田中ザック Isaac Mathis 5ba53fbcfb Validate native AppLocker EXE event generation with an opt-in probe (#423) ...

* Add native AppLocker EXE event validation probe

* Reference PR 423 in changelogs

* Isolate AppLocker native fixture and preserve prerequisite diagnostics

* Report an integer zero for an empty AppLocker policy

* Prepare disposable AppLocker probe policy without bypassing production importer guards

* Retain bounded native AppLocker channel diagnostics on probe failure

* Require native policy application before the disposable AppLocker probe

* Preserve exact timestamp strings in native evidence fixtures

* Record actual runner session and AppLocker publication diagnostics

* Activate and restore the native policy converter on disposable AppLocker hosts

* Compare native task freshness without guessing its timestamp timezone

* Verify effective policy and borrowed converter inactivity during fixture cleanup

* Track the actual native policy-converter task instance instead of cached timestamps

2026-09-20 22:46:56 +09:00

..

fixtures

Validate native AppLocker EXE event generation with an opt-in probe (#423)

2026-09-20 22:46:56 +09:00

AdcsAuditing.Tests.ps1

Guard AD CS audit configuration and collect native request evidence (#421)

2026-09-20 19:34:03 +09:00

AdcsAuditing.Windows.Tests.ps1

Guard AD CS audit configuration and collect native request evidence (#421)

2026-09-20 19:34:03 +09:00

AdObjectSacl.Tests.ps1

Isolate unknown dMSA prerequisites from other AD audit classes

2026-09-19 06:20:41 +09:00

AdObjectSacl.Windows.Tests.ps1

Confirm AD SACL receipt ownership and validate exact PKI parent

2026-09-19 05:47:54 +09:00

AppLockerProbe.Tests.ps1

Validate native AppLocker EXE event generation with an opt-in probe (#423)

2026-09-20 22:46:56 +09:00

AppLockerProbe.Windows.Tests.ps1

Validate native AppLocker EXE event generation with an opt-in probe (#423)

2026-09-20 22:46:56 +09:00

AppLockerReadiness.Tests.ps1

Validate native AppLocker EXE event generation with an opt-in probe (#423)

2026-09-20 22:46:56 +09:00

AppLockerReadiness.Windows.Tests.ps1

Handle unused AppLocker placeholders without weakening merge enforcement guards

2026-09-19 06:25:36 +09:00

audit-profiles.Tests.ps1

Preserve additional minimum audit flags and reject unknown CA roles

2026-09-18 22:04:43 +09:00

audit-profiles.Windows.Tests.ps1

Exercise real audit CLI export in Windows read-only smoke

2026-09-18 22:05:13 +09:00

AuditCatalogMappings.Tests.ps1

Correct legacy token audit GUID and validate catalog mapping uncertainty

2026-09-19 07:01:50 +09:00

AuditCatalogMappings.Windows.Tests.ps1

Correct legacy token audit GUID and validate catalog mapping uncertainty

2026-09-19 07:01:50 +09:00

AuditIntegrity.Tests.ps1

Add source-specific Windows audit privilege and integrity controls (#412)

2026-09-20 14:03:18 +09:00

AuditIntegrity.Windows.Tests.ps1

Add source-specific Windows audit privilege and integrity controls (#412)

2026-09-20 14:03:18 +09:00

AuditNotifications.Tests.ps1

Add OneSettings auditing and Security warning controls (#408)

2026-09-20 13:55:24 +09:00

AuditNotifications.Windows.Tests.ps1

Add OneSettings auditing and Security warning controls (#408)

2026-09-20 13:55:24 +09:00

AuditPrecedence.Tests.ps1

Read audit precedence provenance from documented RSoP schemas

2026-09-19 02:35:06 +09:00

AuditPrecedence.Windows.Tests.ps1

Verify advanced audit precedence before applying subcategories

2026-09-19 02:21:55 +09:00

AuditProfileNativeWriter.Tests.ps1

Fix audit applicability, NTLM value types, and native exit verification

2026-09-19 00:36:38 +09:00

AuditProfileOutput.Tests.ps1

Merge commit '45b6be91a8a35e1f08f6138fff70e0c6fafc58d1' into feat/387-native-rule-eligibility

2026-09-19 11:46:07 +09:00

AuditRecovery.Tests.ps1

Restore selected audit changes from reviewed recovery evidence (#419)

