WELA/docs at dev - WELA

ad-object-sacl.md

Isolate unknown dMSA prerequisites from other AD audit classes

2026-09-19 06:20:41 +09:00

adcs-auditing.md

Resume a reviewed pending AD CS auditing restart (#431 )

2026-09-21 09:16:39 +09:00

adcs-restart-resume.md

Resume a reviewed pending AD CS auditing restart (#431 )

2026-09-21 09:16:39 +09:00

applocker-probe.md

Document Script evidence boundaries and retain bounded startup diagnostics

2026-09-21 22:26:34 +09:00

applocker-readiness.md

docs: document native issue coverage

2026-09-23 07:37:09 +09:00

applocker-script-probe.md

Refuse stopped service dependencies before AppLocker CIM observation

2026-09-21 22:34:09 +09:00

audit-catalog-mappings.md

docs: close issue applicability

2026-09-22 18:20:23 +09:00

audit-integrity.md

docs: close issue integrity

2026-09-22 18:20:21 +09:00

audit-notifications.md

fix: preserve omitted notification selection and document native OneSettings acceptance

2026-09-22 12:06:07 +09:00

audit-profiles.md

Exercise public profile configuration against native audit policy

2026-09-22 07:41:18 +09:00

audit-recovery.md

Link named registry recovery changelog and native API contracts

2026-09-21 09:35:10 +09:00

audit-scoring.md

docs: fix issue coverage heading

2026-09-23 07:05:56 +09:00

capi2-probe.md

Pin observed CAPI2 XML and require existing running services

2026-09-21 18:03:42 +09:00

channel-read.md

Verify actual current-token access to built-in event channels (#432 )

2026-09-21 09:18:46 +09:00

channel-recovery.md

Add reviewed recovery of one completed native channel operation

2026-09-22 07:52:16 +09:00

configuration-results.md

Clarify unsupported common parameters and integrate native channel tests

2026-09-22 07:21:55 +09:00

control-applicability.md

Gate historical controls and require evidence for Windows defaults (#409 )

2026-09-20 14:00:10 +09:00

custom-audit-profiles.md

docs: fix issue coverage heading

2026-09-23 07:05:54 +09:00

dns-analytical.md

Add guarded DNS analytical logging and stopped-trace archives (#425 )

2026-09-20 22:49:52 +09:00

dns-client-probe.md

Use precise native DNS operation timestamps and nonce-only event reads

2026-09-21 10:47:06 +09:00

event-measurement.md

Measure bounded native event delivery and verify exact EVTX samples (#430 )

2026-09-21 09:14:48 +09:00

eventlog-recovery.md

Bind the reviewed native host gate and context dependency

2026-09-21 18:17:23 +09:00

eventlog-settings.md

docs: document native issue coverage

2026-09-23 07:37:17 +09:00

evtx-recovery.md

Verify native EVTX recovery under the actual primary reader token

2026-09-21 09:30:59 +09:00

failed-logon-probe.md

Add a native local failed-logon audit probe (#444 )

2026-09-21 22:13:20 +09:00

file-access-probe.md

Measure held-readback phase and refuse implementation targets before hashing

2026-09-21 22:51:50 +09:00

file-sacl-recovery.md

Verify the observed present-null SACL after sole audit ACE removal

2026-09-21 10:26:57 +09:00

firewall-logging-recovery.md

Require running firewall providers before recovery observations

2026-09-21 18:15:02 +09:00

firewall-logging.md

Link guarded recovery from firewall configuration guide

2026-09-21 17:55:50 +09:00

gpo-audit-packages.md

Create new disabled, unlinked GPOs from reviewed native audit backups (#427 )

2026-09-20 22:53:00 +09:00

gpo-creation.md

docs: fix issue coverage heading

2026-09-23 07:05:57 +09:00

gpo-package-deployment.md

Create new disabled, unlinked GPOs from reviewed native audit backups (#427 )

2026-09-20 22:53:00 +09:00

intune-audit-export.md

docs: fix issue coverage heading

2026-09-23 07:05:59 +09:00

ipsec-prerequisites.md

Gate conditional IPsec auditing on native prerequisite evidence (#439 )

