mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 04:32:32 +00:00
added centralized guardrails for easier maintenance, added some more gather rules
This commit is contained in:
Oliver Kieselbach
+140
@@ -1,6 +1,25 @@
|
||||
{
|
||||
"$schema": "../schema/gather-rule.schema.json",
|
||||
"rules": [
|
||||
{
|
||||
"ruleId": "GATHER-APPS-001",
|
||||
"title": "IME Logs directory check",
|
||||
"description": "Checks whether the Intune Management Extension log directory exists and reports file sizes. Useful to verify IME is active and logs are being written.",
|
||||
"category": "apps",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "file",
|
||||
"target": "C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
|
||||
"trigger": "startup",
|
||||
"outputEventType": "gather_ime_logs_directory",
|
||||
"outputSeverity": "Info",
|
||||
"tags": [
|
||||
"apps",
|
||||
"ime",
|
||||
"logs"
|
||||
]
|
||||
},
|
||||
{
|
||||
"ruleId": "GATHER-DEVICE-001",
|
||||
"title": "Collect dsregcmd join status",
|
||||
@@ -44,6 +63,127 @@
|
||||
"startup",
|
||||
"boot"
|
||||
]
|
||||
},
|
||||
{
|
||||
"ruleId": "GATHER-DEVICE-003",
|
||||
"title": "BIOS information",
|
||||
"description": "Queries WMI for BIOS details including manufacturer, version, serial number, and release date. Helps correlate firmware-level issues with enrollment problems.",
|
||||
"category": "device",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "wmi",
|
||||
"target": "SELECT * FROM Win32_BIOS",
|
||||
"trigger": "startup",
|
||||
"outputEventType": "gather_bios_info",
|
||||
"outputSeverity": "Info",
|
||||
"tags": [
|
||||
"device",
|
||||
"bios",
|
||||
"hardware"
|
||||
]
|
||||
},
|
||||
{
|
||||
"ruleId": "GATHER-DEVICE-004",
|
||||
"title": "Recent Windows updates",
|
||||
"description": "Lists the 10 most recent hotfixes/updates installed on the device. Useful for correlating known issues with specific KB articles or verifying that prerequisite updates are present.",
|
||||
"category": "device",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "command_allowlisted",
|
||||
"target": "Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description",
|
||||
"trigger": "startup",
|
||||
"outputEventType": "gather_recent_updates",
|
||||
"outputSeverity": "Info",
|
||||
"tags": [
|
||||
"device",
|
||||
"updates",
|
||||
"hotfix"
|
||||
]
|
||||
},
|
||||
{
|
||||
"ruleId": "GATHER-DEVICE-005",
|
||||
"title": "Pending reboot detection",
|
||||
"description": "Checks the Component Based Servicing registry key for a pending reboot after app installations. A pending reboot at FinalizingSetup can delay or block enrollment completion.",
|
||||
"category": "device",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "registry",
|
||||
"target": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing\\RebootPending",
|
||||
"trigger": "phase_change",
|
||||
"triggerPhase": "FinalizingSetup",
|
||||
"outputEventType": "gather_pending_reboot",
|
||||
"outputSeverity": "Warning",
|
||||
"tags": [
|
||||
"device",
|
||||
"reboot",
|
||||
"servicing"
|
||||
]
|
||||
},
|
||||
{
|
||||
"ruleId": "GATHER-ENROLL-001",
|
||||
"title": "MDM enrollment diagnostic events",
|
||||
"description": "Collects recent events from the DeviceManagement Enterprise Diagnostics Provider at the FinalizingSetup phase. Captures MDM sync errors, policy application failures, and enrollment diagnostics accumulated throughout the session.",
|
||||
"category": "enrollment",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "eventlog",
|
||||
"target": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin",
|
||||
"parameters": {
|
||||
"maxEntries": "10"
|
||||
},
|
||||
"trigger": "phase_change",
|
||||
"triggerPhase": "FinalizingSetup",
|
||||
"outputEventType": "gather_mdm_enrollment_events",
|
||||
"outputSeverity": "Info",
|
||||
"tags": [
|
||||
"enrollment",
|
||||
"mdm",
|
||||
"diagnostics"
|
||||
]
|
||||
},
|
||||
{
|
||||
"ruleId": "GATHER-ENROLL-002",
|
||||
"title": "Applied MDM device policies",
|
||||
"description": "Reads the PolicyManager registry key to list all MDM device policies that have been applied. Verifies that expected compliance and configuration policies landed on the device during enrollment.",
|
||||
"category": "enrollment",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "registry",
|
||||
"target": "HKLM\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device",
|
||||
"trigger": "phase_change",
|
||||
"triggerPhase": "FinalizingSetup",
|
||||
"outputEventType": "gather_mdm_device_policies",
|
||||
"outputSeverity": "Info",
|
||||
"tags": [
|
||||
"enrollment",
|
||||
"mdm",
|
||||
"policies",
|
||||
"compliance"
|
||||
]
|
||||
},
|
||||
{
|
||||
"ruleId": "GATHER-ID-001",
|
||||
"title": "Machine certificates",
|
||||
"description": "Lists certificates in the local machine personal store (My). Verifies that the MDM enrollment certificate and any SCEP certificates have been provisioned.",
|
||||
"category": "identity",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "command_allowlisted",
|
||||
"target": "certutil -store My",
|
||||
"trigger": "startup",
|
||||
"outputEventType": "gather_machine_certificates",
|
||||
"outputSeverity": "Info",
|
||||
"tags": [
|
||||
"identity",
|
||||
"certificates",
|
||||
"scep"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"$schema": "../schema/gather-rule.schema.json",
|
||||
"ruleId": "GATHER-APPS-001",
|
||||
"title": "IME Logs directory check",
|
||||
"description": "Checks whether the Intune Management Extension log directory exists and reports file sizes. Useful to verify IME is active and logs are being written.",
|
||||
"category": "apps",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "file",
|
||||
"target": "C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
|
||||
"trigger": "startup",
|
||||
"outputEventType": "gather_ime_logs_directory",
|
||||
"outputSeverity": "Info",
|
||||
"tags": ["apps", "ime", "logs"]
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"$schema": "../schema/gather-rule.schema.json",
|
||||
"ruleId": "GATHER-DEVICE-003",
|
||||
"title": "BIOS information",
|
||||
"description": "Queries WMI for BIOS details including manufacturer, version, serial number, and release date. Helps correlate firmware-level issues with enrollment problems.",
|
||||
"category": "device",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "wmi",
|
||||
"target": "SELECT * FROM Win32_BIOS",
|
||||
"trigger": "startup",
|
||||
"outputEventType": "gather_bios_info",
|
||||
"outputSeverity": "Info",
|
||||
"tags": ["device", "bios", "hardware"]
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"$schema": "../schema/gather-rule.schema.json",
|
||||
"ruleId": "GATHER-DEVICE-004",
|
||||
"title": "Recent Windows updates",
|
||||
