Skip to content

MDE Toolkit 3.1.2

Choose a tag to compare

View all tags
@chlaplan chlaplan released this 19 Jun 14:13
· 6 commits to master since this release
3.1.2
d1835c0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

• Recommendations skip rule levels they can't honestly satisfy from AH data (no more placeholder , no more REPLACE_WITH_ROOT_TBS_HASH signers).
• New ManualReview sentinel for events with zero usable metadata — surfaced in the grid, excluded from exports.
• Policy export now merges into one of four Microsoft WDAC Wizard templates (Empty Supplemental / Default Windows / Allow Microsoft / Signed and Reputable) with proper / / wiring (UMCI=12, KMCI=131) so the resulting AllowMicrosoft.xml actually enforces rules.
• New "Auto-compile to .cip after export" checkbox runs ConvertFrom-CIPolicy and drops the .cip next to the AllowMicrosoft.xml.
• Hash rules now emit both SHA256 + SHA1; FileName rules now valid .
• Per-policy coverage credits every policy that allowed an event
• Risk badge follows the recommended rule type instead of just file location.
• Policy comparer evaluates against all selected policies with Deny-overrides-Allow precedence.

Assets 4
Loading