2026-09-21 17:42:53 +09:00

ldap-diagnostics.md

docs: close issue ldap

2026-09-22 18:20:19 +09:00

native-channel-access.md

Add reviewed recovery of one completed native channel operation

2026-09-22 07:52:16 +09:00

native-filesystem-sacl-validation.md

test: complete filesystem lifecycle fixture dependencies and evidence guide

2026-09-22 11:59:29 +09:00

native-onesettings-acceptance.md

docs: document native issue coverage

2026-09-23 07:37:21 +09:00

native-provider-acceptance.md

Handle native WinRM manifest IDs without Int32 overflow

2026-09-22 10:10:01 +09:00

native-provider-assessment.md

Assess native rule eligibility with explicit evidence gates

2026-09-19 07:24:04 +09:00

native-provider-packs.md

docs: close issue providers

2026-09-22 18:20:25 +09:00

native-registry-sacl-validation.md

test: run registry fixtures in explicit native shells and document evidence

2026-09-22 08:06:51 +09:00

native-rule-eligibility.md

docs: fix issue coverage heading

2026-09-23 07:05:51 +09:00

native-token-right-attribution.md

docs: document native issue coverage

2026-09-23 07:37:13 +09:00

native-validation.md

Collect native 4688 validation components with a fixed benign probe (#413 )

2026-09-20 18:08:34 +09:00

ntlm-auditing.md

fix: require running WMI before scoped NTLM observations

2026-09-22 12:06:11 +09:00

outgoing-ntlm.md

feat: configure selected incoming and domain NTLM audit policies

2026-09-22 12:03:11 +09:00

powershell-logging.md

Reject scoped logging changes that overflow bounded policy inventories

2026-09-22 15:19:20 +09:00

powershell-transcription.md

Integrate current native auditing commands with transcript verification

2026-09-22 14:24:29 +09:00

process-commandline.md

Add scoped native 4688 command-line policy configuration

2026-09-22 14:34:05 +09:00

registry-sacl-recovery.md

fix: accept exact native empty catalog representations and document recovery

2026-09-22 11:01:38 +09:00

registry-value-probe.md

Reserve registry probe capacity and isolate exact-value cleanup

2026-09-22 14:59:21 +09:00

retention-health.md

docs: close issue retention

2026-09-22 18:20:17 +09:00

selected-sacl-configuration.md

test: complete filesystem lifecycle fixture dependencies and evidence guide

2026-09-22 11:59:29 +09:00

smb-auditing.md

docs: document native issue coverage

2026-09-23 07:37:25 +09:00

smb-runtime-activation.md

Activate native SMB audit runtime switches explicitly (#441 )

2026-09-21 18:09:10 +09:00

targeted-sacl-planning.md

Apply reviewed SACL plans to explicitly selected local targets (#422 )

2026-09-20 19:36:05 +09:00

transcript-probe.md

Clarify character bounds for worker diagnostics

2026-09-21 09:55:35 +09:00

transcription-recovery.md

Explain disabled transcription after interrupted recovery

2026-09-21 22:09:06 +09:00

wec-authorization.md

Review and update only source SID authorization on disabled WEC subscriptions

2026-09-22 07:50:50 +09:00

wec-collector-observation.md

Fix native collector subscription inventory and Unicode readback

2026-09-22 09:46:28 +09:00

wec-ingress.md

Add reviewed scoped collector firewall ingress creation (#442 )

2026-09-21 18:19:30 +09:00

wec-listener.md

Verify effective native worker module path and complete fixture exit status

2026-09-21 23:07:16 +09:00

wec-runtime.md

Add typed native WEC runtime observations (#424 )

2026-09-20 22:48:32 +09:00

wec-state.md

Review and apply existing WEC subscription enable/disable (#440 )

2026-09-21 17:54:55 +09:00

wec-update.md

Review and apply existing WEC subscription enable/disable (#440 )

2026-09-21 17:54:55 +09:00

wef-arrival.md

Verify native probe arrival in the local WEF collector (#418 )

2026-09-20 19:26:57 +09:00

wef-deployment.md

Validate typed source inputs and preserve caller scope in query reader

2026-09-22 12:10:03 +09:00

wef-query.md

fix: decode native WEF XML independently of property count

2026-09-22 12:37:37 +09:00

wmi-descendants.md

Reject unexplained descendant changes and unrelated WMI command arguments

2026-09-22 14:45:06 +09:00

wmi-namespace-auditing.md

Document bounded WMI tree guarantees and record native protection behavior

2026-09-22 14:40:25 +09:00

wmi-probe.md

Use precise native UTC for WMI probe event intervals (#438 )

2026-09-21 17:30:16 +09:00

wmi-sacl-recovery.md

Add reviewed removal of one proven parent-only WMI audit ACE

2026-09-22 14:43:33 +09:00