"description": "Lists the 10 most recent hotfixes/updates installed on the device. Useful for correlating known issues with specific KB articles or verifying that prerequisite updates are present.",
|
||||
"category": "device",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "command_allowlisted",
|
||||
"target": "Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description",
|
||||
"trigger": "startup",
|
||||
"outputEventType": "gather_recent_updates",
|
||||
"outputSeverity": "Info",
|
||||
"tags": ["device", "updates", "hotfix"]
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
{
|
||||
"$schema": "../schema/gather-rule.schema.json",
|
||||
"ruleId": "GATHER-DEVICE-005",
|
||||
"title": "Pending reboot detection",
|
||||
"description": "Checks the Component Based Servicing registry key for a pending reboot after app installations. A pending reboot at FinalizingSetup can delay or block enrollment completion.",
|
||||
"category": "device",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "registry",
|
||||
"target": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing\\RebootPending",
|
||||
"trigger": "phase_change",
|
||||
"triggerPhase": "FinalizingSetup",
|
||||
"outputEventType": "gather_pending_reboot",
|
||||
"outputSeverity": "Warning",
|
||||
"tags": ["device", "reboot", "servicing"]
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"$schema": "../schema/gather-rule.schema.json",
|
||||
"ruleId": "GATHER-ENROLL-001",
|
||||
"title": "MDM enrollment diagnostic events",
|
||||
"description": "Collects recent events from the DeviceManagement Enterprise Diagnostics Provider at the FinalizingSetup phase. Captures MDM sync errors, policy application failures, and enrollment diagnostics accumulated throughout the session.",
|
||||
"category": "enrollment",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "eventlog",
|
||||
"target": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin",
|
||||
"parameters": {
|
||||
"maxEntries": "10"
|
||||
},
|
||||
"trigger": "phase_change",
|
||||
"triggerPhase": "FinalizingSetup",
|
||||
"outputEventType": "gather_mdm_enrollment_events",
|
||||
"outputSeverity": "Info",
|
||||
"tags": ["enrollment", "mdm", "diagnostics"]
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
{
|
||||
"$schema": "../schema/gather-rule.schema.json",
|
||||
"ruleId": "GATHER-ENROLL-002",
|
||||
"title": "Applied MDM device policies",
|
||||
"description": "Reads the PolicyManager registry key to list all MDM device policies that have been applied. Verifies that expected compliance and configuration policies landed on the device during enrollment.",
|
||||
"category": "enrollment",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "registry",
|
||||
"target": "HKLM\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device",
|
||||
"trigger": "phase_change",
|
||||
"triggerPhase": "FinalizingSetup",
|
||||
"outputEventType": "gather_mdm_device_policies",
|
||||
"outputSeverity": "Info",
|
||||
"tags": ["enrollment", "mdm", "policies", "compliance"]
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"$schema": "../schema/gather-rule.schema.json",
|
||||
"ruleId": "GATHER-ID-001",
|
||||
"title": "Machine certificates",
|
||||
"description": "Lists certificates in the local machine personal store (My). Verifies that the MDM enrollment certificate and any SCEP certificates have been provisioned.",
|
||||
"category": "identity",
|
||||
"version": "1.0.0",
|
||||
"author": "Autopilot Monitor",
|
||||
"enabled": false,
|
||||
"collectorType": "command_allowlisted",
|
||||
"target": "certutil -store My",
|
||||
"trigger": "startup",
|
||||
"outputEventType": "gather_machine_certificates",
|
||||
"outputSeverity": "Info",
|
||||
"tags": ["identity", "certificates", "scep"]
|
||||
}
|
||||
@@ -0,0 +1,160 @@
|
||||
{
|
||||
"registryPrefixes": [
|
||||
{
|
||||
"category": "MDM / Enrollment",
|
||||
"prefixes": [
|
||||
"SOFTWARE\\Microsoft\\Enrollments",
|
||||
"SOFTWARE\\Microsoft\\EnterpriseDesktopAppManagement",
|
||||
"SOFTWARE\\Microsoft\\Provisioning",
|
||||
"SOFTWARE\\Microsoft\\PolicyManager",
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\MDM"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "AAD / Entra Join",
|
||||
"prefixes": [
|
||||
"SOFTWARE\\Microsoft\\IdentityStore",
|
||||
"SYSTEM\\CurrentControlSet\\Control\\CloudDomainJoin"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "Windows Update / WUfB",
|
||||
"prefixes": [
|
||||
"SOFTWARE\\Microsoft\\WindowsUpdate",
|
||||
"SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "BitLocker",
|
||||
"prefixes": [
|
||||
"SOFTWARE\\Microsoft\\BitLocker",
|
||||
"SYSTEM\\CurrentControlSet\\Control\\BitLockerStatus"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "Network / Proxy",
|
||||
"prefixes": [
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
|
||||
"SYSTEM\\CurrentControlSet\\Services\\Tcpip"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "Autopilot / OOBE / Setup",
|
||||
"prefixes": [
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup",
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE",
|
||||
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "TPM",
|
||||
"prefixes": [
|
||||
"SYSTEM\\CurrentControlSet\\Services\\TPM",
|
||||
"SOFTWARE\\Microsoft\\Tpm"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "Intune IME",
|
||||
"prefixes": [
|
||||
"SOFTWARE\\Microsoft\\IntuneManagementExtension"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "Certificates (SCEP)",
|
||||
"prefixes": [
|
||||
"SOFTWARE\\Microsoft\\SystemCertificates",
|
||||
"SOFTWARE\\Policies\\Microsoft\\SystemCertificates"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "Servicing",
|
||||
"prefixes": [
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing"
|
||||
]
|
||||
}
|
||||
],
|
||||
"filePrefixes": [
|
||||
"C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
|
||||
"C:\\Windows\\CCM\\Logs",
|
||||
"C:\\Windows\\Logs",
|
||||
"C:\\Windows\\Panther",
|
||||
"C:\\Windows\\SetupDiag",
|
||||
"C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
|
||||
"C:\\Windows\\SoftwareDistribution\\ReportingEvents.log"
|
||||
],
|
||||
"wmiQueryPrefixes": [
|
||||
"SELECT * FROM Win32_OperatingSystem",
|
||||
"SELECT * FROM Win32_ComputerSystem",
|
||||
"SELECT * FROM Win32_BIOS",
|
||||
"SELECT * FROM Win32_Processor",
|
||||
"SELECT * FROM Win32_BaseBoard",
|
||||
"SELECT * FROM Win32_Battery",
|
||||
"SELECT * FROM Win32_TPM",
|
||||
"SELECT * FROM Win32_NetworkAdapter",
|
||||
"SELECT * FROM Win32_NetworkAdapterConfiguration",
|
||||
"SELECT * FROM Win32_DiskDrive",
|
||||
"SELECT * FROM Win32_LogicalDisk",
|
||||
"SELECT * FROM SoftwareLicensingProduct"
|
||||
],
|
||||
"allowedCommands": [
|
||||
{
|
||||
"category": "TPM and Security",
|
||||
"commands": [
|
||||
"Get-Tpm",
