Commit Graph

31 Commits

Author SHA1 Message Date
Oliver Kieselbach f6ed4660d1 agent: secureboot certs incl. analyze rule, timezone auto set, NTP offset check 2026-03-26 09:23:12 +01:00
Claude e2073ebeba Fix 4 more incorrect CPE entries found by NVD verification
- Docker Desktop: docker_desktop → desktop (NVD uses docker:desktop)
- BlackBerry Protect: cylanceprotect → protect (rebranded in NVD)
- WithSecure: f-secure vendor → withsecure (company rebranded)
- ProtonVPN: protonvpn vendor → proton (correct NVD vendor)

Total fixes across all commits: 7 incorrect CPE entries corrected.

https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 16:51:06 +00:00
Claude 9b37832347 Add 14 more CPE mappings: hardware drivers, CAD/engineering, productivity
Hardware drivers (highest CVE relevance, previously missing category):
- Intel Graphics Driver, Intel Chipset Device Software
- AMD Radeon Software
- NVIDIA GeForce Experience
- Realtek HD Audio Driver
- Canon printer driver

OEM management:
- Lenovo Vantage (complements existing System Update entry)

Creative/Media:
- Adobe Media Encoder (completes CC suite coverage)

Engineering/CAD (enterprise manufacturing/construction):
- Autodesk AutoCAD, Autodesk Revit
- SolidWorks, MATLAB
- Siemens Teamcenter (PLM)

Productivity:
- Grammarly

Total mappings: 247 → 261

https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 16:50:13 +00:00
Claude 55da532f17 Improve CPE mapping seed: fix 3 incorrect entries, add 41 new mappings
Fixes (NVD-verified):
- CrowdStrike: falcon_sensor → falcon (correct NVD product name)
- Bitwarden: desktop → bitwarden (correct NVD product name)
- Nmap: removed npcap from displayNamePatterns (separate product)

New mappings added (41 entries, 206→247 total):
- Adobe Creative Suite: Creative Cloud, Photoshop, Illustrator, InDesign,
  Premiere Pro, After Effects, Animate, Bridge
- Hardware management: Dell SupportAssist, HP Support Assistant,
  Intel Driver & Support Assistant, NVIDIA GPU Display Driver
- VPN/Security: SonicWall NetExtender, Check Point Endpoint Security,
  Cisco Secure Client, Ivanti Secure Access Client
- Security tools: Tenable Nessus/Agent, RSA SecurID, Trellix Agent,
  Absolute Persistence, Wazuh Agent
- Enterprise: SolarWinds Orion, ManageEngine Endpoint Central,
  Progress WhatsUp Gold, Elastic Agent
- Communication: Mitel MiCollab, RingCentral, Cisco Webex Teams
- Development: JetBrains CLion/PhpStorm/RubyMine/Toolbox,
  Snyk CLI, Beyond Compare, WinMerge
- Print drivers: HP Universal, Ricoh, Lexmark
- Cloud storage: Box Drive, Citrix ShareFile

Also: Edge displayNamePatterns expanded for WebView2 Runtime,
version bumped to 1.1.0, lastUpdated set to 2026-03-21.

