3e7f66e8ea
added app dashboard
2026-04-07 15:57:45 +02:00
3a5bf83b7c
new seed file
2026-04-07 09:47:59 +02:00
860d00c017
added better error code handling and mapping
2026-04-06 17:53:55 +02:00
0976a6e45e
new template analyze rule fix
2026-04-03 20:05:19 +02:00
ed0e19fa36
added template vars to analyze rules for better user journey
2026-04-03 19:52:58 +02:00
e19852cd9a
add structured error code extraction from IME log patterns
...
The backend already reads errorCode from event data for FailureCode and
failure reason formatting, but the agent never populated it. This change
extracts error codes (exit codes, HRESULT) from named regex capture groups
in IME log error patterns and sends them as structured errorCode fields.
Also fixes a pre-existing bug where ErrorPatternId/ErrorDetail were not
persisted across agent restarts.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-03 16:56:00 +02:00
eaba031b82
fix multiline script output matching in PS-AGENT-OUTPUT/ERROR patterns
...
.* doesn't match newlines without Singleline flag — script stdout/stderr
from AgentExecutor.log spans multiple lines and was never captured.
Changed to [\s\S]*? to match across newlines.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-03 11:25:53 +02:00
7763563c76
improved matching with exclude pattern
2026-04-02 23:13:21 +02:00
743d7b3372
fixex for vulnerability matching (respect platform, wildcard matches with low confidance flag now, mismatched secure client, updated seed file)
2026-04-02 21:36:57 +02:00
e3a99e519a
Fix CVE version filtering to exclude already-fixed vulnerabilities
...
The FilterByVersion wildcard logic was treating CVEs with specific
versions in their CPE URI as affecting ALL versions. Now extracts the
version from the CPE 2.3 URI and compares it against the installed
version, so only truly relevant CVEs are shown.
Also adds missing CPE seed mappings for common Intune/Autopilot
managed software: Intune Management Extension, Company Portal,
ODBC/OLE DB drivers, Remote Desktop, Azure CLI.
https://claude.ai/code/session_01Kv2aAEVqbeFSsyPv7gU7pF
2026-03-28 18:03:29 +00:00
f6ed4660d1
agent: secureboot certs incl. analyze rule, timezone auto set, NTP offset check
2026-03-26 09:23:12 +01:00
e2073ebeba
Fix 4 more incorrect CPE entries found by NVD verification
...
- Docker Desktop: docker_desktop → desktop (NVD uses docker:desktop)
- BlackBerry Protect: cylanceprotect → protect (rebranded in NVD)
- WithSecure: f-secure vendor → withsecure (company rebranded)
- ProtonVPN: protonvpn vendor → proton (correct NVD vendor)
Total fixes across all commits: 7 incorrect CPE entries corrected.
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 16:51:06 +00:00
9b37832347
Add 14 more CPE mappings: hardware drivers, CAD/engineering, productivity
...
Hardware drivers (highest CVE relevance, previously missing category):
- Intel Graphics Driver, Intel Chipset Device Software
- AMD Radeon Software
- NVIDIA GeForce Experience
- Realtek HD Audio Driver
- Canon printer driver
OEM management:
- Lenovo Vantage (complements existing System Update entry)
Creative/Media:
- Adobe Media Encoder (completes CC suite coverage)
Engineering/CAD (enterprise manufacturing/construction):
- Autodesk AutoCAD, Autodesk Revit
- SolidWorks, MATLAB
- Siemens Teamcenter (PLM)
Productivity:
- Grammarly
Total mappings: 247 → 261
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 16:50:13 +00:00
55da532f17
Improve CPE mapping seed: fix 3 incorrect entries, add 41 new mappings
...
