feat: DSRegTool phases 2-4 — registry evidence, connectivity, event logs - #16
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds richer Intune evidence UX (GUID name enrichment, dedicated download surface, and a new Event Log surface) while extending the Rust backend to normalize timestamps, parse additional evidence types, and support Windows live Event Log querying.
Changes:
- Introduces new React surfaces/dialogs:
EventLogSurface,DownloadSurface, Fluent UI-basedFindDialog, and a newAccessibilityDialog. - Extends Rust Intune pipeline with GUID registry enrichment, UTC-normalized timestamps, and new EVTX/live WinEvt models and querying.
- Adds evidence collection references/scripts and related docs/roadmap updates; updates parsers/tests to salvage malformed headers.
Reviewed changes
Copilot reviewed 47 out of 84 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
| src/components/intune/EventLogSurface.tsx | New virtualized Windows Event Log UI with filters and correlation links. |
| src/components/intune/DownloadSurface.tsx | New Fluent UI download summary + detail table surface. |
| src/components/intune/DownloadStats.tsx | Formats download timestamps via shared display formatter. |
| src/components/dialogs/FindDialog.tsx | Migrates custom overlay dialog to Fluent UI Dialog. |
| src/components/dialogs/AccessibilityDialog.tsx | Adds an accessibility settings modal (font sizes, palette preview). |
| src-tauri/tests/parser_regression_corpus.rs | Updates regression expectations for parser salvage behavior. |
| src-tauri/src/watcher/tail.rs | Adjusts tailing test write to use writeln!. |
| src-tauri/src/parser/panther.rs | Adds relaxed header parsing and refactors capture parsing. |
| src-tauri/src/parser/dism.rs | Adds relaxed header parsing, refactors header parsing/building. |
| src-tauri/src/parser/cbs.rs | Adds relaxed header parsing, refactors header parsing/building. |
| src-tauri/src/models/log_entry.rs | Adds aggregate parse result structs; derives equality for selection info. |
| src-tauri/src/menu.rs | Adds “Accessibility Settings…” menu action. |
| src-tauri/src/lib.rs | Registers new backend commands (folder aggregate, evidence inspection, system prefs). |
| src-tauri/src/intune/models.rs | Expands Intune diagnostics metadata and adds full Event Log analysis schema. |
| src-tauri/src/intune/mod.rs | Wires new Intune modules (guid registry, EVTX/live querying). |
| src-tauri/src/intune/ime_parser.rs | Adds timestamp_utc normalization and related tests; refactors parsing. |
| src-tauri/src/intune/guid_registry.rs | New GUID→name registry with confidence merging and enrichment helpers + tests. |
| src-tauri/src/intune/eventlog_win32.rs | New Windows WinEvt wrapper for live channel querying and message formatting. |
| src-tauri/src/intune/event_tracker.rs | Prefers UTC timestamps; changes event naming + duration parsing. |
| src-tauri/src/intune/download_stats.rs | Reuses GUID registry regex/helpers; prefers UTC timestamps; adjusts fallback naming. |
| src-tauri/src/dsregcmd/registry.rs | Adds registry snapshot inspection summary models + tests. |
| src-tauri/src/commands/system_preferences.rs | Adds Windows date/time preferences command (registry-backed). |
| src-tauri/src/commands/mod.rs | Exposes new system_preferences command module. |
| src-tauri/Cargo.toml | Adds Rayon, EVTX parser crate, and Windows WinEvt bindings dependency. |
| skills-lock.json | Adds Claude skill lock metadata. |
| scripts/Launch-CMTraceOpen.ps1 | Adds build mode and PATH/cargo validation helpers. |
| references/collection/intune-evidence-profile.json | Adds curated evidence collection profile (logs/registry/event logs/exports/commands). |
| references/collection/README.md | Documents evidence collection scripts and operational behavior. |
| references/collection/Invoke-CmtraceEvidenceBootstrap.ps1 | Adds bootstrapper to stage collector/profile + schedule SYSTEM run. |
| references/collection/Detect-CmtraceEvidenceBootstrap.ps1 | Adds detection script for Remediations throttle/task state. |
| plan-winEvtLiveEventLogsAndLocalTimeDisplay.prompt.md | Adds implementation plan for WinEvt live logs + local time display. |
| package.json | Adds Fluent UI dependency and exe-only build script. |
| cmtraceopen.code-workspace | Adds VS Code workspace file. |
| FEATURE_IMPROVEMENTS.md | Reflows/updates roadmap content and push status. |
| CLAUDE.md | Adds repository guidance for Claude Code usage. |
| .claude/skills/frontend-design/SKILL.md | Adds skill documentation file. |
| .claude/skills/frontend-design/LICENSE.txt | Adds skill license text. |
| .claude/settings.local.json | Adds local Claude settings/permissions. |
| .agents/skills/frontend-design/SKILL.md | Adds agents skill documentation file. |
| .agents/skills/frontend-design/LICENSE.txt | Adds agents skill license text. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ); | ||
| } | ||
|
|
||
| const thStyle: React.CSSProperties = { |
| lineHeight: `${metrics.headerLineHeight}px`, | ||
| }; | ||
|
|
||
| const tdStyle: React.CSSProperties = { |
| lineHeight: `${metrics.rowLineHeight}px`, | ||
| }; | ||
|
|
||
| const monoStyle: React.CSSProperties = { |