https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 16:48:41 +00:00
Oliver Kieselbach 8e0bf00079 simplified seeding 2026-03-21 00:16:25 +01:00
Oliver Kieselbach f977f7a31c debounce esp_provisioning_status, re-check vulnerabilities, save button fixes, rule engine fix min one condition required 2026-03-20 22:43:58 +01:00
Oliver Kieselbach f1d653e60e feat: enhanced software inventory and vulnerability report 2026-03-20 19:01:16 +01:00
okieselbach c2a9a647b8 chore: regenerate rules/dist from individual files 2026-03-20 13:56:55 +00:00
Oliver Kieselbach 709905fac9 fix rule 2026-03-20 14:56:10 +01:00
Oliver Kieselbach dc3a3a5923 added security category to rule schema 2026-03-20 14:49:47 +01:00
Oliver Kieselbach 26e5925672 feat: Software Inventory Analyzer with Vulnerability Correlation 2026-03-20 14:43:58 +01:00
Oliver Kieselbach 767b2d7807 changed link reference in admin analyze 2026-03-18 11:17:08 +01:00
Oliver Kieselbach 1bb0aea6c3 fix admin analyze rule 2026-03-18 11:06:09 +01:00
Oliver Kieselbach 09998249fa added local admin analyze rule, 2026-03-18 10:57:04 +01:00
okieselbach d1d88f57df chore: regenerate rules/dist from individual files 2026-03-17 21:44:00 +00:00
Oliver Kieselbach c3b8f12300 fix community gather cert rule 2026-03-17 22:43:17 +01:00
okieselbach 0b607df09b chore: regenerate rules/dist from individual files 2026-03-17 21:32:34 +00:00
Oliver Kieselbach 4dc61b4728 fix IsDeviceOnlyDeployment completion event, added community rules 2026-03-17 22:31:49 +01:00
Oliver Kieselbach c6899cf898 fixed new gather rules and added severity override 2026-03-17 18:19:21 +01:00
Oliver Kieselbach 280a413dac added centralized guardrails for easier maintenance, added some more gather rules 2026-03-17 17:17:08 +01:00
Oliver Kieselbach ae47161be5 fix summary cleanup, added old OS warning analyze rule 2026-03-09 17:49:55 +01:00
Oliver Kieselbach 0b960d7d6f added PowerShell Script Execution Tracking 2026-03-05 10:12:57 +01:00
Oliver Kieselbach eae2898ce2 add Galactic Admin audit logs, audit pagination, and platform metrics backend cache
- Galactic Admin Mode for Audit Logs: banner + cross-tenant endpoint (galactic/audit/logs)
- Audit page pagination (12 entries per page) with Previous/Next controls
- Platform Metrics: moved computation to backend PlatformMetricsService with 5-min cache
- New endpoint GET /api/galactic/metrics/platform replaces N+1 client-side fetches
- IME log tracker enhancements, DO telemetry pattern, and download progress improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-02 19:40:37 +01:00
okieselbach 0b322f2d2c chore: regenerate rules/dist from individual files 2026-02-28 13:12:14 +00:00
Oliver Kieselbach 65860d7e9b version bump 2026-02-28 14:11:35 +01:00
Oliver Kieselbach a1c9e9a576 chagned gather rule phase definition 2026-02-28 14:07:57 +01:00
Oliver Kieselbach 64a9a0aa99 chore: unignore rules/dist/ and add initial combined rule files
rules/dist/ was excluded by the global dist/ .gitignore pattern.
Added !rules/dist/ exception so the combine-rules workflow can
commit the generated files. Also adds the initial dist files.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-02-28 13:24:15 +01:00
Oliver Kieselbach 7cb5cf040c fix: add count_per_group_gte operator to analyze rule schema
Adds the missing operator to the enum so ANALYZE-APP-006.json passes
schema validation in the combine-rules workflow.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-02-28 13:19:35 +01:00
Oliver Kieselbach 1f796bf6e3 feat: externalize rules to GitHub + API consolidation + preview mode
## Rules as GitHub single source of truth
- Add 75 individual JSON rule files (2 gather, 18 analyze, 55 IME patterns)
  under rules/gather/, rules/analyze/, rules/ime-log-patterns/
- Add JSON Schemas for all three rule types with VS Code IntelliSense support
- Add CI combine script (rules/scripts/combine.js) + GitHub Action that
  validates schemas with ajv-cli and generates rules/dist/ combined files
- Convert BuiltIn*.cs from hardcoded C# objects to embedded JSON resource loaders
- Add GitHubRuleRepository service to fetch dist/ files from raw.githubusercontent.com
- Add ReseedFromGitHubFunction: POST /api/rules/reseed-from-github?type=all|gather|analyze|ime

## IME Log Patterns
- Extend ImeLogPattern model with Description and IsBuiltIn properties
- Add ImeLogPatterns table + API constants
- Add TableStorageService CRUD methods for IME log patterns
- Add ImeLogPatternService (CRUD, merge, auto-seed from embedded JSON)
- Add ImeLogPatternsFunction: GET/PUT /api/rules/ime-log-patterns (Phase 1: read-only
  for tenants, Galactic Admin can enable/disable/edit globally)
- Add IME Log Patterns management page (/ime-log-patterns)
- Wire GetAgentConfigFunction to use ImeLogPatternService instead of static class

## API route consolidation
- All rule endpoints now under /api/rules/* for single certificate exclusion path:
  /api/rules/gather, /api/rules/analyze, /api/rules/ime-log-patterns,
  /api/rules/reseed-from-github

## Export buttons
- Add per-rule and export-all JSON download buttons to gather-rules,
  analyze-rules, and ime-log-patterns pages

## Admin configuration
- Replace old individual reseed buttons with unified "Fetch & Reseed from GitHub"
  (calls new GitHub endpoint) plus compact individual-type reseed buttons
- Add CDN cache hint: GitHub raw.githubusercontent.com caches up to 5 minutes

## Preview mode
- ?preview=1 URL param seeds localStorage.previewMode (persists across navigation)
- ?preview=0 clears it; toggle in Navbar settings dropdown (indigo, eye icon)
- IME Log Patterns nav link gated behind galacticAdminMode OR previewMode
- Preview badge shown on nav link when active for normal users

## Tests
- Add xUnit test project (net8.0) with 5 tests for embedded resource loading,
  known IME actions validation, and valid categories check

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-28 13:12:09 +01:00
Oliver Kieselbach 080624cc5b parsing signalr messages fix 2026-02-10 11:34:58 +01:00
Oliver Kieselbach 5690620058 Initial commit 2026-02-05 06:14:41 +01:00