Compliance Engine stage 1 for BSI Grundschutz++ (Kernel requirements only):
- Pinned snapshots of the BSI Kernel catalog and the official ISO 27001
Annex A -> Grundschutz++ mapping with source URL, SHA-256 and CC BY-SA
attribution, generated by server/compliance/update-bsi-assets.mjs.
- Requirements are derived from accepted ISO controls, never stored as
decisions; missing mapping targets are reported.
- Client Info Compliance tab: BSI Grundschutz++ tile and Results window.
- Finding Reader: collapsed BSI requirements section grouped by ISO control.
- Work: BSI requirement and BSI practice facets.
- Data Hub: BSI catalog tile with Update from BSI and Use bundled catalog;
new outbound target documented in SECURITY.md.
The Compliance row moves from the Client Info Overview into its own
Compliance tab (before AI Overview). The framework tile row and its
Results button stay unchanged so later frameworks add a tile.
The tab heading carries a Last mapping button. Its window lists up to 50
mapping batches and single finding mappings of all clients, because
mappings are global per rule. Each entry shows its trigger (Automatic,
Manual, Single finding), where it came from relative to the shown
timeslot (This timeslot, Other timeslot, Other client, Unknown), status
and content-free counts. Mapping runs now record their trigger, and
single mappings their origin as SHA-256 tokens only, since runs are
exported with every client. The tab refreshes while a mapping runs and
shows the last overview at once when returning to it.
Also: history table keeps the 14px table role in every column, and the
flaky sheet-selection-cost test uses 300 instead of 2,537 sheets.
Core changes (released Presentation, Governance, Platform, Core Tests):
DashboardPanel Compliance tab, AGENTS.md decisions, product version
2.20.0 -> 2.21.0, sheet-selection-cost test.
The Compliance Engine maps newly uploaded scans and GPO evaluations to
ISO controls while the new Data Hub switch "Map new scans automatically"
is on (default off). An engine-side watcher reads only through
ComplianceReadPort: active scan runs and, for GPOs, the deviation rows of
each timeslot as filtered Result DB pages. It starts the existing ISO
batch per new scan run or per timeslot with new GPO rows; already mapped
rules are reused, so only new rules reach the model. Existing data forms
the baseline and is not mapped retroactively.
The switch lives in the engine's own settings file, not a Core table.
Switching the Compliance Engine off in the Engines popup also switches
automatic mapping off server-wide.
Core changes (released Platform, Core Tests, Presentation, Governance):
PUT /reference-data/iso-corpus/auto-mapping route, setIsoAutoMapping API
client method, subscribeEnginePreferences export, AGENTS.md decision and
product version 2.19.1 -> 2.20.0.
- Move AI overview and privacy-safe JSON export into Compliance Engine
- Add ISO control and theme facets to Work, including GPO settings
- Enrich ISO queries with baseline context, Windows code meanings and technical explanations
- Count GPO settings once and preserve editable decisions across mapping runs
- Fix GPO mapping version conflicts and backup domain identity resolution
- Add regression coverage and update architecture and reimport documentation
Extract the regulatory ISO control mapping from the Core into the
Compliance Engine (src/compliance, server/compliance, tests/compliance).
- Fix ISO mapping after the Result DB privacy merge: look up a finding's
Result DB row scoped to its project instead of comparing a stripped
project id.
- Engine reads the Core only through ComplianceReadPort and writes only
its own ComplianceStore (existing migration 026 tables, own pool);
engine writes no longer advance the Core revision.
- Engines popup gains Compliance Engine; switched off it shows nothing
and sends no requests. Permanent on/off invariance test.
- Map ISO controls opens a window like Accepted Risk; accepted controls
appear as an ISO controls section in the Finding Reader and as tiles
below the Context heatmap in Client Info (drill-down into Work).
- First two proposals of a finished mapping are accepted automatically
(provisional user decision); existing decisions are never overridden.
- Activity log names Compliance Engine work, keeps running mappings,
batches and corpus embedding until the backend ends them, and no
longer logs repeated status checks.
- Data Flow diagram shows the Compliance Engine.
- Core guard treats a bare engine folder name as engine path; new guard
area test.
Adapted pick of fdd46e8: recognition, source extractor, domain model and
tool profile for Defender for IoT alert exports, the common-description
first read with its AGENTS.md rule, and the shared markdown, recognition,
status-outcome and scan-sequence changes.
Also brings forward two fixes Defender needs on this base: the title
fallback in recordTitleFor (from 210bbc0) and the Source Rule ID
exception for ID columns that are the finding title (from 21a6266).
Product version 2.12.0 for the Defender series.
Die Client-Info-Aktion Management Report erzeugt den faktenbasierten
HTML-Bericht aus der gemeinsamen Reportprojektion: erfasste DC,
bewertete und abweichende Ergebnisse, Heatmap des Abweichungsanteils
und Pass-/Abweichungsbalken je Security Domain. Kein Mixed-Method-Score,
keine Scannerlisten, keine LLM-, Internet- oder Risikoableitung.
Report B bleibt technisch. Keine Projektions-, API- oder Persistenz-
aenderung.
Verifiziert: Vollsuite 1645 bestanden, 14 uebersprungen; 7 bestehende
Fehler in 6 Dateien identisch auf dem vorherigen Commit. Beide
Produktionsbuilds bestanden. Visuelle Browserabnahme offen.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Result DB is checked and stored on creation (migration 024, assessor_result_db_rows)
with a content-free per-row trace, per-client identity guard and Open original in Work
- Disclosure policy 3.4.0: review state no longer revealed via withheld-field trace,
per-finding scanner scores withheld, CIS numbers keep all seven levels
- Less over-redaction: "Limited" is no legal form, attached versions (Tls1.2, v1.0),
Windows 95, 2012-R2, step/option/page references, documented Microsoft GUIDs and
documented vendor values in the recommendation field stay
- Maester first read shows the native result statement verbatim
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reference recognition (Phase 13D, 2.8.0-2.8.5):
- ATT&CK 19.2 / D3FEND 1.6.0 catalogs, versioned recognizer and
append-only reference runs (migration 023), catalog references in the
reader, Data Hub status and reprocessing, MITRE online update.
Scanner report and Work (2.8.6):
- Resolve scope-named Purple Knight runs to their profile via runNames.
- Maester "Remediation action" section as next step; PowerShell scripts
as command blocks with display-only line layout.
- Purple Knight likelihood without the appended references section.
- CIS section titles from the run's own report in the CIS Category
filter, Work headings and badge tooltips.
- Keep all record metadata when GPO results rebuild All Records
(withRebuiltLayout) with a guard test for future metadata.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Binh
Michael
Tronth