Shirofune-Security 83ab9c8752 Require running firewall providers before recovery observations

2026-09-21 18:15:02 +09:00

..

ad-object-sacl.md

Isolate unknown dMSA prerequisites from other AD audit classes

2026-09-19 06:20:41 +09:00

adcs-auditing.md

Resume a reviewed pending AD CS auditing restart (#431)

2026-09-21 09:16:39 +09:00

adcs-restart-resume.md

Resume a reviewed pending AD CS auditing restart (#431)

2026-09-21 09:16:39 +09:00

applocker-probe.md

Validate native AppLocker EXE event generation with an opt-in probe (#423)

2026-09-20 22:46:56 +09:00

applocker-readiness.md

Handle unused AppLocker placeholders without weakening merge enforcement guards

2026-09-19 06:25:36 +09:00

audit-catalog-mappings.md

Correct legacy token audit GUID and validate catalog mapping uncertainty

2026-09-19 07:01:50 +09:00

audit-integrity.md

Add source-specific Windows audit privilege and integrity controls (#412)

2026-09-20 14:03:18 +09:00

audit-notifications.md

Add OneSettings auditing and Security warning controls (#408)

2026-09-20 13:55:24 +09:00

audit-profiles.md

Gate conditional IPsec auditing on native prerequisite evidence (#439)

2026-09-21 17:42:53 +09:00

audit-recovery.md

Restore selected audit changes from reviewed recovery evidence (#419)

2026-09-20 19:30:49 +09:00

audit-scoring.md

Add transparent configuration and native rule readiness scores (#417)

2026-09-20 18:15:04 +09:00

channel-read.md

Verify actual current-token access to built-in event channels (#432)

2026-09-21 09:18:46 +09:00

configuration-results.md

Merge commit '88c84fa' into HEAD

2026-09-19 04:49:40 +09:00

control-applicability.md

Gate historical controls and require evidence for Windows defaults (#409)

2026-09-20 14:00:10 +09:00

custom-audit-profiles.md

Support validated custom audit profile files through the shared engine (#416)

2026-09-20 18:09:52 +09:00

dns-analytical.md

Add guarded DNS analytical logging and stopped-trace archives (#425)

2026-09-20 22:49:52 +09:00

event-measurement.md

Measure bounded native event delivery and verify exact EVTX samples (#430)

2026-09-21 09:14:48 +09:00

eventlog-settings.md

Unify event-log size and retention profiles with verified configuration

2026-09-19 02:30:41 +09:00

evtx-recovery.md

Export and verify recovery of native probe events from EVTX (#420)

2026-09-20 19:33:20 +09:00

firewall-logging-recovery.md

Require running firewall providers before recovery observations

2026-09-21 18:15:02 +09:00

firewall-logging.md

Link guarded recovery from firewall configuration guide

2026-09-21 17:55:50 +09:00

gpo-audit-packages.md

Create new disabled, unlinked GPOs from reviewed native audit backups (#427)

2026-09-20 22:53:00 +09:00

gpo-creation.md

Create new disabled, unlinked GPOs from reviewed native audit backups (#427)

2026-09-20 22:53:00 +09:00

gpo-package-deployment.md

Create new disabled, unlinked GPOs from reviewed native audit backups (#427)

2026-09-20 22:53:00 +09:00

intune-audit-export.md

Export native audit profiles for reviewed Intune client policies (#414)

2026-09-20 18:10:52 +09:00

ipsec-prerequisites.md

Gate conditional IPsec auditing on native prerequisite evidence (#439)

2026-09-21 17:42:53 +09:00

ldap-diagnostics.md

Reject LDAP options before profile command dispatch

2026-09-19 07:15:31 +09:00

native-channel-access.md

Verify actual current-token access to built-in event channels (#432)

2026-09-21 09:18:46 +09:00

native-provider-assessment.md

Assess native rule eligibility with explicit evidence gates

2026-09-19 07:24:04 +09:00

native-provider-packs.md

Add guarded DNS analytical logging and stopped-trace archives (#425)

2026-09-20 22:49:52 +09:00

native-rule-eligibility.md

Use explicit canonical framing for portable metadata hashes

2026-09-19 07:39:47 +09:00

native-validation.md

Collect native 4688 validation components with a fixed benign probe (#413)

2026-09-20 18:08:34 +09:00

powershell-transcription.md

Record passing Windows transcription evidence and link PR 405

2026-09-19 07:13:22 +09:00

retention-health.md

Add typed native WEC runtime observations (#424)

2026-09-20 22:48:32 +09:00

selected-sacl-configuration.md

Verify reviewed descendant SACL propagation and preservation (#429)

2026-09-21 09:12:56 +09:00

smb-auditing.md

Activate native SMB audit runtime switches explicitly (#441)

2026-09-21 18:09:10 +09:00

smb-runtime-activation.md

Activate native SMB audit runtime switches explicitly (#441)

2026-09-21 18:09:10 +09:00

targeted-sacl-planning.md

Apply reviewed SACL plans to explicitly selected local targets (#422)

2026-09-20 19:36:05 +09:00

wec-runtime.md

Add typed native WEC runtime observations (#424)

2026-09-20 22:48:32 +09:00

wec-state.md

Review and apply existing WEC subscription enable/disable (#440)

2026-09-21 17:54:55 +09:00

wec-update.md

Review and apply existing WEC subscription enable/disable (#440)

2026-09-21 17:54:55 +09:00

wef-arrival.md

Verify native probe arrival in the local WEF collector (#418)

2026-09-20 19:26:57 +09:00

wef-deployment.md

Add typed native WEC runtime observations (#424)

2026-09-20 22:48:32 +09:00

wmi-namespace-auditing.md

Collect local WMI namespace audit evidence with a fixed read probe (#428)

2026-09-21 09:08:20 +09:00

wmi-probe.md

Use precise native UTC for WMI probe event intervals (#438)

2026-09-21 17:30:16 +09:00