|
||||
"Get-SecureBootPolicy",
|
||||
"Get-SecureBootUEFI -Name SetupMode"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "BitLocker",
|
||||
"commands": [
|
||||
"Get-BitLockerVolume -MountPoint C:"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "Network",
|
||||
"commands": [
|
||||
"Get-NetAdapter | Select-Object Name, Status, InterfaceDescription, MacAddress, LinkSpeed",
|
||||
"Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses",
|
||||
"Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, IPv4DefaultGateway, DNSServer",
|
||||
"netsh winhttp show proxy",
|
||||
"ipconfig /all"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "Domain / Identity",
|
||||
"commands": [
|
||||
"nltest /dsgetdc:",
|
||||
"dsregcmd /status"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "Certificate",
|
||||
"commands": [
|
||||
"certutil -store My"
|
||||
]
|
||||
},
|
||||
{
|
||||
"category": "Windows Update",
|
||||
"commands": [
|
||||
"Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description"
|
||||
]
|
||||
}
|
||||
],
|
||||
"diagnosticsPathPrefixes": [
|
||||
"C:\\ProgramData\\AutopilotMonitor",
|
||||
"C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
|
||||
"C:\\Windows\\Panther",
|
||||
"C:\\Windows\\Logs",
|
||||
"C:\\Windows\\SetupDiag",
|
||||
"C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
|
||||
"C:\\Windows\\System32\\winevt\\Logs",
|
||||
"C:\\Windows\\CCM\\Logs",
|
||||
"C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
|
||||
"C:\\ProgramData\\Microsoft\\Windows\\WER",
|
||||
"C:\\Windows\\Logs\\CBS"
|
||||
],
|
||||
"blockedFilePrefixes": [
|
||||
"C:\\Users"
|
||||
]
|
||||
}
|
||||
@@ -1,10 +1,9 @@
|
||||
#!/usr/bin/env node
|
||||
/**
|
||||
* Combines individual rule JSON files into dist/ array files.
|
||||
* Run: node rules/scripts/combine.js
|
||||
* Combines individual rule JSON files into dist/ array files and generates
|
||||
* TypeScript guardrails from rules/guardrails.json.
|
||||
*
|
||||
* Reads all .json files from rules/gather/, rules/analyze/, rules/ime-log-patterns/
|
||||
* and writes combined arrays to rules/dist/.
|
||||
* Run: node rules/scripts/combine.js
|
||||
*/
|
||||
|
||||
const fs = require('fs');
|
||||
@@ -12,6 +11,8 @@ const path = require('path');
|
||||
|
||||
const rulesRoot = path.resolve(__dirname, '..');
|
||||
|
||||
// ── Rule combination ────────────────────────────────────────────────────────
|
||||
|
||||
const configs = [
|
||||
{
|
||||
dir: path.join(rulesRoot, 'gather'),
|
||||
@@ -58,3 +59,88 @@ for (const config of configs) {
|
||||
|
||||
console.log(`${path.basename(config.output)}: ${rules.length} rules combined`);
|
||||
}
|
||||
|
||||
// ── Guardrails generation ───────────────────────────────────────────────────
|
||||
|
||||
const guardrailsPath = path.join(rulesRoot, 'guardrails.json');
|
||||
const guardrailsOutput = path.resolve(
|
||||
rulesRoot, '..', 'src', 'Web', 'autopilot-monitor-web', 'lib', 'guardrails.generated.ts'
|
||||
);
|
||||
|
||||
if (fs.existsSync(guardrailsPath)) {
|
||||
const guardrails = JSON.parse(fs.readFileSync(guardrailsPath, 'utf8'));
|
||||
|
||||
/** Escape a string for use inside a TS string literal (double-quoted). */
|
||||
const esc = (s) => s.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
|
||||
|
||||
/** Render an array of strings as a TS readonly array. */
|
||||
const flatArray = (items) =>
|
||||
items.map((s) => ` "${esc(s)}",`).join('\n');
|
||||
|
||||
/** Render a categorized list as a TS readonly array of { category, items }. */
|
||||
const categorizedArray = (groups, itemsKey) =>
|
||||
groups.map((g) => {
|
||||
const items = g[itemsKey].map((s) => ` "${esc(s)}",`).join('\n');
|
||||
return ` {\n category: "${esc(g.category)}",\n items: [\n${items}\n ],\n },`;
|
||||
}).join('\n');
|
||||
|
||||
// Flatten categorized lists for validation
|
||||
const flatRegistryPrefixes = guardrails.registryPrefixes.flatMap((g) => g.prefixes);
|
||||
const flatCommands = guardrails.allowedCommands.flatMap((g) => g.commands);
|
||||
|
||||
const ts = `/**
|
||||
* AUTO-GENERATED from rules/guardrails.json — DO NOT EDIT.
|
||||
* Run: node rules/scripts/combine.js
|
||||
*/
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Categorized data (for documentation / UI display)
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
export interface GuardrailCategory {
|
||||
readonly category: string;
|
||||
readonly items: readonly string[];
|
||||
}
|
||||
|
||||
export const REGISTRY_PREFIX_CATEGORIES: readonly GuardrailCategory[] = [
|
||||
${categorizedArray(guardrails.registryPrefixes, 'prefixes')}
|
||||
];
|
||||
|
||||
export const COMMAND_CATEGORIES: readonly GuardrailCategory[] = [
|
||||
${categorizedArray(guardrails.allowedCommands, 'commands')}
|
||||
];
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Flat arrays (for validation logic)
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
export const ALLOWED_REGISTRY_PREFIXES: readonly string[] = [
|
||||
${flatArray(flatRegistryPrefixes)}
|
||||
];
|
||||
|
||||
export const ALLOWED_FILE_PREFIXES: readonly string[] = [
|
||||
${flatArray(guardrails.filePrefixes)}
|
||||
];
|
||||
|
||||
export const ALLOWED_WMI_QUERY_PREFIXES: readonly string[] = [
|
||||
${flatArray(guardrails.wmiQueryPrefixes)}
|
||||
];
|
||||
|
||||
export const ALLOWED_COMMANDS_LIST: readonly string[] = [
|
||||
${flatArray(flatCommands)}
|
||||
];
|
||||
|
||||
export const ALLOWED_DIAGNOSTICS_PATH_PREFIXES: readonly string[] = [
|
||||
${flatArray(guardrails.diagnosticsPathPrefixes)}
|
||||
];
|
||||
|
||||
export const BLOCKED_FILE_PREFIXES: readonly string[] = [
|
||||
${flatArray(guardrails.blockedFilePrefixes)}
|
||||
];
|
||||
`;
|
||||
|
||||
fs.writeFileSync(guardrailsOutput, ts, 'utf8');
|
||||
console.log(`guardrails.generated.ts: ${flatRegistryPrefixes.length} registry, ${flatCommands.length} commands, ${guardrails.filePrefixes.length} file prefixes`);
|
||||
} else {
|
||||
console.warn('guardrails.json not found — skipping guardrails generation');
|
||||
}
|
||||
|
||||
@@ -13,6 +13,10 @@
|
||||
<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
|
||||
</ItemGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<EmbeddedResource Include="..\..\..\rules\guardrails.json" LogicalName="AutopilotMonitor.Agent.Core.Resources.guardrails.json" />
|
||||
</ItemGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<Reference Include="System.Net.Http" />
|
||||
<Reference Include="System.Management" />
|
||||
|
||||
@@ -2,17 +2,22 @@ using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Reflection;
|
||||
using Newtonsoft.Json.Linq;
|
||||
|
||||
namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
|
||||
{
|
||||
/// <summary>
|
||||
/// Privacy and security guards for GatherRule collectors.
