From fd00d976dc699d45a0863c541d2a99219937dd68 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 21 Mar 2026 17:58:04 +0000 Subject: [PATCH] Strict whitelist for all AppX packages, not just Microsoft MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sandboxed AppX/MSIX apps rarely have CVEs and the sandbox limits blast radius. Allowing all 3rd-party AppX packages through would dilute the report with irrelevant entries. Now uses a single whitelist for all publishers — only explicitly listed packages (CompanyPortal, Teams, Office, Terminal, etc.) pass. Removes the Microsoft vs 3rd-party distinction and the separate framework/runtime exclude list (no longer needed). https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw --- .../Analyzers/SoftwareInventoryAnalyzer.cs | 40 ++++--------------- 1 file changed, 7 insertions(+), 33 deletions(-) diff --git a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Analyzers/SoftwareInventoryAnalyzer.cs b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Analyzers/SoftwareInventoryAnalyzer.cs index fde84989..4a6d73c6 100644 --- a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Analyzers/SoftwareInventoryAnalyzer.cs +++ b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Analyzers/SoftwareInventoryAnalyzer.cs @@ -294,12 +294,13 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Analyzers }; // ----------------------------------------------------------------------- - // AppX package filtering — whitelist approach to avoid inbox app noise - // Only Microsoft packages on this list pass through; all non-Microsoft - // publisher packages are allowed (they are rare and usually relevant). + // AppX package filtering — strict whitelist for all publishers + // Sandboxed AppX/MSIX apps rarely have CVEs and the sandbox limits + // blast radius, so we only surface packages with known security or + // enterprise relevance to keep the report clean. // ----------------------------------------------------------------------- - private static readonly HashSet AppxMicrosoftWhitelist = new HashSet(StringComparer.OrdinalIgnoreCase) + private static readonly HashSet AppxWhitelist = new HashSet(StringComparer.OrdinalIgnoreCase) { // Intune / device management "Microsoft.CompanyPortal", @@ -330,17 +331,6 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Analyzers "Microsoft.OneDriveSync", }; - // Prefixes that always indicate noise (frameworks, runtimes, OS plumbing) - private static readonly string[] AppxAlwaysExcludePrefixes = new[] - { - "Microsoft.NET.", // .NET runtimes - "Microsoft.VCLibs.", // VC++ runtime - "Microsoft.UI.Xaml.", // WinUI framework - "Microsoft.DirectX.", // DirectX runtime - "Microsoft.Services.", // OS services - "Microsoft.Advertising.", // Ad SDK - }; - // Pattern: {Publisher.PackageName}_{Version}_{Arch}__{PublisherHash} private static readonly Regex AppxPackagePattern = new Regex( @"^(.+?)_(\d+(?:\.\d+)*)_([^_]*)__([a-z0-9]+)$", @@ -611,30 +601,14 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Analyzers private static bool ShouldExcludeAppx(string packageFullName) { - // Always exclude frameworks/runtimes regardless of publisher - foreach (var prefix in AppxAlwaysExcludePrefixes) - { - if (packageFullName.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)) - return true; - } - // Extract the package identity (everything before the first underscore) var underscoreIndex = packageFullName.IndexOf('_'); var packageId = underscoreIndex > 0 ? packageFullName.Substring(0, underscoreIndex) : packageFullName; - // Non-Microsoft publishers: allow through (rare, usually relevant 3rd-party apps) - bool isMicrosoft = packageId.StartsWith("Microsoft", StringComparison.OrdinalIgnoreCase) - || packageId.StartsWith("MSTeams", StringComparison.OrdinalIgnoreCase) - || packageId.StartsWith("Windows.", StringComparison.OrdinalIgnoreCase) - || packageId.StartsWith("Clipchamp.", StringComparison.OrdinalIgnoreCase); - - if (!isMicrosoft) - return false; // 3rd-party → keep - - // Microsoft publisher: only allow whitelisted packages - return !AppxMicrosoftWhitelist.Contains(packageId); + // Strict whitelist — only explicitly listed packages pass through + return !AppxWhitelist.Contains(packageId); } private static SoftwareEntry ParseAppxPackageName(string packageFullName)