田中ザック Isaac Mathis 2fd37d0318 Measure bounded native event delivery and verify exact EVTX samples (#430) ...

* Add bounded local delivery measurement and exact EVTX samples

* Link delivery measurement changelog to PR 430

* Reject evidence aliases before Windows path normalization

* Use PowerShell 5.1-compatible record IDs and bound fixture cleanup

* Revalidate the native EVTX artifact before recording final evidence

* Require exact observed local computer identities for sampled events

* Clarify provider scope within shared built-in event channels

* Preserve mixed XML payload ordering in EVTX sample verification

* Bound ordered event XML comparisons for nested UserData

* Dispose observer wait handle when bookmark creation fails

2026-09-21 09:14:48 +09:00

..

provider_rule_sources

Add opt-in native DNS and provider audit packs (#411)

2026-09-20 13:58:49 +09:00

wef-examples

Add opt-in native WEF source and collector subscription controls

2026-09-19 07:23:47 +09:00

audit_integrity_profiles.json

Add source-specific Windows audit privilege and integrity controls (#412)

2026-09-20 14:03:18 +09:00

audit_profiles.json

Add six missing native audit subcategories with source-specific masks

2026-09-18 21:58:33 +09:00

audit_sacl_targets.json

Address Copilot re-review: %SystemRoot%, Entra SIDs, WOW64 gate, reg-unload check, subcategory-failure, help

2026-09-17 22:49:42 +09:00

audit_scoring.json

Add transparent configuration and native rule readiness scores (#417)

2026-09-20 18:15:04 +09:00

baselines.json

Correct legacy token audit GUID and validate catalog mapping uncertainty

2026-09-19 07:01:50 +09:00

control_applicability.json

Gate historical controls and require evidence for Windows defaults (#409)

2026-09-20 14:00:10 +09:00

custom-audit-profile.example.json

Support validated custom audit profile files through the shared engine (#416)

2026-09-20 18:09:52 +09:00

eid_subcategory_mapping.csv

update

2025-03-10 18:36:30 +09:00

event_measurement.json

Measure bounded native event delivery and verify exact EVTX samples (#430)

2026-09-21 09:14:48 +09:00

eventlog_profiles.json

Unify event-log size and retention profiles with verified configuration

2026-09-19 02:30:41 +09:00

intune_audit_csp.json

Export native audit profiles for reviewed Intune client policies (#414)

2026-09-20 18:10:52 +09:00

native_channel_profile.json

Add opt-in native WEF channel settings and preserved CAPI2 read access

2026-09-19 05:36:29 +09:00

native_provider_packs.json

Add opt-in native DNS and provider audit packs (#411)

2026-09-20 13:58:49 +09:00

retention-collector.example.json

Report native log retention and collection health evidence (#410)

2026-09-20 14:01:43 +09:00

retention-source.example.json

Report native log retention and collection health evidence (#410)

2026-09-20 14:01:43 +09:00

rule_eligibility_manifest.json

Assess native rule eligibility with explicit evidence gates

2026-09-19 07:24:04 +09:00

security_rules.json

Sigma Rule Update (2026-09-01 22:29:49) (#359)

2026-09-01 22:29:56 +00:00