|
||||
///
|
||||
/// All four allowlists (registry, file, WMI, command) restrict data collection to
|
||||
/// enrollment-relevant information only. Rules targeting paths, queries, or commands
|
||||
/// outside these lists are blocked and reported as security_warning events.
|
||||
/// All allowlists are loaded from the embedded guardrails.json resource
|
||||
/// (source of truth: rules/guardrails.json). They restrict data collection
|
||||
/// to enrollment-relevant information only. Rules targeting paths, queries,
|
||||
/// or commands outside these lists are blocked and reported as security_warning events.
|
||||
///
|
||||
/// To allow additional paths: edit rules/guardrails.json and run
|
||||
/// node rules/scripts/combine.js to regenerate all derived files.
|
||||
///
|
||||
/// To allow additional paths: add a prefix entry to the appropriate list.
|
||||
/// Segment-bounded matching is used: the path must match the prefix exactly
|
||||
/// up to a path separator or end of string, preventing prefix spoofing.
|
||||
/// Registry paths are expected without the hive prefix (e.g. "SOFTWARE\\Microsoft\\..." not "HKLM\\...").
|
||||
@@ -22,136 +27,85 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Collectors
|
||||
public static class GatherRuleGuards
|
||||
{
|
||||
// -----------------------------------------------------------------------
|
||||
// Registry — subPath after hive prefix stripped (HKLM\\ / HKCU\\)
|
||||
// Loaded from embedded guardrails.json
|
||||
// -----------------------------------------------------------------------
|
||||
public static readonly IReadOnlyList<string> AllowedRegistryPrefixes = new[]
|
||||
{
|
||||
// MDM / Enrollment
|
||||
@"SOFTWARE\Microsoft\Enrollments",
|
||||
@"SOFTWARE\Microsoft\EnterpriseDesktopAppManagement",
|
||||
@"SOFTWARE\Microsoft\Provisioning",
|
||||
@"SOFTWARE\Microsoft\PolicyManager",
|
||||
@"SOFTWARE\Microsoft\Windows\CurrentVersion\MDM",
|
||||
|
||||
// AAD / Hybrid Join / Workplace Join
|
||||
@"SOFTWARE\Microsoft\IdentityStore",
|
||||
@"SYSTEM\CurrentControlSet\Control\CloudDomainJoin",
|
||||
|
||||
// Windows Update / WUfB
|
||||
@"SOFTWARE\Microsoft\WindowsUpdate",
|
||||
@"SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate",
|
||||
|
||||
// BitLocker
|
||||
@"SOFTWARE\Microsoft\BitLocker",
|
||||
@"SYSTEM\CurrentControlSet\Control\BitLockerStatus",
|
||||
|
||||
// Network / Proxy (enrollment connectivity)
|
||||
@"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings",
|
||||
@"SYSTEM\CurrentControlSet\Services\Tcpip",
|
||||
|
||||
// Autopilot / OOBE / Setup
|
||||
@"SOFTWARE\Microsoft\Windows\CurrentVersion\Setup",
|
||||
@"SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE",
|
||||
@"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",
|
||||
|
||||
// TPM
|
||||
@"SYSTEM\CurrentControlSet\Services\TPM",
|
||||
@"SOFTWARE\Microsoft\Tpm",
|
||||
|
||||
// Intune IME
|
||||
@"SOFTWARE\Microsoft\IntuneManagementExtension",
|
||||
|
||||
// SCEP / Certificate enrollment
|
||||
@"SOFTWARE\Microsoft\SystemCertificates",
|
||||
@"SOFTWARE\Policies\Microsoft\SystemCertificates",
|
||||
};
|
||||
|
||||
// -----------------------------------------------------------------------
|
||||
// File — after Environment.ExpandEnvironmentVariables
|
||||
// -----------------------------------------------------------------------
|
||||
public static readonly IReadOnlyList<string> AllowedFilePrefixes = new[]
|
||||
{
|
||||
// Intune Management Extension logs
|
||||
@"C:\ProgramData\Microsoft\IntuneManagementExtension\Logs",
|
||||
|
||||
// ConfigMgr / MECM client logs (hybrid scenarios)
|
||||
@"C:\Windows\CCM\Logs",
|
||||
|
||||
// Windows setup / upgrade logs
|
||||
@"C:\Windows\Logs",
|
||||
@"C:\Windows\Panther",
|
||||
@"C:\Windows\SetupDiag",
|
||||
|
||||
// MDM Diagnostics
|
||||
@"C:\ProgramData\Microsoft\DiagnosticLogCSP",
|
||||
|
||||
// Windows Update logs
|
||||
@"C:\Windows\SoftwareDistribution\ReportingEvents.log",
|
||||
};
|
||||
|
||||
// -----------------------------------------------------------------------
|
||||
// WMI — full query string must start with one of these prefixes
|
||||
// Only SELECT queries against known safe classes are permitted.
