics on probe failure
* Require native policy application before the disposable AppLocker probe
* Preserve exact timestamp strings in native evidence fixtures
* Record actual runner session and AppLocker publication diagnostics
* Activate and restore the native policy converter on disposable AppLocker hosts
* Compare native task freshness without guessing its timestamp timezone
* Verify effective policy and borrowed converter inactivity during fixture cleanup
* Track the actual native policy-converter task instance instead of cached timestamps
2026-09-20 22:46:56 +09:00
田中ザック Isaac Mathis
ff0e5c1890
Apply reviewed SACL plans to explicitly selected local targets ( #422 )
...
* Add reviewed configuration for selected native SACL targets
* Link selected SACL changelog to PR 422
* Identify native full-descriptor read failures without partial fallback
* Fix diagnostic variable scope in native C# helper
* Read explicit descriptor sections and retain observation scope
2026-09-20 19:36:05 +09:00
田中ザック Isaac Mathis
f1c1f74166
Guard AD CS audit configuration and collect native request evidence ( #421 )
...
* Add guarded native CA auditing and disposable request evidence
* Link AD CS changelog to PR 421
* Retain primary native CA failure before cleanup diagnostics
* Normalize native CA certificate hashes and record pending feature removal
* Emit bounded disposable CA request matching diagnostics
* Match observed version 1 CA request events with exact pending disposition
2026-09-20 19:34:03 +09:00
田中ザック Isaac Mathis
f21a9f30e4
Add transparent configuration and native rule readiness scores ( #417 )
...
* Add transparent native audit compliance and evidence readiness scores
* Link transparent audit scoring changelog to PR 417
* Resolve scoring outputs against the PowerShell filesystem location
2026-09-20 18:15:04 +09:00
田中ザック Isaac Mathis
14ac8667d4
Gate historical controls and require evidence for Windows defaults ( #409 )
...
* Gate historical controls and require provenance for Windows defaults
* Bind default evidence to UTC provenance and native architecture
* Reference PR 409 in applicability changelogs
2026-09-20 14:00:10 +09:00
田中ザック Isaac Mathis
d35b1374d0
Add opt-in native DNS and provider audit packs ( #411 )
...
* Add selective native provider packs with pinned rule and schema evidence
* Reference PR 411 in provider-pack changelogs
* Fix provider pack service reader export and CI exit propagation
2026-09-20 13:58:49 +09:00
Shirofune-Security
e8a0aeb59b
Keep rule evidence identities stable across Windows checkouts and shells
2026-09-19 07:34:10 +09:00
田中ザック Isaac Mathis