Comment on lines
840
to
845
| if let Some(guid) = guid { | ||
| let short = short_guid(guid); | ||
| format!("{label} ({short}...)") | ||
| format!("{label} ({short})") | ||
| } else { | ||
| format!("{label}: {}", msg.chars().take(50).collect::<String>()) | ||
| format!("{label}: {msg}") | ||
| } |
Comment on lines
+336
to
+349
| <div | ||
| onClick={() => handleRowClick(entry)} | ||
| style={{ | ||
| display: "flex", | ||
| alignItems: "center", | ||
| gap: 6, | ||
| padding: "4px 12px", | ||
| cursor: "pointer", | ||
| height: 28, | ||
| borderBottom: isExpanded ? "none" : "1px solid #f0f0f0", | ||
| background: isExpanded ? "#f5f5f5" : "transparent", | ||
| fontSize: 12, | ||
| }} | ||
| > |
Comment on lines
+364
to
+370
| function formatBytes(bytes: number): string { | ||
| if (bytes === 0) return "0 B"; | ||
| const units = ["B", "KB", "MB", "GB"]; | ||
| const i = Math.floor(Math.log(bytes) / Math.log(1024)); | ||
| const val = bytes / Math.pow(1024, i); | ||
| return `${val.toFixed(i > 0 ? 1 : 0)} ${units[Math.min(i, units.length - 1)]}`; | ||
| } |
Comment on lines
+294
to
+306
| let utc_value = if let Some(offset_minutes) = timezone_offset { | ||
| let offset = FixedOffset::east_opt(offset_minutes.checked_mul(60)?)?; | ||
| offset | ||
| .from_local_datetime(&naive) | ||
| .single()? | ||
| .with_timezone(&Utc) | ||
| } else { | ||
| match Local.from_local_datetime(&naive) { | ||
| LocalResult::Single(local_value) => local_value.with_timezone(&Utc), | ||
| LocalResult::Ambiguous(local_value, _) => local_value.with_timezone(&Utc), | ||
| LocalResult::None => return None, | ||
| } | ||
| }; |
| - No Azure PowerShell modules. | ||
| - No external dependencies beyond built-in PowerShell cmdlets and native Windows tools such as `reg.exe`, `wevtutil.exe`, and `dsregcmd.exe`. | ||
|
|
||
| ## Pre-requirments |
Comment on lines
+7
to
+27
| 1. Phase 1: Lock the live-query boundary. Reuse the existing decision point in c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src-tauri\src\commands\intune.rs inside load_event_log_analysis so only the live path changes. Keep parse_bundle_event_logs and downstream correlation logic unchanged. This step blocks all later backend work. | ||
| 2. Phase 2: Add WinEvt dependencies and wrapper module. Update c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src-tauri\Cargo.toml to add the windows crate with the minimum required features for Win32 event logging and foundation error handling. Create a focused Windows-only wrapper module, preferably c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src-tauri\src\intune\eventlog_win32.rs, to own UTF-16 conversion, Win32 error mapping, and RAII handle cleanup via EvtClose. This depends on step 1. | ||
| 3. Phase 3: Implement live channel querying through WinEvt. In the new wrapper module, implement local-machine querying for the existing curated channel list using EvtQuery and EvtNext. Keep the current channel list in c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src-tauri\src\intune\evtx_parser.rs unless there is a deliberate product change. Query each channel independently so access failures or missing channels produce partial results instead of aborting the full live analysis. This depends on step 2. | ||
| 4. Phase 4: Render event records into the existing EventLogEntry model. Prefer extracting stable system properties through WinEvt rather than regex over shell output. Use EvtCreateRenderContext plus EvtRender for structured system fields such as provider, event id, level, channel, computer, activity id, and timestamp. For message text, use EvtOpenPublisherMetadata and EvtFormatMessage as a best-effort path; if message formatting fails because publisher metadata is unavailable or access is restricted, fall back to a synthesized message built from event data or XML so entries still surface in the UI. This depends on step 3. | ||
| 5. Phase 5: Normalize timestamps and preserve current correlation behavior. Convert WinEvt timestamps to the same UTC ISO-8601 shape currently expected by EventLogEntry and the correlation code. Keep ordering, severity mapping, and event id assignment stable so c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src-tauri\src\commands\intune.rs and the existing event-log correlation helpers continue to work without schema changes. This depends on step 4. | ||
| 6. Phase 6: Make frontend display use the viewer's system timezone as the source of truth. Update the display path centered on c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src\lib\date-time-format.ts so UI formatting prefers timezone-aware values or UTC-normalized instants instead of reparsing naive display strings as local dates. The target behavior is that rendered dates and times in the Intune workspace, event-log views, and timeline surfaces show in the current user's system timezone. | ||
| 7. Phase 7: Normalize timezone handling for Intune and other timeline inputs. Review c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src-tauri\src\intune\timeline.rs and any event serialization paths that still emit naive timestamps, then standardize them to emit timezone-safe values that the frontend can consistently convert into the viewer's local timezone. This depends on steps 5 and 6. | ||
