Adding New Checks

Adding new checks

Checks are small classes that declare their data requirements via decorator and return finding dictionaries. Files placed under checks/ are auto-imported at startup; checks/EXAMPLE_TEMPLATES.py is skipped and holds commented templates you can copy as a starting point.

Decide which pattern fits the finding you're adding, then follow the matching section of the Framework Guide:

If your check...	Pattern	Reference
Reads a property on every user or computer	AD check	Writing an AD Check
Runs Cypher against MSSQL or SCCM nodes	Platform check	Writing a Platform Check
Detects an ADCS template or CA misconfiguration	ADCS check	Writing an ADCS Check
Queries a new OpenGraph plugin's custom nodes	OpenGraph check	Writing an OpenGraph Check and Working with OpenGraph plugins
Compares state across two domains	Cross-domain check	See checks/cross_domain/ — start from CrossDomainCheck and register the class with @CrossDomainRegistry.register

Before opening a PR

Run the framework tests:

python -m unittest tests.test_framework.test_datasource_abstraction tests.test_framework.test_manager_hardening tests.test_framework.test_domain_filtering tests.test_framework.test_discovery_smoke

Smoke-test against a lab dataset:

./adpathfinder.py --ad --diagnostics

For the full Check API reference — parameter tables, helpers, domain filter mixins, DataSource creation, testing — see the Framework Guide.