Shirofune-Security
bfa286bf7d
Integrate reviewed WMI recovery with combined dev auditing batch
2026-09-22 15:06:51 +09:00
Shirofune-Security
e584345df3
Integrate approved native recovery PRs before dev merge
2026-09-22 15:05:40 +09:00
Shirofune-Security
2b270042e7
Stack leaf-file recovery and preserve scoped NTLM dry-run integration
2026-09-22 15:03:17 +09:00
Shirofune-Security
3c47442634
Stack named registry recovery on reviewed logging integration
2026-09-22 15:01:03 +09:00
Shirofune-Security
1dfd3a92b9
Stack intended-reader EVTX recovery on the approved native auditing batch
2026-09-22 14:56:09 +09:00
Shirofune-Security
ab45d03f15
Add reviewed removal of one proven parent-only WMI audit ACE
2026-09-22 14:43:33 +09:00
Shirofune-Security
3ba8a45d80
Integrate current native auditing commands with transcript verification
2026-09-22 14:24:29 +09:00
Shirofune-Security
0ef22f20fa
Merge dev and preserve leaf-file SACL recovery integration
2026-09-22 14:24:24 +09:00
Shirofune-Security
4598bb36f7
Integrate current dev with intended-reader EVTX verification
2026-09-22 14:24:04 +09:00
Shirofune-Security
397dfbf006
Merge dev and preserve named registry recovery integration
2026-09-22 14:23:55 +09:00
Shirofune-Security
7ef29df61f
Integrate reviewed native auditing batch and preserve 4703 validation
2026-09-22 14:23:44 +09:00
Shirofune-Security
2fef35da23
Integrate reviewed native auditing commands with OneSettings validation
2026-09-22 14:23:33 +09:00
Shirofune-Security
005b249c3b
Integrate reviewed filesystem and WEF query changes with scoped NTLM auditing
2026-09-22 14:23:24 +09:00
Shirofune-Security
34b7a775c4
Merge dev and preserve filesystem lifecycle and WEF query changes
2026-09-22 14:23:10 +09:00
Shirofune-Security
160b573a99
test: bind native 4703 attribution to installed schema and exact restored context
2026-09-22 12:34:43 +09:00
Shirofune-Security
9692edcec6
fix: normalize native WEF reader tokens before strict validation
2026-09-22 12:30:51 +09:00
Shirofune-Security
353159615e
fix: preserve omitted notification selection and document native OneSettings acceptance
2026-09-22 12:06:07 +09:00
Shirofune-Security
b162c4e598
feat: configure selected incoming and domain NTLM audit policies
2026-09-22 12:03:11 +09:00
Shirofune-Security
0f95115908
test: establish owned redirected-profile native SACL fixture
2026-09-22 11:49:31 +09:00
Shirofune-Security
70a812556d
Merge commit '29f03e352823af81b35869659928a94e70df4cf9' into feat/373-registry-sacl-recovery
...
# Conflicts:
# .gitattributes
# .github/workflows/release.yml
# CHANGELOG-Japanese.md
# CHANGELOG.md
# website/docs/resources/changelog.ja.md
# website/docs/resources/changelog.md
2026-09-22 11:43:28 +09:00
Shirofune-Security
008a8c80b9
Merge remote-tracking branch 'origin/dev' into fix/368-native-collector-observation
...
# Conflicts:
# .github/workflows/release.yml
# CHANGELOG-Japanese.md
# CHANGELOG.md
# website/docs/resources/changelog.ja.md
# website/docs/resources/changelog.md
2026-09-22 11:42:00 +09:00
Shirofune-Security
530b49f26b
feat: checkpoint reviewed native registry SACL recovery
2026-09-22 10:11:02 +09:00
Shirofune-Security
af88b87e01
Fix native collector subscription inventory and Unicode readback
2026-09-22 09:46:28 +09:00
Shirofune-Security
f403521068
Merge commit '03039cb1c653f75cc0052ed93c7699290873058e' into test/386-native-provider-configure
...
