Skip to content

MDE Toolkit 3.2.1

Choose a tag to compare

View all tags
@chlaplan chlaplan released this 03 Aug 22:00
· 6 commits to master since this release
3.2.1
d1835c0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Major App Control / WDAC workflow upgrade
  • New Advanced Hunting deep-dive tools for policy impact analysis
  • New interactive export report experience with PDF, HTML, JSON, and redaction options
  • New Policy Diff / Merge workflow
  • Improved fleet-impact querying for large tenants
  • Better local policy discovery, including active WDAC policies and optional EFI policy locations
  • Improved background collection and upload schema for enterprise reporting

App Control and WDAC

  • Added a deeper App Control workflow with:
    • Vendor / product picker for Advanced Hunting scoping
    • Policy impact scanner for local files
    • Policy comparison against loaded WDAC policies
    • Fleet impact mode for tenant-wide would-block analysis
    • Policy diff / merge popup for comparing multiple policies
  • Added clearer per-policy status:
    • Audit vs Enforced
    • Signed policy indicators
    • Improved handling for supplemental policies inheriting base-policy mode
  • Enhanced WDAC policy page:
    • Added policy status display
    • Added optional EFI policy scanning
    • Improved local active policy discovery
    • Better support for .cip, .p7b, and XML policy sources

Advanced Hunting

  • Added support for both Microsoft Graph Advanced Hunting and direct MDE API authentication paths.
  • Added local-policy and custom-folder policy loading.
  • Added option to exclude already-covered policy rules from generated KQL so results focus on gaps.
  • Added a guided Advanced Hunting walkthrough.
  • Improved fleet-impact queries:
    • Aggregates by unique binary
    • Tracks distinct impacted devices
    • Adds event count rollups
    • Uses sharded/adaptive query execution to avoid large-tenant result-size and timeout failures
    • Handles retryable failures more gracefully

Exporting and reporting

  • Replaced the old ticket PDF flow with a new Export Report dialog.
  • Added output format options:
    • PDF only
    • HTML only
    • Both PDF and HTML
    • Optional raw JSON snapshot
  • Added report section selection with all/none shortcuts.
  • Added redaction options for:
  • Machine/current user
  • UPN/email addresses
  • IP addresses
  • Serial number placeholder
  • Redesigned PDF output with:
    • Dashboard verdict page
    • Table of contents
    • Bookmarks
    • Repeating table headers
    • Footer with machine/timestamp/page numbers
  • Added new self-contained HTML report:
    • Searchable
    • Sortable tables
    • Collapsible sections
    • Sticky navigation
    • Dark-mode support
    • Print-friendly styling
  • Modernized triage report HTML to match the new report style.
  • Added CLI parity for report export:
    • --export-html
    • --format
    • --include-json
    • --redact
    • --include-sections

Knowledge Base and scoring

  • Added Knowledge Base navigation/content for application guidance.
  • Fixed PUA Protection security-score handling.
  • Added cross-reference guidance from App Control areas into the KB.

CAB / compliance / grid fixes

  • Fixed CAB/event insight grid usability:
    • Re-enabled virtualization
    • Improved scrolling
    • Added sortable columns
    • Added row details for long content
  • Fixed compliance grid behavior:
    • Better sorting
    • Improved scrolling
    • Added expandable details for notes/details

Background collection and enterprise upload

Latest branch changes after the 3.2.1 bump improve the collect/upload path:

  • Background collector now flattens summary fields into the root JSON payload for easier Function App and Azure Table mapping.

  • Added more collected summary fields:

    • Platform version
    • Engine/signature versions
    • Scan timestamps
    • IP address
    • last boot time
    • MDE Org ID
    • device tag / org unit / environment label

  • Added registry/filesystem fallbacks for Defender version and scan data when CIM/WMI is unavailable under SYSTEM.

  • Improved App Control status detection by checking deployed .cip policy count and enforcement/audit state.

  • Improved Function App ingestion with new table fields:

    • DeviceTag
    • OrgUnit
    • Environment
    • PlatformVersion

Fixes

  • Fixed Advanced Hunting export and policy comparison issues.
  • Fixed large Advanced Hunting pulls by sharding fleet-impact queries.
  • Fixed PDF/HTML report inconsistencies.
  • Fixed empty HTML policy/device-control report tables.
  • Fixed Policy Diff picker scrolling/minimum size.
  • Fixed export settings window layout.
  • Fixed App Control audit/enforced counters.
  • Fixed signed .cip detection display.
  • Fixed CAB and compliance grid scrolling/sorting issues.
Assets 4
Loading