Skip to content

MDE Toolkit 3.2.0

Choose a tag to compare

View all tags
@chlaplan chlaplan released this 02 Jul 18:26
· 6 commits to master since this release
3.2.0
d1835c0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

App Control Deep-Dive

A workflow-focused release that adds six Application Control features and a
completely new ticket-attachment export pipeline for Tier II / III support.

Highlights

Fixes

  • UI regex characters Removed regex characters from UI

🔍 Six new App Control features

  • Vendor & Product picker for Advanced Hunting — scope Day-1 hunts to a
    specific publisher/product without hand-writing KQL.
  • Audit-mode banner + per-policy Mode/Signed columns on the Overview
    page so you can see at a glance whether policies are enforced, in audit,
    and CMS-signed.
  • Impact Scanner (renamed from File Scanner) — load any policy,
    scan a folder / the local machine, and see predicted allow/block/audit
    outcomes. Includes a guided tour on first use.
  • Fleet Impact toggle in Advanced Hunting — a single click switches AH
    to a unique-binary, device-aggregated view that answers "should I deploy
    this policy?" with would-block %, devices affected, and top vendors.
  • Policy Diff & Merge popup — compare N loaded policies (In-All /
    Only-in-some / Conflict) and merge them into a single fresh SiPolicy XML.
  • PDF ticket reports — completely redesigned first-page dashboard with
    HEALTHY / REVIEW / DEGRADED verdict, TOC with real page numbers, per-WDAC
    bookmarks, repeating table headers, alternating row bands.

📎 New Export Report dialog (replaces "Save PDF for ticket…")

  • Format: PDF only / HTML only / Both.
  • Sections: 19 checkboxes with All / None shortcuts.
  • Redaction: machine name, UPN, IP addresses.
  • Extras: also emit raw JSON snapshot.
  • Post-actions: open when done / reveal in Explorer.
  • Preferences persist across launches
    (%LocalAppData%\MDE-Monitoring-App\export-prefs.json).

🌐 HTML export (new)

Single self-contained .html file — no frameworks, no external assets:

  • Sticky toolbar with page-wide search, Expand/Collapse-all, Print.
  • Sticky TOC that jumps cleanly to sections.
  • Every section is a <details> — WDAC policies collapse by default so
    a 20-policy machine still opens on one screen.
  • Sortable tables — click any header (numeric columns detected).
  • Dark-mode CSS via prefers-color-scheme.
  • Print stylesheet strips interactive chrome for clean printouts.

📝 Triage Report HTML modernized

Same visual language as the Export Report — dark-mode, sticky TOC, verdict
banner, collapsible sections, sortable tables, in-page search. Markdown
output is unchanged for pasting into ticket bodies.

🖥️ CLI parity with the GUI

--export-html, --format, --include-json, --redact,
--include-sections all wired through the same pipeline as the GUI.
Batch mode (--machines-file) honours every new flag. Backwards compatible:
--export-pdf alone still produces exactly one PDF.

Assets 4
Loading