|
||||
// -----------------------------------------------------------------------
|
||||
public static readonly IReadOnlyList<string> AllowedWmiQueryPrefixes = new[]
|
||||
{
|
||||
// OS / Hardware identity
|
||||
"SELECT * FROM Win32_OperatingSystem",
|
||||
"SELECT * FROM Win32_ComputerSystem",
|
||||
"SELECT * FROM Win32_BIOS",
|
||||
"SELECT * FROM Win32_Processor",
|
||||
"SELECT * FROM Win32_BaseBoard",
|
||||
"SELECT * FROM Win32_Battery",
|
||||
|
||||
// TPM
|
||||
"SELECT * FROM Win32_TPM",
|
||||
|
||||
// Network
|
||||
"SELECT * FROM Win32_NetworkAdapter",
|
||||
"SELECT * FROM Win32_NetworkAdapterConfiguration",
|
||||
|
||||
// Storage
|
||||
"SELECT * FROM Win32_DiskDrive",
|
||||
"SELECT * FROM Win32_LogicalDisk",
|
||||
|
||||
// Windows licensing / activation
|
||||
"SELECT * FROM SoftwareLicensingProduct",
|
||||
};
|
||||
|
||||
// -----------------------------------------------------------------------
|
||||
// Command — exact match (trimmed); no prefix matching for security
|
||||
// -----------------------------------------------------------------------
|
||||
public static readonly IReadOnlyCollection<string> AllowedCommands = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
|
||||
{
|
||||
// TPM and Security
|
||||
"Get-Tpm",
|
||||
"Get-SecureBootPolicy",
|
||||
"Get-SecureBootUEFI -Name SetupMode",
|
||||
|
||||
// BitLocker
|
||||
"Get-BitLockerVolume -MountPoint C:",
|
||||
|
||||
// Network
|
||||
"Get-NetAdapter | Select-Object Name, Status, InterfaceDescription, MacAddress, LinkSpeed",
|
||||
"Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses",
|
||||
"Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, IPv4DefaultGateway, DNSServer",
|
||||
"netsh winhttp show proxy",
|
||||
"ipconfig /all",
|
||||
|
||||
// Domain / Identity
|
||||
"nltest /dsgetdc:",
|
||||
"dsregcmd /status",
|
||||
|
||||
// Certificate
|
||||
"certutil -store My",
|
||||
|
||||
// Windows Update
|
||||
"Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description"
|
||||
};
|
||||
public static readonly IReadOnlyList<string> AllowedRegistryPrefixes;
|
||||
public static readonly IReadOnlyList<string> AllowedFilePrefixes;
|
||||
public static readonly IReadOnlyList<string> AllowedWmiQueryPrefixes;
|
||||
public static readonly IReadOnlyCollection<string> AllowedCommands;
|
||||
|
||||
// Hard block: C:\Users is never allowed, even in unrestricted mode
|
||||
private static readonly string BlockedUsersPrefix = Path.GetFullPath(@"C:\Users");
|
||||
|
||||
static GatherRuleGuards()
|
||||
{
|
||||
try
|
||||
{
|
||||
var json = LoadEmbeddedGuardrails();
|
||||
if (json != null)
|
||||
{
|
||||
var obj = JObject.Parse(json);
|
||||
|
||||
AllowedRegistryPrefixes = FlattenCategorized(obj, "registryPrefixes", "prefixes");
|
||||
AllowedFilePrefixes = obj["filePrefixes"]?.ToObject<List<string>>() ?? new List<string>();
|
||||
AllowedWmiQueryPrefixes = obj["wmiQueryPrefixes"]?.ToObject<List<string>>() ?? new List<string>();
|
||||
|
||||
var commands = FlattenCategorized(obj, "allowedCommands", "commands");
|
||||
AllowedCommands = new HashSet<string>(commands, StringComparer.OrdinalIgnoreCase);
|
||||
return;
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
// Fallback to empty lists on parse error — agent will block everything
|
||||
// and emit security_warning events, making the issue visible.
|
||||
}
|
||||
|
||||
AllowedRegistryPrefixes = new List<string>();
|
||||
AllowedFilePrefixes = new List<string>();
|
||||
AllowedWmiQueryPrefixes = new List<string>();
|
||||
AllowedCommands = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
|
||||
}
|
||||
|
||||
private static string LoadEmbeddedGuardrails()
|
||||
{
|
||||
var assembly = Assembly.GetExecutingAssembly();
|
||||
using (var stream = assembly.GetManifestResourceStream(
|
||||
"AutopilotMonitor.Agent.Core.Resources.guardrails.json"))
|
||||
{
|
||||
if (stream == null)
|
||||
return null;
|
||||
using (var reader = new StreamReader(stream))
|
||||
{
|
||||
return reader.ReadToEnd();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Flattens a categorized array structure like
|
||||
/// [{ "category": "...", "prefixes": ["a","b"] }, ...] into ["a","b",...].
|
||||
/// </summary>
|
||||
private static List<string> FlattenCategorized(JObject root, string arrayProp, string itemsProp)
|
||||
{
|
||||
var result = new List<string>();
|
||||
var arr = root[arrayProp] as JArray;
|
||||
if (arr == null) return result;
|
||||
|
||||
foreach (var group in arr)
|
||||
{
|
||||
var items = group[itemsProp] as JArray;
|
||||
if (items == null) continue;
|
||||
foreach (var item in items)
|
||||
{
|
||||
var val = item.Value<string>();
|
||||
if (!string.IsNullOrEmpty(val))
|
||||
result.Add(val);
|
||||
}
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------
|
||||
// Guard methods
|
||||
// -----------------------------------------------------------------------
|
||||
|
||||
@@ -1 +1 @@
|
||||
456
|
||||
457
|
||||
|
||||
@@ -1,6 +1,12 @@
|
||||
"use client";
|
||||
|
||||
import { useState } from "react";
|
||||
import {
|
||||
REGISTRY_PREFIX_CATEGORIES,
|
||||
COMMAND_CATEGORIES,
|
||||
ALLOWED_FILE_PREFIXES,
|
||||
ALLOWED_WMI_QUERY_PREFIXES,
|
||||
} from "@/lib/guardrails.generated";
|
||||
|
||||
function GuardToggle({ label, children }: { label: string; children: React.ReactNode }) {
|
||||
const [open, setOpen] = useState(false);
|
||||
@@ -68,36 +74,12 @@ export function SectionGatherRules() {
|
||||
<p className="text-xs text-gray-500 mt-0.5">All paths are under <code className="bg-gray-100 px-1 rounded">HKLM\</code> or <code className="bg-gray-100 px-1 rounded">HKCU\</code>. Segment-bounded matching — subkeys are allowed, but sibling keys are not.</p>
|
||||
<GuardToggle label="Show allowed registry prefixes">
|
||||
<div className="bg-gray-50 border border-gray-200 rounded px-3 py-2 text-xs font-mono space-y-1">
