From ea2d9076169b363862a00f51207a4d543bb4e654 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 21 Mar 2026 18:09:38 +0000 Subject: [PATCH] Remove 5 irrelevant entries from AppX whitelist Removed packages that don't belong in the AppX filter: - Microsoft.ManagementApp (IME is Win32, not AppX) - Microsoft.MicrosoftOfficeHub (just a launcher, no attack surface) - Microsoft.PowerBIDesktop (deployed as Win32, not AppX) - Microsoft.SecHealthUI (UI shell only, Defender version from other sources) - Microsoft.OneDriveSync (normal Win32 app, not AppX) https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw --- .../Monitoring/Analyzers/SoftwareInventoryAnalyzer.cs | 7 ------- 1 file changed, 7 deletions(-) diff --git a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Analyzers/SoftwareInventoryAnalyzer.cs b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Analyzers/SoftwareInventoryAnalyzer.cs index 4a6d73c6..7767c841 100644 --- a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Analyzers/SoftwareInventoryAnalyzer.cs +++ b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Analyzers/SoftwareInventoryAnalyzer.cs @@ -304,14 +304,12 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Analyzers { // Intune / device management "Microsoft.CompanyPortal", - "Microsoft.ManagementApp", // Communication & productivity (CVE-relevant, enterprise-deployed) "Microsoft.Teams", "MSTeams", "MicrosoftTeams", "Microsoft.Office.Desktop", - "Microsoft.MicrosoftOfficeHub", "Microsoft.OutlookForWindows", // Remote access (security surface) @@ -324,11 +322,6 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Analyzers // Power Platform (enterprise) "Microsoft.PowerAutomateDesktop", - "Microsoft.PowerBIDesktop", - - // Security-relevant Microsoft apps - "Microsoft.SecHealthUI", // Windows Security app - "Microsoft.OneDriveSync", }; // Pattern: {Publisher.PackageName}_{Version}_{Arch}__{PublisherHash}