d59ce5b574
style update
2026-03-23 05:36:04 +01:00
ec6eb2f273
changed styling
2026-03-23 05:29:28 +01:00
4d71260e2e
admin settings expandable pattern
2026-03-23 05:21:01 +01:00
7b172d6270
expandable sidebar menu
2026-03-23 05:15:29 +01:00
2f2228d16f
fix sidebar
2026-03-23 05:04:08 +01:00
4a2b0e8ad9
re-org tenant settings
2026-03-23 04:53:17 +01:00
2a43a72907
re-org admin settings #2
2026-03-22 20:30:01 +01:00
8ab237530a
layout update software mapping
2026-03-22 20:22:25 +01:00
fe8ab4e32b
additional re-org of admin settings
2026-03-22 20:18:18 +01:00
23facc7b91
re-org admin config
2026-03-22 20:00:10 +01:00
8a3519be32
feat: software mappings, changes and bugfix
2026-03-22 18:47:28 +01:00
73c62b19ee
update FAQ region
2026-03-22 18:13:30 +01:00
fe1e23943f
Merge pull request #25 from okieselbach/claude/tenant-config-report-9WElF
...
Add tenant config report page for galactic admins
2026-03-22 18:06:47 +01:00
ea882754ec
Merge pull request #24 from okieselbach/claude/verify-inventory-migration-9Lfoo
...
Expand software inventory collection to include per-user and AppX packages
2026-03-22 18:05:55 +01:00
f6c927bb50
Update auto-generated build artifacts
...
https://claude.ai/code/session_0136YgG8JDuqAhHvMbALyPoZ
2026-03-21 19:29:12 +00:00
bc4c266470
Add Tenant Config Report page for Galactic Admins
...
New read-only report page that shows the full tenant configuration
and computed runtime parameters (AgentConfigResponse) side by side.
Helps Galactic Admins quickly analyze what a tenant has configured.
- Tenant selector to pick any tenant cross-tenant
- All TenantConfiguration fields grouped by section
- Computed runtime parameters with defaults applied
- Non-default values highlighted in purple for quick scanning
- SAS URLs are masked for security
- Added nav item to Galactic Admin section
https://claude.ai/code/session_0136YgG8JDuqAhHvMbALyPoZ
2026-03-21 19:28:36 +00:00
5465d7e1d4
Add Microsoft.ManagementApp back to AppX whitelist
...
Intune Management Extension (IME) is relevant for device management
monitoring alongside CompanyPortal.
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 18:29:48 +00:00
867e268855
Replace deprecated RemoteDesktop with Windows App in AppX whitelist
...
Microsoft.RemoteDesktop is deprecated, replaced by
MicrosoftCorporationII.WindowsApp (Windows App).
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 18:14:21 +00:00
ea2d907616
Remove 5 irrelevant entries from AppX whitelist
...
Removed packages that don't belong in the AppX filter:
- Microsoft.ManagementApp (IME is Win32, not AppX)
- Microsoft.MicrosoftOfficeHub (just a launcher, no attack surface)
- Microsoft.PowerBIDesktop (deployed as Win32, not AppX)
- Microsoft.SecHealthUI (UI shell only, Defender version from other sources)
- Microsoft.OneDriveSync (normal Win32 app, not AppX)
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 18:09:38 +00:00
fd00d976dc
Strict whitelist for all AppX packages, not just Microsoft
...
Sandboxed AppX/MSIX apps rarely have CVEs and the sandbox limits
blast radius. Allowing all 3rd-party AppX packages through would
dilute the report with irrelevant entries.
Now uses a single whitelist for all publishers — only explicitly
listed packages (CompanyPortal, Teams, Office, Terminal, etc.) pass.
Removes the Microsoft vs 3rd-party distinction and the separate
framework/runtime exclude list (no longer needed).
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 17:58:04 +00:00
7a5ffae480
Switch AppX filter from blacklist to whitelist strategy
...
The blacklist approach leaked dozens of inbox apps (Cortana, Xbox*,
Zune*, GetHelp, ScreenSketch, Clipchamp, MicrosoftCorporationII.*,
etc.) producing noise with no security relevance.
New approach:
- Microsoft-published packages: only a curated whitelist passes
(CompanyPortal, Teams, Office, WSL, Terminal, RemoteDesktop, etc.)
- Non-Microsoft publishers: always allowed (rare, usually relevant)
- Framework/runtime prefixes: always excluded regardless of publisher
This ensures near-zero noise from AppX enumeration.
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 17:43:39 +00:00
7f7e0ffc98
Add AppX/MSIX and HKU per-user software detection
...
Extend SoftwareInventoryAnalyzer with two new detection sources that
close significant gaps in installed software enumeration:
1. AppX/MSIX packages (AppxAllUserStore\Applications registry):
- Detects modern packaged apps: Company Portal, new Teams, etc.
- Filters out OS components, frameworks, and runtimes to avoid noise
- Parses package full names into vendor/product/version
2. HKU per-user Uninstall keys (via ProfileList SID enumeration):
- Detects per-user installs: VS Code user, Teams Classic, Spotify
- Iterates loaded user hives via Registry.Users
- Skips current user SID to avoid duplicates with existing HKCU read
Both methods are pure registry reads — no WMI, no PowerShell, no
external tools. Typical overhead < 50ms.
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 17:37:19 +00:00
e2073ebeba
Fix 4 more incorrect CPE entries found by NVD verification
...