2026-09-20 19:30:49 +09:00

AuditRecovery.Windows.Tests.ps1

Restore selected audit changes from reviewed recovery evidence (#419)

2026-09-20 19:30:49 +09:00

AuditScoring.Tests.ps1

Add transparent configuration and native rule readiness scores (#417)

2026-09-20 18:15:04 +09:00

AuditScoring.Windows.Tests.ps1

Add transparent configuration and native rule readiness scores (#417)

2026-09-20 18:15:04 +09:00

ControlApplicability.Tests.ps1

Gate historical controls and require evidence for Windows defaults (#409)

2026-09-20 14:00:10 +09:00

ControlApplicability.Windows.Tests.ps1

Gate historical controls and require evidence for Windows defaults (#409)

2026-09-20 14:00:10 +09:00

CustomAuditProfiles.Tests.ps1

Support validated custom audit profile files through the shared engine (#416)

2026-09-20 18:09:52 +09:00

CustomAuditProfiles.Windows.Tests.ps1

Support validated custom audit profile files through the shared engine (#416)

2026-09-20 18:09:52 +09:00

DomainNtlm.Tests.ps1

Fix audit applicability, NTLM value types, and native exit verification

2026-09-19 00:36:38 +09:00

DomainNtlmAuditOutput.Tests.ps1

Assess native rule eligibility with explicit evidence gates

2026-09-19 07:24:04 +09:00

EventLogSettings.Tests.ps1

Unify event-log size and retention profiles with verified configuration

2026-09-19 02:30:41 +09:00

EventLogSettings.Windows.Tests.ps1

Unify event-log size and retention profiles with verified configuration

2026-09-19 02:30:41 +09:00

EvtxRecovery.Tests.ps1

Validate native AppLocker EXE event generation with an opt-in probe (#423)

2026-09-20 22:46:56 +09:00

EvtxRecovery.Windows.Tests.ps1

Export and verify recovery of native probe events from EVTX (#420)

2026-09-20 19:33:20 +09:00

FirewallLogging.Tests.ps1

Reject firewall log path drift before configuration

2026-09-19 02:33:53 +09:00

FirewallLogging.Windows.Tests.ps1

Add opt-in native firewall text logging controls

2026-09-19 02:24:38 +09:00

GpoAuditPackages.Tests.ps1

Add reviewable GPO audit-policy deployment packages (#415)

2026-09-20 18:13:34 +09:00

GpoAuditPackages.Windows.Tests.ps1

Add reviewable GPO audit-policy deployment packages (#415)

2026-09-20 18:13:34 +09:00

IntegrationNtlmConfiguration.Tests.ps1

Fix audit applicability, NTLM value types, and native exit verification

2026-09-19 00:36:38 +09:00

IntegrationProfileConfiguration.Tests.ps1

Plan targeted SACL prerequisites alongside audit profiles

2026-09-19 05:25:38 +09:00

IntegrationSafety.Tests.ps1

Fix audit applicability, NTLM value types, and native exit verification

2026-09-19 00:36:38 +09:00

IntuneAuditExport.Cli.Tests.ps1

Export native audit profiles for reviewed Intune client policies (#414)

2026-09-20 18:10:52 +09:00

IntuneAuditExport.Tests.ps1

Export native audit profiles for reviewed Intune client policies (#414)

2026-09-20 18:10:52 +09:00

LdapDiagnostics.Tests.ps1

Reject LDAP options before profile command dispatch

2026-09-19 07:15:31 +09:00

LdapDiagnostics.Windows.Tests.ps1

Make LDAP 1644 diagnostics explicit and preserve existing DC settings

2026-09-19 07:09:07 +09:00

NativeAuditControls.Tests.ps1

Verify source attribution and prerequisites in native control results

2026-09-18 22:00:52 +09:00

NativeChannelAccess.Tests.ps1

Add opt-in native WEF channel settings and preserved CAPI2 read access

2026-09-19 05:36:29 +09:00

NativeChannelAccess.Windows.Tests.ps1

Construct unknown ACE fixture without PowerShell enum validation

2026-09-19 05:42:06 +09:00

NativeProviderPacks.Tests.ps1

Add opt-in native DNS and provider audit packs (#411)

2026-09-20 13:58:49 +09:00

NativeProviderPacks.Windows.Tests.ps1

Add opt-in native DNS and provider audit packs (#411)

