-
Notifications
You must be signed in to change notification settings - Fork 60
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
test(ci): run the atomic suite on macOS against PR builds
ciCI/CD changesCI/CD changesmacosmacOS supportmacOS supportp2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowstestingTest coverage and verificationTest coverage and verificationStatus: Open.feat(windows-etw): recover rename source paths and file creation times
enhancementNew feature or requestNew feature or requestp3Backlog; larger or lower-urgency workBacklog; larger or lower-urgency worksensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#488 In Karib0u/rustinel;feat(windows-eventlog): collect TaskScheduler task lifecycle events
enhancementNew feature or requestNew feature or requestp3Backlog; larger or lower-urgency workBacklog; larger or lower-urgency worksensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#487 In Karib0u/rustinel;test(telemetry): add a capture-based sensor contract suite
epicLarge or cross-cutting workLarge or cross-cutting workp1Important but not required for next cycleImportant but not required for next cyclesensorSensor and telemetry workSensor and telemetry worktestingTest coverage and verificationTest coverage and verificationStatus: Open.design(windows): spike collectors for Sysmon-only categories
designDesign and architectureDesign and architecturep3Backlog; larger or lower-urgency workBacklog; larger or lower-urgency worksensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#485 In Karib0u/rustinel;feat(windows-eventlog): collect System events beyond 7045 and expose Event Log header fields
enhancementNew feature or requestNew feature or requestp3Backlog; larger or lower-urgency workBacklog; larger or lower-urgency worksensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#484 In Karib0u/rustinel;feat(windows-eventlog): add a Defender Operational channel source
enhancementNew feature or requestNew feature or requestp2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowssensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.fix(windows-etw): service: dns-client rules load as active but can never match
bugSomething isn't workingSomething isn't workingengineDetection engine workDetection engine workp1Important but not required for next cycleImportant but not required for next cyclewindowsWindows supportWindows supportStatus: Open.feat(windows-etw): collect WMI-Activity permanent subscription events (5857-5861)
enhancementNew feature or requestNew feature or requestp2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowssensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.feat(windows-etw): populate User, LogonId and ParentUser on process creation
enhancementNew feature or requestNew feature or requestp2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowssensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#480 In Karib0u/rustinel;feat(windows-eventlog): collect additional Security audit event IDs
enhancementNew feature or requestNew feature or requestp1Important but not required for next cycleImportant but not required for next cyclesensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.refactor(tests): adopt shared fixtures in the replay, capture, and alert unit tests
dxDeveloper and operator experienceDeveloper and operator experiencep2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowsrefactorCode refactoringCode refactoringtestingTest coverage and verificationTest coverage and verificationStatus: Open.#476 In Karib0u/rustinel;