|
||||
<p className="text-gray-400 font-sans not-italic">MDM / Enrollment</p>
|
||||
<p>SOFTWARE\Microsoft\Enrollments</p>
|
||||
<p>SOFTWARE\Microsoft\EnterpriseDesktopAppManagement</p>
|
||||
<p>SOFTWARE\Microsoft\Provisioning</p>
|
||||
<p>SOFTWARE\Microsoft\PolicyManager</p>
|
||||
<p>SOFTWARE\Microsoft\Windows\CurrentVersion\MDM</p>
|
||||
<p className="text-gray-400 font-sans not-italic pt-1">AAD / Entra Join</p>
|
||||
<p>SOFTWARE\Microsoft\IdentityStore</p>
|
||||
<p>SYSTEM\CurrentControlSet\Control\CloudDomainJoin</p>
|
||||
<p className="text-gray-400 font-sans not-italic pt-1">Windows Update / WUfB</p>
|
||||
<p>SOFTWARE\Microsoft\WindowsUpdate</p>
|
||||
<p>SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate</p>
|
||||
<p className="text-gray-400 font-sans not-italic pt-1">BitLocker</p>
|
||||
<p>SOFTWARE\Microsoft\BitLocker</p>
|
||||
<p>SYSTEM\CurrentControlSet\Control\BitLockerStatus</p>
|
||||
<p className="text-gray-400 font-sans not-italic pt-1">Network / Proxy</p>
|
||||
<p>SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings</p>
|
||||
<p>SYSTEM\CurrentControlSet\Services\Tcpip</p>
|
||||
<p className="text-gray-400 font-sans not-italic pt-1">Autopilot / OOBE / Setup</p>
|
||||
<p>SOFTWARE\Microsoft\Windows\CurrentVersion\Setup</p>
|
||||
<p>SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE</p>
|
||||
<p>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon</p>
|
||||
<p className="text-gray-400 font-sans not-italic pt-1">TPM</p>
|
||||
<p>SYSTEM\CurrentControlSet\Services\TPM</p>
|
||||
<p>SOFTWARE\Microsoft\Tpm</p>
|
||||
<p className="text-gray-400 font-sans not-italic pt-1">Intune IME</p>
|
||||
<p>SOFTWARE\Microsoft\IntuneManagementExtension</p>
|
||||
<p className="text-gray-400 font-sans not-italic pt-1">Certificates (SCEP)</p>
|
||||
<p>SOFTWARE\Microsoft\SystemCertificates</p>
|
||||
<p>SOFTWARE\Policies\Microsoft\SystemCertificates</p>
|
||||
{REGISTRY_PREFIX_CATEGORIES.map((cat, i) => (
|
||||
<div key={cat.category}>
|
||||
<p className={`text-gray-400 font-sans not-italic${i > 0 ? " pt-1" : ""}`}>{cat.category}</p>
|
||||
{cat.items.map((p) => <p key={p}>{p}</p>)}
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</GuardToggle>
|
||||
</div>
|
||||
@@ -161,18 +143,10 @@ export function SectionGatherRules() {
|
||||
<p className="font-medium text-gray-900">Allowed WMI Classes</p>
|
||||
<GuardToggle label="Show allowed WMI classes">
|
||||
<div className="bg-gray-50 border border-gray-200 rounded px-3 py-2 text-xs font-mono columns-2 space-y-0.5">
|
||||
<p>Win32_OperatingSystem</p>
|
||||
<p>Win32_ComputerSystem</p>
|
||||
<p>Win32_BIOS</p>
|
||||
<p>Win32_Processor</p>
|
||||
<p>Win32_BaseBoard</p>
|
||||
<p>Win32_Battery</p>
|
||||
<p>Win32_TPM</p>
|
||||
<p>Win32_NetworkAdapter</p>
|
||||
<p>Win32_NetworkAdapterConfiguration</p>
|
||||
<p>Win32_DiskDrive</p>
|
||||
<p>Win32_LogicalDisk</p>
|
||||
<p>SoftwareLicensingProduct</p>
|
||||
{ALLOWED_WMI_QUERY_PREFIXES.map((q) => {
|
||||
const cls = q.replace(/^SELECT \* FROM /i, "");
|
||||
return <p key={cls}>{cls}</p>;
|
||||
})}
|
||||
</div>
|
||||
</GuardToggle>
|
||||
</div>
|
||||
@@ -209,13 +183,7 @@ export function SectionGatherRules() {
|
||||
<p className="font-medium text-gray-900">Allowed Path Prefixes</p>
|
||||
<GuardToggle label="Show allowed file path prefixes">
|
||||
<div className="bg-gray-50 border border-gray-200 rounded px-3 py-2 text-xs font-mono space-y-0.5">
|
||||
<p>C:\ProgramData\Microsoft\IntuneManagementExtension\Logs</p>
|
||||
<p>C:\Windows\CCM\Logs</p>
|
||||
<p>C:\Windows\Logs</p>
|
||||
<p>C:\Windows\Panther</p>
|
||||
<p>C:\Windows\SetupDiag</p>
|
||||
<p>C:\ProgramData\Microsoft\DiagnosticLogCSP</p>
|
||||
<p>C:\Windows\SoftwareDistribution\ReportingEvents.log</p>
|
||||
{ALLOWED_FILE_PREFIXES.map((p) => <p key={p}>{p}</p>)}
|
||||
</div>
|
||||
</GuardToggle>
|
||||
</div>
|
||||
@@ -246,25 +214,12 @@ export function SectionGatherRules() {
|
||||
<p className="font-medium text-gray-900">Allowed Commands</p>
|
||||
<GuardToggle label="Show allowed commands">
|
||||
<div className="bg-gray-50 border border-gray-200 rounded px-3 py-2 text-xs font-mono space-y-0.5">
|
||||
<p className="text-gray-400"># TPM and Security</p>
|
||||
<p>Get-Tpm</p>
|
||||
<p>Get-SecureBootPolicy</p>
|
||||
<p>Get-SecureBootUEFI -Name SetupMode</p>
|
||||
<p className="text-gray-400"># BitLocker</p>
|
||||
<p>Get-BitLockerVolume -MountPoint C:</p>
|
||||
<p className="text-gray-400"># Network</p>
|
||||
<p>Get-NetAdapter | Select-Object Name, Status, InterfaceDescription, MacAddress, LinkSpeed</p>
|
||||
<p>Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses</p>
|
||||
<p>Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, IPv4DefaultGateway, DNSServer</p>
|
||||
<p>netsh winhttp show proxy</p>
|
||||
<p>ipconfig /all</p>
|
||||
<p className="text-gray-400"># Domain / Identity</p>
|
||||
<p>nltest /dsgetdc:</p>
|
||||
<p>dsregcmd /status</p>
|
||||
<p className="text-gray-400"># Certificate</p>
|
||||
<p>certutil -store My</p>
|
||||
<p className="text-gray-400"># Windows Update</p>
|
||||
<p>Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description</p>
|
||||
{COMMAND_CATEGORIES.map((cat) => (
|
||||
<div key={cat.category}>
|
||||
<p className="text-gray-400"># {cat.category}</p>
|
||||
{cat.items.map((cmd) => <p key={cmd}>{cmd}</p>)}
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</GuardToggle>
|
||||
</div>
|
||||
|
||||
@@ -1,10 +1,23 @@
|
||||
/**
|
||||
* Client-side port of agent guardrail validation logic.
|
||||
*
|
||||
* Mirrors GatherRuleGuards.cs and DiagnosticsPathGuards.cs so the UI can
|
||||
* show instant "Allowed" / "Not allowed" feedback without a round-trip.
|
||||
* All allowlists are loaded from guardrails.generated.ts which is generated
|
||||
* from the single source of truth: rules/guardrails.json.