2026-09-20 13:58:49 +09:00

NativeProviders.Tests.ps1

Merge commit '45b6be91a8a35e1f08f6138fff70e0c6fafc58d1' into feat/387-native-rule-eligibility

2026-09-19 11:46:07 +09:00

NativeProviders.Windows.Tests.ps1

Assess native channels and provider prerequisites without static enabled claims

2026-09-19 02:29:56 +09:00

NativeValidation.Tests.ps1

Collect native 4688 validation components with a fixed benign probe (#413)

2026-09-20 18:08:34 +09:00

NativeValidation.Windows.Tests.ps1

Collect native 4688 validation components with a fixed benign probe (#413)

2026-09-20 18:08:34 +09:00

OutgoingNtlm.Tests.ps1

Fix audit applicability, NTLM value types, and native exit verification

2026-09-19 00:36:38 +09:00

PowerShellTranscription.Tests.ps1

Add opt-in Windows PowerShell transcription for CIS Level 2

2026-09-19 07:09:33 +09:00

PowerShellTranscription.Windows.Tests.ps1

Add opt-in Windows PowerShell transcription for CIS Level 2

2026-09-19 07:09:33 +09:00

RetentionHealth.Cli.Tests.ps1

Report native log retention and collection health evidence (#410)

2026-09-20 14:01:43 +09:00

RetentionHealth.Tests.ps1

Report native log retention and collection health evidence (#410)

2026-09-20 14:01:43 +09:00

RetentionHealth.Windows.Tests.ps1

Report native log retention and collection health evidence (#410)

2026-09-20 14:01:43 +09:00

RuleEligibility.Tests.ps1

Use explicit canonical framing for portable metadata hashes

2026-09-19 07:39:47 +09:00

SelectedSacl.Tests.ps1

Apply reviewed SACL plans to explicitly selected local targets (#422)

2026-09-20 19:36:05 +09:00

SelectedSacl.Windows.Tests.ps1

Apply reviewed SACL plans to explicitly selected local targets (#422)

2026-09-20 19:36:05 +09:00

SmbAuditing.Tests.ps1

Separate SMB policy verification from runtime activation

2026-09-19 04:39:55 +09:00

SmbAuditing.Windows.Tests.ps1

Separate SMB policy verification from runtime activation

2026-09-19 04:39:55 +09:00

TargetedSaclPlanning.Tests.ps1

Preserve configured user-file suffixes in SACL plans

2026-09-19 06:21:18 +09:00

TargetedSaclPlanning.Windows.Tests.ps1

Plan targeted SACL prerequisites alongside audit profiles

2026-09-19 05:25:38 +09:00

Test-ConfigurationReadOnlyWindows.ps1

Clear expected child failure codes after regression assertions

2026-09-18 21:56:01 +09:00

Test-ConfigurationResults.ps1

Guard AD CS audit configuration and collect native request evidence (#421)

2026-09-20 19:34:03 +09:00

Test-ConfigurationScriptScopeWindows.ps1

Keep deferred configuration callbacks in script scope on PowerShell 5.1

2026-09-18 22:13:58 +09:00

WefArrival.Tests.ps1

Validate native AppLocker EXE event generation with an opt-in probe (#423)

2026-09-20 22:46:56 +09:00

WefArrival.Windows.Tests.ps1

Verify native probe arrival in the local WEF collector (#418)

2026-09-20 19:26:57 +09:00

WefDeployment.Cli.Tests.ps1

Clear expected child failure exit status after CLI assertions

2026-09-19 07:33:32 +09:00

WefDeployment.Tests.ps1

Normalize WEF XML evidence before PowerShell 5.1 JSON serialization

2026-09-19 07:31:23 +09:00

WefDeployment.Windows.Tests.ps1

Clear handled native-read exit status after Windows smoke assertions

2026-09-19 07:35:04 +09:00

WmiNamespaceAuditing.DisposableNamespace.Tests.ps1

Verify native WMI SACL flags on disposable Windows namespaces

2026-09-19 06:20:32 +09:00

WmiNamespaceAuditing.Privilege.Tests.ps1

Restrict native WMI writes to SACL and verify privilege cleanup

2026-09-19 05:41:08 +09:00

WmiNamespaceAuditing.Tests.ps1

Add opt-in WMI namespace audit SACL workflow

2026-09-19 05:30:12 +09:00

WmiNamespaceAuditing.Windows.Tests.ps1

Restrict native WMI writes to SACL and verify privilege cleanup

2026-09-19 05:41:08 +09:00