| 8. Phase 8: Surface live event-log progress and results in the UI. Keep the existing event-log surface in c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src\components\intune\EventLogSurface.tsx and store plumbing in c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src\stores\intune-store.ts, but update c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src\components\layout\FileSidebar.tsx to show live event-log status, queried channel count, and signal counts alongside the IME file list. Also confirm c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src\components\intune\NewIntuneWorkspace.tsx exposes clearer status when live event-log parsing is in progress or when zero accessible entries are returned. This can begin in parallel with step 6 once the returned metadata shape is confirmed. | ||
| 9. Phase 9: Harden error handling and diagnostics. Distinguish between no entries, inaccessible channel, missing channel, and query failure in backend logs and progress messages. Also distinguish between source timestamps that were timezone-aware and source timestamps that were only local/naive so the display layer does not silently misrepresent time. This depends on steps 6 through 8. | ||
| 10. Phase 10: Add validation and regression coverage. Add or update Rust tests around severity mapping, timestamp normalization, and partial-channel failure handling. Add frontend validation around local-time rendering in c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src\lib\date-time-format.ts and verify key surfaces such as the Intune timeline and Event Log Evidence use the end user's system timezone consistently. This depends on steps 6 through 9. | ||
|
|
||
| **Relevant files** | ||
|
|
||
| - c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src-tauri\Cargo.toml — add the windows crate and required Win32 feature flags for event log access and error handling. | ||
| - c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src-tauri\src\commands\intune.rs — keep load_event_log_analysis as the stable boundary between bundle and live event-log modes. | ||
| - c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src-tauri\src\intune\evtx_parser.rs — retain bundle parsing and shared EventLogAnalysis assembly; replace only the live parser internals. | ||
| - c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src-tauri\src\intune\models.rs — preserve EventLogEntry and EventLogAnalysis shapes so frontend/state code does not need schema churn. | ||
| - c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src\components\layout\Toolbar.tsx — keep the existing includeLiveEventLogs trigger for the known live Intune source. | ||
| - c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src\components\intune\NewIntuneWorkspace.tsx — keep the live-analysis entry point and tighten user-facing status around event-log querying outcomes. | ||
| - c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src\components\intune\EventLogSurface.tsx — reuse the existing event-log display surface without changing its contract. | ||
| - c:\Users\AdamGell\Documents\GitHub\cmtraceopen\src\lib\date-time-format.ts — make frontend display formatting use timezone-aware or UTC-normalized values and render them in the viewer's local timezone. |
Comment on lines
+214
to
+228
| fn extract_provider_name(xml: &str) -> Option<String> { | ||
| PROVIDER_RE | ||
| .captures(xml) | ||
| .and_then(|captures| captures.get(1).map(|value| value.as_str().to_string())) | ||
| } | ||
|
|
||
| fn sanitize_channel_name(channel: &str) -> String { | ||
| channel | ||
| .chars() | ||
| .map(|value| match value { | ||
| '/' | '\\' | ':' | ' ' => '-', | ||
| other => other, | ||
| }) | ||
| .collect() | ||
| } |
adamgell
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
- Introduced AccessibilityDialog component for adjusting log list and details text sizes. - Added functionality to increase, decrease, and reset log text sizes via menu actions. - Implemented log severity color palette options for improved accessibility. - Updated UI store to manage new accessibility preferences and font size settings. - Enhanced InfoPane and LogListView components to utilize dynamic font sizes. - Integrated keyboard shortcuts for quick adjustments to log text sizes.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
…cript with path management functions
- Introduced EvidenceBundleArtifactCounts for tracking artifact statuses. - Created EvidenceBundleMetadata to encapsulate metadata related to evidence bundles. - Defined EvidenceArtifactStatus and EvidenceArtifactIntakeKind enums for categorizing evidence artifacts. - Added EvidenceArtifactIntake interface to manage intake details and diagnostics. - Implemented RegistrySnapshot and EvidenceEventLogExport previews for better evidence representation. - Developed EvidenceArtifactRecord and ExpectedEvidenceRecord interfaces for detailed artifact records. - Established EvidenceBundleDetails to aggregate metadata, content, and artifacts for a complete evidence bundle overview.
