GSH v1.5.0 — Real Windows Event Log Output

What's in this release

• A real Windows Application Event Log adapter (adapters/windows_eventlog.py). Set siem_output: windows_eventlog in your policy YAML and both gsh-sentinel-deploy.py and gsh-mcp-proxy.py will write findings to the local Windows Application Event Log under a registered source (default GSH-Sentinel), for pickup by an existing Windows-based log forwarder (Winlogbeat, NXLog, etc.).
• Severity maps to Windows event type: CRITICAL/HIGH → Error, MEDIUM → Warning, LOW → Information.
• Windows-only, and optional even there: the module imports cleanly on any platform. pywin32 is now an optional, platform-marked dependency (pywin32>=306; sys_platform == "win32" in requirements.txt) so pip install -r requirements.txt still succeeds on Linux/macOS. Without pywin32 or on a non-Windows platform, send() logs a warning and returns False rather than raising, so the existing file/stdout fallback still applies — a finding is never silently dropped.
• Closes repo issue #8.
• New: a Version History table in README.md summarizing every release (v1.0.0-beta through this one) in one place, alongside the full release notes on this Releases page.

Verified against the real Event Log, not just mocks

Wrote and read back real events two ways: directly via the adapter, and through the full gsh-sentinel-deploy.py script with siem_output: windows_eventlog configured, confirming the finding data landed correctly (verified with Get-EventLog/Get-WinEvent).

This surfaced and fixed a real bug in the first draft: event ID 1000 doesn't resolve against win32evtlogutil's default message-table DLL, so Event Viewer showed a "description for Event ID ... cannot be found" wrapper even though the finding data was written correctly underneath it. Switched to event ID 1, which does resolve against the built-in generic message table — verified by direct comparison of IDs 0, 1, and 1000 against the real log. 11 new tests in tests/test_windows_eventlog.py, including one that performs a real write-and-read-back rather than a mock.

Also fixed a stale docstring in adapters/mcp_proxy.py that still said Splunk/Elastic output was "in progress under issues #5 and #7" — those shipped back in v1.3.0.

Known limitations

• Registering a new event source (win32evtlogutil.AddSourceToRegistry) writes to HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application and typically requires an elevated/administrator context for the first write under a given source name. If registration fails, this is caught and logged as a warning, and the finding falls back to local file output rather than being lost.
• No QRadar or generic syslog output yet.

Full Changelog

v1.4.0...v1.5.0