|
||||
* Run: node rules/scripts/combine.js
|
||||
*/
|
||||
|
||||
import {
|
||||
ALLOWED_REGISTRY_PREFIXES,
|
||||
ALLOWED_FILE_PREFIXES,
|
||||
ALLOWED_WMI_QUERY_PREFIXES,
|
||||
ALLOWED_COMMANDS_LIST,
|
||||
ALLOWED_DIAGNOSTICS_PATH_PREFIXES,
|
||||
BLOCKED_FILE_PREFIXES,
|
||||
} from "./guardrails.generated";
|
||||
|
||||
// Re-export for consumers that imported from here
|
||||
export { ALLOWED_REGISTRY_PREFIXES, ALLOWED_FILE_PREFIXES, ALLOWED_WMI_QUERY_PREFIXES, ALLOWED_COMMANDS_LIST, ALLOWED_DIAGNOSTICS_PATH_PREFIXES };
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Result type
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -17,102 +30,14 @@ export interface ValidationResult {
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Constants — mirror GatherRuleGuards.cs exactly
|
||||
// Derived sets
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
export const ALLOWED_REGISTRY_PREFIXES: readonly string[] = [
|
||||
// MDM / Enrollment
|
||||
"SOFTWARE\\Microsoft\\Enrollments",
|
||||
"SOFTWARE\\Microsoft\\EnterpriseDesktopAppManagement",
|
||||
"SOFTWARE\\Microsoft\\Provisioning",
|
||||
"SOFTWARE\\Microsoft\\PolicyManager",
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\MDM",
|
||||
// AAD / Hybrid Join
|
||||
"SOFTWARE\\Microsoft\\IdentityStore",
|
||||
"SYSTEM\\CurrentControlSet\\Control\\CloudDomainJoin",
|
||||
// Windows Update / WUfB
|
||||
"SOFTWARE\\Microsoft\\WindowsUpdate",
|
||||
"SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate",
|
||||
// BitLocker
|
||||
"SOFTWARE\\Microsoft\\BitLocker",
|
||||
"SYSTEM\\CurrentControlSet\\Control\\BitLockerStatus",
|
||||
// Network / Proxy
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
|
||||
"SYSTEM\\CurrentControlSet\\Services\\Tcpip",
|
||||
// Autopilot / OOBE / Setup
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup",
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE",
|
||||
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
|
||||
// TPM
|
||||
"SYSTEM\\CurrentControlSet\\Services\\TPM",
|
||||
"SOFTWARE\\Microsoft\\Tpm",
|
||||
// Intune IME
|
||||
"SOFTWARE\\Microsoft\\IntuneManagementExtension",
|
||||
// SCEP / Certificates
|
||||
"SOFTWARE\\Microsoft\\SystemCertificates",
|
||||
"SOFTWARE\\Policies\\Microsoft\\SystemCertificates",
|
||||
];
|
||||
|
||||
export const ALLOWED_FILE_PREFIXES: readonly string[] = [
|
||||
"C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
|
||||
"C:\\Windows\\CCM\\Logs",
|
||||
"C:\\Windows\\Logs",
|
||||
"C:\\Windows\\Panther",
|
||||
"C:\\Windows\\SetupDiag",
|
||||
"C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
|
||||
"C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
|
||||
];
|
||||
|
||||
export const ALLOWED_WMI_QUERY_PREFIXES: readonly string[] = [
|
||||
"SELECT * FROM Win32_OperatingSystem",
|
||||
"SELECT * FROM Win32_ComputerSystem",
|
||||
"SELECT * FROM Win32_BIOS",
|
||||
"SELECT * FROM Win32_Processor",
|
||||
"SELECT * FROM Win32_BaseBoard",
|
||||
"SELECT * FROM Win32_Battery",
|
||||
"SELECT * FROM Win32_TPM",
|
||||
"SELECT * FROM Win32_NetworkAdapter",
|
||||
"SELECT * FROM Win32_NetworkAdapterConfiguration",
|
||||
"SELECT * FROM Win32_DiskDrive",
|
||||
"SELECT * FROM Win32_LogicalDisk",
|
||||
"SELECT * FROM SoftwareLicensingProduct",
|
||||
];
|
||||
|
||||
const ALLOWED_COMMANDS_LIST: readonly string[] = [
|
||||
"Get-Tpm",
|
||||
"Get-SecureBootPolicy",
|
||||
"Get-SecureBootUEFI -Name SetupMode",
|
||||
"Get-BitLockerVolume -MountPoint C:",
|
||||
"Get-NetAdapter | Select-Object Name, Status, InterfaceDescription, MacAddress, LinkSpeed",
|
||||
"Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses",
|
||||
"Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, IPv4DefaultGateway, DNSServer",
|
||||
"netsh winhttp show proxy",
|
||||
"ipconfig /all",
|
||||
"nltest /dsgetdc:",
|
||||
"dsregcmd /status",
|
||||
"certutil -store My",
|
||||
"Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description",
|
||||
];
|
||||
|
||||
const ALLOWED_COMMANDS_SET = new Set(
|
||||
ALLOWED_COMMANDS_LIST.map((c) => c.toLowerCase())
|
||||
);
|
||||
|
||||
export const ALLOWED_DIAGNOSTICS_PATH_PREFIXES: readonly string[] = [
|
||||
"C:\\ProgramData\\AutopilotMonitor",
|
||||
"C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
|
||||
"C:\\Windows\\Panther",
|
||||
"C:\\Windows\\Logs",
|
||||
"C:\\Windows\\SetupDiag",
|
||||
"C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
|
||||
"C:\\Windows\\System32\\winevt\\Logs",
|
||||
"C:\\Windows\\CCM\\Logs",
|
||||
"C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
|
||||
"C:\\ProgramData\\Microsoft\\Windows\\WER",
|
||||
"C:\\Windows\\Logs\\CBS",
|
||||
];
|
||||
|
||||
const BLOCKED_USERS_PREFIX = "C:\\Users";
|
||||
const BLOCKED_USERS_PREFIX = BLOCKED_FILE_PREFIXES[0] || "C:\\Users";
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Common Windows environment variables (for client-side expansion)
|
||||
|
||||
@@ -0,0 +1,222 @@
|
||||
/**
|
||||
* AUTO-GENERATED from rules/guardrails.json — DO NOT EDIT.
