Defender part of 21a6266 on disclosure policy 3.5.0: Defender is a known
Result DB tool, and a formally valid public CVE ID crosses as rule ID and
title. Includes the securityToolId mapping deferred from c056c21 and a
projection regression for Work and Result DB titles.
Adapted pick of fdd46e8: recognition, source extractor, domain model and
tool profile for Defender for IoT alert exports, the common-description
first read with its AGENTS.md rule, and the shared markdown, recognition,
status-outcome and scan-sequence changes.
Also brings forward two fixes Defender needs on this base: the title
fallback in recordTitleFor (from 210bbc0) and the Source Rule ID
exception for ID columns that are the finding title (from 21a6266).
Product version 2.12.0 for the Defender series.
Partial pick of b438f25. CVE, device and site rows expand their details
in place; the Affected Devices table lists name and IP separately.
Unlike the original, the expanded row uses the blue table-row marking
tokens and the drill-down keeps the shared tile tokens. The NVD client
fix is left out with the skipped CVE enrichment.
Adapted pick of fe71246. Adds the vulnerability_finding result type,
missingStatusOutcome for sources whose rows are the finding, and Defender
profile 1.1.0. The Work deviation filter uses the canonical predicate
through isDeviationRecord; Michael's GPO status logic and status cache
stay in front of it.
The constraint migration is renumbered from 022 to 027. The CVE
enrichment commit e048295 is skipped for now.
Partial pick of 5fbbda2. One finding per CVE with an Affected Devices
table and device count; the Finding Reader hides the raw Source
Observations field.
Left out: the Affected Devices label in the Result DB row detail, since
the disclosure policy withholds affectedAsset for every row.
Adapted pick of 7d3ef5f. The profile declares the now mandatory
securityScoring, priorityBasis and timeslotComparison. Client Info adds
Defender as a third tab beside Overview and AI Overview, and a
Defender-only timeslot starts in the Defender view. recordTitleFor only
replaces the title candidate; the Maester and CIS title rules stay.
Left out: the .gitignore entry, --tile-inset, the stored-profile
precedence Michael's fileProfile already has, and the old processing
version assertion.
Binh
Michael
Tronth