# Conflicts:
# .gitattributes
# .github/workflows/release.yml
# CHANGELOG-Japanese.md
# CHANGELOG.md
# website/docs/resources/changelog.ja.md
# website/docs/resources/changelog.md
2026-09-22 09:41:21 +09:00
Shirofune-Security
8af856ffa6
Validate public provider pack configuration on native Windows
2026-09-22 09:40:56 +09:00
Shirofune-Security
ac45e8f72f
Merge commit 'dc7867b6bc1193e3b5d54a9c7368c0647c39b663' into test/373-native-registry-sacl-lifecycle
...
# Conflicts:
# .gitattributes
# .github/workflows/release.yml
# CHANGELOG-Japanese.md
# CHANGELOG.md
# website/docs/resources/changelog.ja.md
# website/docs/resources/changelog.md
2026-09-22 09:35:07 +09:00
Shirofune-Security
dc7867b6bc
Merge commit 'ffe4ed473414438d5465156e15b62796393daf80' into feat/368-reviewed-wec-authorization
...
# Conflicts:
# .gitattributes
# .github/workflows/release.yml
# CHANGELOG-Japanese.md
# CHANGELOG.md
# website/docs/resources/changelog.ja.md
# website/docs/resources/changelog.md
2026-09-22 09:35:07 +09:00
Shirofune-Security
a62c3b7def
test: exercise public registry SACL lifecycle and native4657
2026-09-22 08:01:48 +09:00
Shirofune-Security
0ff81052e6
Merge commit '39e8ce1' into feat/367-reviewed-channel-recovery
...
# Conflicts:
# .gitattributes
# .github/workflows/release.yml
# CHANGELOG-Japanese.md
# CHANGELOG.md
# website/docs/resources/changelog.ja.md
# website/docs/resources/changelog.md
2026-09-22 07:53:01 +09:00
Shirofune-Security
0c51232a40
Add reviewed recovery of one completed native channel operation
2026-09-22 07:52:16 +09:00
Shirofune-Security
0051f8c662
Review and update only source SID authorization on disabled WEC subscriptions
2026-09-22 07:50:50 +09:00
Shirofune-Security
39e8ce1d70
Resolve combined native source line-ending attributes
2026-09-22 07:25:54 +09:00
Shirofune-Security
0d1adfb442
Integrate reviewed CLI, channel and native probe changes
2026-09-22 07:25:37 +09:00
Shirofune-Security
3e9ba8c403
Create one reviewed exact-IP collector listener through a bounded native adapter
2026-09-21 22:58:08 +09:00
Shirofune-Security
ce7b49a5ac
Bind observed native file paths and document exact read evidence
2026-09-21 22:40:50 +09:00
Shirofune-Security
9bc243a041
Integrate final reviewed development base for CAPI2 probe
2026-09-21 18:21:10 +09:00
Shirofune-Security
ec21453cf2
Bind strict receipt parser into CAPI2 source evidence
2026-09-21 18:11:13 +09:00
田中ザック Isaac Mathis
b4fb77da02
Review and apply existing WEC subscription enable/disable ( #440 )
...
* Add reviewed existing WEC subscription state transitions
* Validate WEC destination and retain failed activation state
2026-09-21 17:54:55 +09:00
Shirofune-Security
718ef8c91d
Add fixed offline CAPI2 chain source probe
2026-09-21 17:51:31 +09:00
Shirofune-Security
2b1a3bce82
Add guarded recovery for one selected leaf-file audit ACE
2026-09-21 10:03:00 +09:00
Shirofune-Security
480ddea0b4
Add current-account automatic transcription probe
2026-09-21 09:43:39 +09:00
Shirofune-Security
9327d04fc9
Add guarded value-only recovery for named logging DWORDs
2026-09-21 09:34:13 +09:00
Shirofune-Security
2631331406
Verify native EVTX recovery under the actual primary reader token
2026-09-21 09:30:59 +09:00
田中ザック Isaac Mathis
fd7a7924aa
Verify actual current-token access to built-in event channels ( #432 )
...
