26 lines
3.5 KiB
Markdown
26 lines
3.5 KiB
Markdown
# Public AI search
|
||
|
||
Presentation-only, Phase 7. The shared FindingReader exposes AI search for every tool, including mixed-tool workspaces. An explicit click opens Google AI Mode with opener/referrer protection. No background lookup, runtime catalog download, automatic AI evaluation or report upload is introduced.
|
||
|
||
## Public evidence boundary
|
||
|
||
`src/profiles/public-search/catalog.json` is a public-identifier snapshot reviewed on 2026-09-06: 67 registry targets, 45 privilege constants, 19 ASR identifiers, 161 Maester IDs and 51 PingCastle IDs. Source URLs accompany the identifiers. It is not a complete or automatically updated vendor catalog. It contains identifiers, not copied vendor descriptions or customer report prose. Noncanonical source notations (query-style value names or ambiguous path separators) are excluded rather than guessed.
|
||
|
||
- Registry matches require the complete canonical key plus value name; only the catalog-owned spelling is exported. Private extensions do not match.
|
||
- Native sections and keys resolve to public security-policy identities. ASR identifiers also require the Defender ASR registry family.
|
||
- Scanner IDs must exist in the tool-specific snapshot. Dynamic instance suffixes are discarded.
|
||
- CIS-CAT, Purple Knight, generic and unresolved rules use locally recognized fixed technical concepts. Only fixed vocabulary is sent, not the input excerpt. Registry lookup is tool-independent.
|
||
- Public product families and exact scope/status enums add context without proving OS/role applicability. Existing exact GPO baseline/audit context remains available.
|
||
- An identified numeric/boolean setting may include a bounded selected benchmark target (integer 0–65535 or boolean). It is labeled as selected, not independently verified as a Microsoft recommendation. Assigned accounts, SID lists, strings, arbitrary JSON and all customer actual values are excluded.
|
||
- Imported descriptions, remediation, locators, identities, URLs, owner information and free-form titles are never passed through. Imported ADML provenance alone does not establish that arbitrary prose is public.
|
||
|
||
The search requests the exact control, purpose, risk, configuration steps, verification and direct primary-source links, in German. Azure registry identity references do not replace the selected SCT benchmark or determine its expected value. AI output never changes findings or grading.
|
||
|
||
## Incomplete evidence and maintenance
|
||
|
||
The link exposes its specificity (`setting`, `rule`, `topic`) and full query in its tooltip. Unresolved cases explicitly request topic discussion rather than an invented rule or recommendation. No promise of complete coverage, vendor-verbatim guidance, anonymity or GDPR compliance is made. Google handles connection/IP and potentially account/cookie data; organizational approval remains necessary.
|
||
|
||
Extend the catalog only from independently reviewed public publisher sources, with attribution and synthetic tests. Never learn public vocabulary automatically from customer reports. Tests cover all tool links, mixed workspaces, private suffixes, complete path matching, numeric bounds, ambiguous fields and catalog integrity. Tests do not query Google or inspect real tenant content.
|
||
|
||
GPO badges use existing section/type and registry family evidence. System Access, Privilege Rights, Registry Values and related sections are display categories, not new outcomes. Registry/Software/System are structural fallbacks; specific product/security families take precedence. Description text does not assign badges.
|