- Docker Desktop: docker_desktop → desktop (NVD uses docker:desktop)
- BlackBerry Protect: cylanceprotect → protect (rebranded in NVD)
- WithSecure: f-secure vendor → withsecure (company rebranded)
- ProtonVPN: protonvpn vendor → proton (correct NVD vendor)
Total fixes across all commits: 7 incorrect CPE entries corrected.
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 16:51:06 +00:00
9b37832347
Add 14 more CPE mappings: hardware drivers, CAD/engineering, productivity
...
Hardware drivers (highest CVE relevance, previously missing category):
- Intel Graphics Driver, Intel Chipset Device Software
- AMD Radeon Software
- NVIDIA GeForce Experience
- Realtek HD Audio Driver
- Canon printer driver
OEM management:
- Lenovo Vantage (complements existing System Update entry)
Creative/Media:
- Adobe Media Encoder (completes CC suite coverage)
Engineering/CAD (enterprise manufacturing/construction):
- Autodesk AutoCAD, Autodesk Revit
- SolidWorks, MATLAB
- Siemens Teamcenter (PLM)
Productivity:
- Grammarly
Total mappings: 247 → 261
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 16:50:13 +00:00
55da532f17
Improve CPE mapping seed: fix 3 incorrect entries, add 41 new mappings
...
Fixes (NVD-verified):
- CrowdStrike: falcon_sensor → falcon (correct NVD product name)
- Bitwarden: desktop → bitwarden (correct NVD product name)
- Nmap: removed npcap from displayNamePatterns (separate product)
New mappings added (41 entries, 206→247 total):
- Adobe Creative Suite: Creative Cloud, Photoshop, Illustrator, InDesign,
Premiere Pro, After Effects, Animate, Bridge
- Hardware management: Dell SupportAssist, HP Support Assistant,
Intel Driver & Support Assistant, NVIDIA GPU Display Driver
- VPN/Security: SonicWall NetExtender, Check Point Endpoint Security,
Cisco Secure Client, Ivanti Secure Access Client
- Security tools: Tenable Nessus/Agent, RSA SecurID, Trellix Agent,
Absolute Persistence, Wazuh Agent
- Enterprise: SolarWinds Orion, ManageEngine Endpoint Central,
Progress WhatsUp Gold, Elastic Agent
- Communication: Mitel MiCollab, RingCentral, Cisco Webex Teams
- Development: JetBrains CLion/PhpStorm/RubyMine/Toolbox,
Snyk CLI, Beyond Compare, WinMerge
- Print drivers: HP Universal, Ricoh, Lexmark
- Cloud storage: Box Drive, Citrix ShareFile
Also: Edge displayNamePatterns expanded for WebView2 Runtime,
version bumped to 1.1.0, lastUpdated set to 2026-03-21.
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
2026-03-21 16:48:41 +00:00
a300d4b7d4
layout modal fix
2026-03-21 08:14:22 +01:00
aa0b8f3ca7
Added oobeConfig modal dialog
2026-03-21 08:05:23 +01:00
056bbb92ac
fix autoscroll
2026-03-21 00:45:50 +01:00
4fadf0cdde
button alignment
2026-03-21 00:44:19 +01:00
8e0bf00079
simplified seeding
2026-03-21 00:16:25 +01:00
6f24bf0c75
CPE Mappings simplified
2026-03-20 23:51:12 +01:00
f977f7a31c
debounce esp_provisioning_status, re-check vulnerabilities, save button fixes, rule engine fix min one condition required
2026-03-20 22:43:58 +01:00
0f6ff19e8a
fix CISA url
2026-03-20 22:09:33 +01:00
5c45e072d2
layout update
2026-03-20 21:57:52 +01:00
1dc38ecb6d
feat store vulnerability reports in own table, changed design margin on public sites, fixed security event sequence order
2026-03-20 21:47:19 +01:00
945df7c816
minor fixes for the new inventory and vulnerability feature
2026-03-20 19:17:56 +01:00
f1d653e60e
feat: enhanced software inventory and vulnerability report
2026-03-20 19:01:16 +01:00
65702f7a64
fix ui for vulnerability report
2026-03-20 17:06:02 +01:00
49204b1290
settings added save reset feedback
2026-03-20 16:03:24 +01:00
b745d72089
settings design change
2026-03-20 15:58:07 +01:00
8db2557896
visability change
2026-03-20 15:47:01 +01:00
5b596a9447
fix error and prevent fatal crashes
2026-03-20 15:33:03 +01:00
1da218a6c0
fix loop error
2026-03-20 15:24:17 +01:00
75f86e69c1
Merge branch 'main' of https://github.com/okieselbach/Autopilot-Monitor
2026-03-20 15:18:04 +01:00
17ec745c59
fix error sessions
2026-03-20 15:17:58 +01:00
c2a9a647b8
chore: regenerate rules/dist from individual files
2026-03-20 13:56:55 +00:00
709905fac9
fix rule
2026-03-20 14:56:10 +01:00
b62c2c554a
changed default für Software Inventory & Vulnerability Analyzer to off (pre-release phase)
2026-03-20 14:53:40 +01:00
dc3a3a5923
added security category to rule schema
2026-03-20 14:49:47 +01:00
26e5925672
feat: Software Inventory Analyzer with Vulnerability Correlation
2026-03-20 14:43:58 +01:00
Oliver Kieselbach