Fixes (NVD-verified):
- CrowdStrike: falcon_sensor → falcon (correct NVD product name)
- Bitwarden: desktop → bitwarden (correct NVD product name)
- Nmap: removed npcap from displayNamePatterns (separate product)
New mappings added (41 entries, 206→247 total):
- Adobe Creative Suite: Creative Cloud, Photoshop, Illustrator, InDesign,
Premiere Pro, After Effects, Animate, Bridge
- Hardware management: Dell SupportAssist, HP Support Assistant,
Intel Driver & Support Assistant, NVIDIA GPU Display Driver
- VPN/Security: SonicWall NetExtender, Check Point Endpoint Security,
Cisco Secure Client, Ivanti Secure Access Client
- Security tools: Tenable Nessus/Agent, RSA SecurID, Trellix Agent,
Absolute Persistence, Wazuh Agent
- Enterprise: SolarWinds Orion, ManageEngine Endpoint Central,
Progress WhatsUp Gold, Elastic Agent
- Communication: Mitel MiCollab, RingCentral, Cisco Webex Teams
- Development: JetBrains CLion/PhpStorm/RubyMine/Toolbox,
Snyk CLI, Beyond Compare, WinMerge
- Print drivers: HP Universal, Ricoh, Lexmark
- Cloud storage: Box Drive, Citrix ShareFile
Also: Edge displayNamePatterns expanded for WebView2 Runtime,
version bumped to 1.1.0, lastUpdated set to 2026-03-21.
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 16:48:41 +00:00
8e0bf00079
simplified seeding
2026-03-21 00:16:25 +01:00
f977f7a31c
debounce esp_provisioning_status, re-check vulnerabilities, save button fixes, rule engine fix min one condition required
2026-03-20 22:43:58 +01:00
f1d653e60e
feat: enhanced software inventory and vulnerability report
2026-03-20 19:01:16 +01:00
c2a9a647b8
chore: regenerate rules/dist from individual files
2026-03-20 13:56:55 +00:00
709905fac9
fix rule
2026-03-20 14:56:10 +01:00
dc3a3a5923
added security category to rule schema
2026-03-20 14:49:47 +01:00
26e5925672
feat: Software Inventory Analyzer with Vulnerability Correlation
2026-03-20 14:43:58 +01:00
767b2d7807
changed link reference in admin analyze
2026-03-18 11:17:08 +01:00
1bb0aea6c3
fix admin analyze rule
2026-03-18 11:06:09 +01:00
09998249fa
added local admin analyze rule,
2026-03-18 10:57:04 +01:00
d1d88f57df
chore: regenerate rules/dist from individual files
2026-03-17 21:44:00 +00:00
0b607df09b
chore: regenerate rules/dist from individual files
2026-03-17 21:32:34 +00:00
c6899cf898
fixed new gather rules and added severity override
2026-03-17 18:19:21 +01:00
280a413dac
added centralized guardrails for easier maintenance, added some more gather rules
2026-03-17 17:17:08 +01:00
ae47161be5
fix summary cleanup, added old OS warning analyze rule
2026-03-09 17:49:55 +01:00
0b960d7d6f
added PowerShell Script Execution Tracking
2026-03-05 10:12:57 +01:00
eae2898ce2
add Galactic Admin audit logs, audit pagination, and platform metrics backend cache
...
- Galactic Admin Mode for Audit Logs: banner + cross-tenant endpoint (galactic/audit/logs)
- Audit page pagination (12 entries per page) with Previous/Next controls
- Platform Metrics: moved computation to backend PlatformMetricsService with 5-min cache
- New endpoint GET /api/galactic/metrics/platform replaces N+1 client-side fetches
- IME log tracker enhancements, DO telemetry pattern, and download progress improvements
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-02 19:40:37 +01:00
0b322f2d2c
chore: regenerate rules/dist from individual files
2026-02-28 13:12:14 +00:00
64a9a0aa99
chore: unignore rules/dist/ and add initial combined rule files
...
rules/dist/ was excluded by the global dist/ .gitignore pattern.
Added !rules/dist/ exception so the combine-rules workflow can
commit the generated files. Also adds the initial dist files.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-02-28 13:24:15 +01:00
Oliver Kieselbach