|
||||
* Run: node rules/scripts/combine.js
|
||||
*/
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Categorized data (for documentation / UI display)
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
export interface GuardrailCategory {
|
||||
readonly category: string;
|
||||
readonly items: readonly string[];
|
||||
}
|
||||
|
||||
export const REGISTRY_PREFIX_CATEGORIES: readonly GuardrailCategory[] = [
|
||||
{
|
||||
category: "MDM / Enrollment",
|
||||
items: [
|
||||
"SOFTWARE\\Microsoft\\Enrollments",
|
||||
"SOFTWARE\\Microsoft\\EnterpriseDesktopAppManagement",
|
||||
"SOFTWARE\\Microsoft\\Provisioning",
|
||||
"SOFTWARE\\Microsoft\\PolicyManager",
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\MDM",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "AAD / Entra Join",
|
||||
items: [
|
||||
"SOFTWARE\\Microsoft\\IdentityStore",
|
||||
"SYSTEM\\CurrentControlSet\\Control\\CloudDomainJoin",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "Windows Update / WUfB",
|
||||
items: [
|
||||
"SOFTWARE\\Microsoft\\WindowsUpdate",
|
||||
"SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "BitLocker",
|
||||
items: [
|
||||
"SOFTWARE\\Microsoft\\BitLocker",
|
||||
"SYSTEM\\CurrentControlSet\\Control\\BitLockerStatus",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "Network / Proxy",
|
||||
items: [
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
|
||||
"SYSTEM\\CurrentControlSet\\Services\\Tcpip",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "Autopilot / OOBE / Setup",
|
||||
items: [
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup",
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE",
|
||||
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "TPM",
|
||||
items: [
|
||||
"SYSTEM\\CurrentControlSet\\Services\\TPM",
|
||||
"SOFTWARE\\Microsoft\\Tpm",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "Intune IME",
|
||||
items: [
|
||||
"SOFTWARE\\Microsoft\\IntuneManagementExtension",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "Certificates (SCEP)",
|
||||
items: [
|
||||
"SOFTWARE\\Microsoft\\SystemCertificates",
|
||||
"SOFTWARE\\Policies\\Microsoft\\SystemCertificates",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "Servicing",
|
||||
items: [
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing",
|
||||
],
|
||||
},
|
||||
];
|
||||
|
||||
export const COMMAND_CATEGORIES: readonly GuardrailCategory[] = [
|
||||
{
|
||||
category: "TPM and Security",
|
||||
items: [
|
||||
"Get-Tpm",
|
||||
"Get-SecureBootPolicy",
|
||||
"Get-SecureBootUEFI -Name SetupMode",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "BitLocker",
|
||||
items: [
|
||||
"Get-BitLockerVolume -MountPoint C:",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "Network",
|
||||
items: [
|
||||
"Get-NetAdapter | Select-Object Name, Status, InterfaceDescription, MacAddress, LinkSpeed",
|
||||
"Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses",
|
||||
"Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, IPv4DefaultGateway, DNSServer",
|
||||
"netsh winhttp show proxy",
|
||||
"ipconfig /all",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "Domain / Identity",
|
||||
items: [
|
||||
"nltest /dsgetdc:",
|
||||
"dsregcmd /status",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "Certificate",
|
||||
items: [
|
||||
"certutil -store My",
|
||||
],
|
||||
},
|
||||
{
|
||||
category: "Windows Update",
|
||||
items: [
|
||||
"Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description",
|
||||
],
|
||||
},
|
||||
];
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Flat arrays (for validation logic)
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
export const ALLOWED_REGISTRY_PREFIXES: readonly string[] = [
|
||||
"SOFTWARE\\Microsoft\\Enrollments",
|
||||
"SOFTWARE\\Microsoft\\EnterpriseDesktopAppManagement",
|
||||
"SOFTWARE\\Microsoft\\Provisioning",
|
||||
"SOFTWARE\\Microsoft\\PolicyManager",
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\MDM",
|
||||
"SOFTWARE\\Microsoft\\IdentityStore",
|
||||
"SYSTEM\\CurrentControlSet\\Control\\CloudDomainJoin",
|
||||
"SOFTWARE\\Microsoft\\WindowsUpdate",
|
||||
"SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate",
|
||||
"SOFTWARE\\Microsoft\\BitLocker",
|
||||
"SYSTEM\\CurrentControlSet\\Control\\BitLockerStatus",
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
|
||||
"SYSTEM\\CurrentControlSet\\Services\\Tcpip",
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup",
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE",
|
||||
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
|
||||
"SYSTEM\\CurrentControlSet\\Services\\TPM",
|
||||
"SOFTWARE\\Microsoft\\Tpm",
|
||||
"SOFTWARE\\Microsoft\\IntuneManagementExtension",
|
||||
"SOFTWARE\\Microsoft\\SystemCertificates",
|
||||
"SOFTWARE\\Policies\\Microsoft\\SystemCertificates",
|
||||
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing",
|
||||
];
|
||||
|
||||
export const ALLOWED_FILE_PREFIXES: readonly string[] = [
|
||||
"C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
|
||||
"C:\\Windows\\CCM\\Logs",
|
||||
"C:\\Windows\\Logs",
|
||||
"C:\\Windows\\Panther",
|
||||
"C:\\Windows\\SetupDiag",
|
||||
"C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
|
||||
"C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
|
||||
];
|
||||
|
||||
export const ALLOWED_WMI_QUERY_PREFIXES: readonly string[] = [
|
||||
"SELECT * FROM Win32_OperatingSystem",
|
||||
"SELECT * FROM Win32_ComputerSystem",
|
||||
"SELECT * FROM Win32_BIOS",
|
||||
"SELECT * FROM Win32_Processor",
|
||||
"SELECT * FROM Win32_BaseBoard",
|
||||
"SELECT * FROM Win32_Battery",
|
||||
"SELECT * FROM Win32_TPM",
|
||||
"SELECT * FROM Win32_NetworkAdapter",
|
||||
"SELECT * FROM Win32_NetworkAdapterConfiguration",
|
||||
"SELECT * FROM Win32_DiskDrive",
|
||||
"SELECT * FROM Win32_LogicalDisk",
|
||||
"SELECT * FROM SoftwareLicensingProduct",
|
||||
];
|
||||
|
||||
export const ALLOWED_COMMANDS_LIST: readonly string[] = [
|
||||
"Get-Tpm",
|
||||
"Get-SecureBootPolicy",
|
||||
"Get-SecureBootUEFI -Name SetupMode",
|
||||
"Get-BitLockerVolume -MountPoint C:",
|
||||
"Get-NetAdapter | Select-Object Name, Status, InterfaceDescription, MacAddress, LinkSpeed",
|
||||
"Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses",
|
||||
"Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, IPv4DefaultGateway, DNSServer",
|
||||
"netsh winhttp show proxy",
|
||||
"ipconfig /all",
|
||||
"nltest /dsgetdc:",
|
||||
"dsregcmd /status",
|
||||
"certutil -store My",
|
||||
"Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description",
|
||||
];
|
||||
|
||||
export const ALLOWED_DIAGNOSTICS_PATH_PREFIXES: readonly string[] = [
|
||||
"C:\\ProgramData\\AutopilotMonitor",
|
||||
"C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
|
||||
"C:\\Windows\\Panther",
|
||||
"C:\\Windows\\Logs",
|
||||
"C:\\Windows\\SetupDiag",
|
||||
"C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
|
||||
"C:\\Windows\\System32\\winevt\\Logs",
|
||||
"C:\\Windows\\CCM\\Logs",
|
||||
"C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
|
||||
"C:\\ProgramData\\Microsoft\\Windows\\WER",
|
||||
"C:\\Windows\\Logs\\CBS",
|
||||
];
|
||||
|
||||
export const BLOCKED_FILE_PREFIXES: readonly string[] = [
|
||||
"C:\\Users",
|
||||
];
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user