* Add actual current-token native channel read evidence
* Use supported workflow shells and link channel-read changelogs
* Handle real event exceptions and bind loaded token helper to source
* Capture query-token interval after evidence and metadata preparation
* Retain native child process exit evidence across PowerShell engines
* Bound native reader fixture pipe draining and child termination
* Preserve native errors from attributed channel query statuses
2026-09-21 09:18:46 +09:00
田中ザック Isaac Mathis
c6da22a2ad
Resume a reviewed pending AD CS auditing restart ( #431 )
...
* Add reviewed recovery for a pending AD CS auditing restart
* Link pending CA restart recovery changelogs to PR 431
2026-09-21 09:16:39 +09:00
田中ザック Isaac Mathis
2fd37d0318
Measure bounded native event delivery and verify exact EVTX samples ( #430 )
...
* Add bounded local delivery measurement and exact EVTX samples
* Link delivery measurement changelog to PR 430
* Reject evidence aliases before Windows path normalization
* Use PowerShell 5.1-compatible record IDs and bound fixture cleanup
* Revalidate the native EVTX artifact before recording final evidence
* Require exact observed local computer identities for sampled events
* Clarify provider scope within shared built-in event channels
* Preserve mixed XML payload ordering in EVTX sample verification
* Bound ordered event XML comparisons for nested UserData
* Dispose observer wait handle when bookmark creation fails
2026-09-21 09:14:48 +09:00
田中ザック Isaac Mathis
bcd4e9717e
Verify reviewed descendant SACL propagation and preservation ( #429 )
...
* Verify reviewed descendant SACL propagation and preservation
* Reference descendant SACL PR429 in release notes
* Prepare protected disposable SACL fixtures through native handles
* Use read-control handles for disposable native SACL protection
2026-09-21 09:12:56 +09:00
田中ザック Isaac Mathis
b84b97b358
Collect local WMI namespace audit evidence with a fixed read probe ( #428 )
...
* Collect bounded local WMI namespace access evidence
* Reference PR428 and preserve UTC worker query timestamps
* Observe equivalent runtime self tokens without reverting caller context
* Test native token equivalence against restricted caller changes
* Diagnose native token differences and package WMI probe guidance
* Limit WMI connections to the explicitly scoped security privilege
* Document verified native WMI events and privilege preservation
* Require an already-running WMI service before namespace reads
2026-09-21 09:08:20 +09:00
田中ザック Isaac Mathis
610d27e8ff
Review and apply query updates to existing disabled WEC subscriptions ( #426 )
...
* Add reviewed existing-only updates for disabled WEC subscriptions
* Pin loaded updater and flush locked recovery artifacts; reference PR 426
* Compare formatted WEC queries semantically before pinning raw native state
* Read native WEC subscription XML with bounded explicit Unicode pipes
* Use explicit Unicode reads for reviewed update and native cleanup
* Keep timestamp strings exact in inherited native evidence fixtures
* Reject XML-invalid descriptions before any native save
* Decode native WEC XML BOMs without unsupported Unicode switch
* Describe native XML byte decoding accurately
* Reference System.Xml explicitly when compiling under Windows PowerShell
2026-09-20 22:51:01 +09:00
田中ザック Isaac Mathis
c12e49213f
Add guarded DNS analytical logging and stopped-trace archives ( #425 )
...
* Add guarded DNS analytical channel lifecycle and trace archives
* Link DNS analytical changelogs to PR425
* Fix native DNS archive inspection and guard artifact paths
* Diagnose exact DNS event envelope from stopped native trace
* Verify DNS ETL event provenance without inventing XML channel
* Preserve exact UTC timestamp strings in shared evidence fixtures
2026-09-20 22:49:52 +09:00
Shirofune-Security