MDE Toolkit 3.1.1

New App Control for Business → Advanced Hunting sub-page that pulls live WDAC events from Microsoft Defender for Endpoint, compares them against your local or custom App Control policies, and recommends the right allow rules to author — with the same -Level / -Fallback precedence semantics as PowerShell New-CIPolicy.

✨ New: App Control for Business - Advanced Hunting

• Direct Advanced Hunting integration. Sign in with MSAL and pull WDAC events (DeviceTvmInfoGathering, audit / enforced blocks, signing-info, script blocks) from the Microsoft Defender for Endpoint Advanced Hunting API. All four sovereign clouds are supported out of the box: Commercial, US Gov GCC, US Gov GCC High, and US Gov DoD — the right endpoint and authority host are picked automatically.
• KQL editor + presets. Built-in editor with one-click presets (All / Blocks only / Audits only / Scripts only / Signing info) that swap the ActionType filter via regex so your custom WHERE clauses survive. Save / load .kql files to share queries with the team.
• Compare against local or custom policies. Load every .cip in C:\Windows\System32\CodeIntegrity\CIPolicies\Active plus SiPolicy.p7b in one click, or browse to a folder of .cip / .p7b / .xml policies (recursive optional). Each event is evaluated as Allowed, Denied (explicit), or Would Still Block across every selected policy. Explicit Deny wins over Allow anywhere in the set, matching how WDAC merges policies at runtime.
• Action plan card. Rolls up the unresolved events into a plain-English plan: how many unique Publisher / FileAttribute / FilePath / Hash rules you’ll need to author, how many Microsoft-signed / kernel / script events were filtered out, and which policies are doing the heavy lifting (per-policy coverage bar).

🔀 Rule precedence (PowerShell -Level / -Fallback)
All 13 documented file-rule levels are supported. Hash, FileName, FilePath, SignedVersion, Publisher, FilePublisher, LeafCertificate, PcaCertificate, RootCertificate, WHQL, WHQLPublisher, WHQLFilePublisher, and PFN.
Admin-configurable precedence. The Policies side-drawer has a new Rule precedence expander with a single list of all 13 levels. Drag rows to re-rank them; the top entry becomes -Level and the rest become -Fallback in order. A live Consolas-styled preview shows the resulting PowerShell-equivalent command. Order is persisted to %LOCALAPPDATA%\MDE-Toolkit\advanced-hunting-prefs.json.
The recommender walks your order, not a hard-coded one. For each event the comparer picks the first level the Advanced Hunting data actually has enough metadata to satisfy - just like New-CIPolicy. Defaults to Microsoft’s recommended FilePublisher → Publisher → SignedVersion → FileName → Hash → FilePath on first launch.
Hash > FilePath when both are available. Hash pins exact bytes, so it’s now preferred over FilePath even for admin-only folders. FilePath only wins when the event has no usable hash at all.