- Introduced a new Intune evidence profile JSON file to collect various logs, registry keys, event logs, exports, and commands related to Intune and Autopilot diagnostics. - Implemented a custom React hook `useIntuneAnalysisProgress` to listen for Intune analysis progress events and update the state in the Intune store accordingly.
- Introduced a new fluent theme configuration in `fluent-theme.ts` with comprehensive styling options including colors, typography, and shadows. - Added type definitions for event logging in `event-log.ts`, including severity levels, channel types, and entry structures to enhance event management capabilities.
…download_stats.rs
…, and UI improvements - Add GuidRegistry for enriching event/download names with resolved app names - Add DownloadSurface component replacing inline DownloadStats - Improve EventTimeline with dynamic font sizing and accessibility metrics - Enhance NewIntuneWorkspace layout with inherited font sizing - Improve DsregcmdWorkspace with expanded diagnostics UI - Update FileSidebar with improved navigation - Streamline download_stats and event_tracker regex initialization - Clean up unused menu items and app-menu hook entries Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…ing, and event logs Phase 2 — Expanded Evidence Collection: - Add 6 new registry exports (OS version, proxy, enrollment, CDJ) - Add registry parsers for OS version, proxy settings, and enrollment entries - Add 6 diagnostic rules (os-build, proxy, enrollment) - Add OS Version, Proxy Configuration, and Enrollment Status fact groups Phase 3 — Active Diagnostics: - Add ureq dependency for synchronous HTTPS connectivity testing - Add connectivity module with endpoint reachability tests (4 endpoints) and SCP query via nltest/PowerShell - Persist active diagnostics to evidence bundle as JSON - Add 7 diagnostic rules (endpoint unreachable, SCP, high latency) - Add Endpoint Connectivity and SCP Configuration fact groups Phase 4 — Deep Diagnostics: - Expose evtx_parser functions as pub(crate) for cross-module reuse - Add 3 new EventLogChannel variants (DPAPI, Kerberos, System) - Add event_logs module collecting 5 dsregcmd-relevant channels - Add 3 diagnostic rules (time skew, DPAPI failure, AAD errors) - Add DsregcmdEventLogSurface component with virtual scrolling - Add Analysis/Event Logs tab strip to DsregcmdWorkspace - Add event log filter state to dsregcmd store Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…path extraction - Remove unused `hasBundleContext` and `hasRegistryPolicyEvidence` variables in DsregcmdWorkspace.tsx (TS6133) - Fix `setup_file_name()` in guid_registry.rs to handle Windows-style backslash paths on Linux CI by splitting on both `\` and `/` instead of relying on `std::path::Path` which is platform-dependent - Remove unused `std::path::Path` import Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- cfg-gate Windows-only imports in connectivity.rs, commands/dsregcmd.rs, and evtx_parser.rs (Lazy, Regex, LiveQuery types) - Fix setup_file_name char comparison per clippy::manual_char_comparison - Simplify enrich_event_name with map() instead of if-let - Remove unneeded return statements in evtx_parser.rs and system_preferences.rs - Add #[expect] annotations for intentional too_many_arguments and type_complexity in ime_parser.rs and commands/intune.rs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…orm build The type is used in `build_event_log_analysis()` which is not cfg-gated. Only EventLogLiveQueryChannelResult and EventLogLiveQueryStatus are Windows-only. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
adamgell
force-pushed
the
intune-workspace-improvements
branch
from
March 17, 2026 00:25
c7383b7 to
b46e967
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Details
connectivity.rs,event_logs.rs,DsregcmdEventLogSurface.tsx#[cfg(target_os = "windows")]gated with non-Windows stubsureq(lightweight sync HTTP) added as Windows-only dependencypub(crate)visibility onbuild_event_log_analysis()andparse_live_event_record()for cross-module reuseTest plan
cargo check— compiles on all platformscargo test --lib— all 189 tests pass (34 dsregcmd, 4 new registry parser tests)npx tsc --noEmit— no new TypeScript errors🤖 Generated with Claude Code