Oliver Kieselbach 4864b2d21d fix(security): gather RuleStats resolve the device-claimed ruleId against the tenant's active gather catalog — title/category/severity come from the catalog rule, unknown or inactive IDs are dropped, and the cross-tenant global_* row is written only for IsBuiltIn/IsCommunity catalog rules (same design as the analyze path); a forged GatherRuleExecutor event can no longer inflate fleet-wide counters, respell a built-in rule's title or mint global rows for retired IDs ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-30 12:13:00 +02:00

..

analyze-rule-triggers.md

feat(agent): live power-state watcher + battery analyze rules DEV-009/010

2026-08-21 15:24:41 +02:00

gather-rule-guardrails.md

feat(diagnostics): built-in collection catalog visible in the portal, RealmJoin + Device Preparation sections gated

2026-08-23 04:09:50 +02:00

gather-rule-phase-scoping.md

fix(security): gather-rule on_event feedback loop — timeline feed carries the event source and never dispatches on_event for gather-emitted events; per-rule on_event cap (100/session); backend rejects rules triggering on their own output type / gather_result

2026-08-29 23:54:44 +02:00

rule-authoring-surface.md

Logparser pattern testing with the agent's exact .NET engine (test_log_pattern) (#125)

2026-08-05 22:48:10 +02:00

rule-id-namespace.md

fix(security): gather RuleStats resolve the device-claimed ruleId against the tenant's active gather catalog — title/category/severity come from the catalog rule, unknown or inactive IDs are dropped, and the cross-tenant global_* row is written only for IsBuiltIn/IsCommunity catalog rules (same design as the analyze path); a forged GatherRuleExecutor event can no longer inflate fleet-wide counters, respell a built-in rule's title or mint global rows for retired IDs

2026-08-30 12:13:00 +02:00