docs(accessanalyzer-26.1): unlist the v12 to AA26 migration KB (AA-773) - #1516
Closed
eanandappa99 wants to merge 11 commits into
Closed
docs(accessanalyzer-26.1): unlist the v12 to AA26 migration KB (AA-773)#1516eanandappa99 wants to merge 11 commits into
eanandappa99 wants to merge 11 commits into
Conversation
Clarified the conditions under which Access Analyzer ends a run that is stuck in Pending or Running states.
…r-runtime Update explanation of Access Analyzer run termination
Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.202 to 1.0.214. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@e5ad3c7...fa2b266) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.210 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…opics/claude-code-action-1.0.210 build(deps): bump anthropics/claude-code-action from 1.0.202 to 1.0.214
Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.16 to 3.3.18. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.16...3.3.18) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…3.3.18 build(deps): bump nanoid from 3.3.16 to 3.3.18
* docs(threatprevention/8.1): scaffold 8.1 docs from 8.0
Copy the 8.0 documentation set and images to 8.1 as a baseline for the
8.1.0 release, with internal links and image paths rewritten to 8.1.
Content edits follow in later commits.
Not registered in src/config/products.js yet, so 8.1 stays off the site
until release.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs(threatprevention/8.1): document the 8.1 changes
Add the topics for what changed in 8.1 and update the existing ones the
changes affect.
New topics:
- Log Files and Logging Configuration - the managed component logs, the
timestamped archive names, and editing .log.config to enable
feature-level logging.
- AD Monitor Logging Configuration - EventTrace.log, the Logging.ini
settings, the DebugFilter and EventFilter values, and the validation
messages.
- LSASS Hook Scan Tool - LsassHookScan.exe, for identifying third-party
hooks in LSASS.
- Policy Verifier Tool - SIPolicyVerifier.exe, for finding policy
references to objects that no longer exist.
- Trusted Domains Blacklist Window - excluding unreachable trusted
domains from account resolution.
Updated topics:
- Process Guardian Monitor and Protect - folder and SHA-256 filtering,
the options for an unresolved folder or an unavailable checksum, the
Kernel Stack attribute, and Never Block Windows System Process
(PID = 4).
- Log Level Configuration Window - Get Agent Log now downloads a ZIP
archive of the logs and ADMonitor_logs folders. Corrects the rollover
description and notes that a log level now survives a restart.
- Upgrade Procedure - the 8.1 upgrade paths, and a section on the
logging changes to plan for, including the Logging.ini settings that
need to be edited by hand.
- Installer file names, and cross-references from the related topics.
- Two KB articles on enabling debug logging, noting the 8.1
.log.config format.
8.1 is not registered in src/config/products.js, so none of this is
published yet. Screenshots still show the 8.0 UI.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(vale): auto-fix style issues (Vale + Dale)
* docs(threatprevention/8.1): correct the 8.1 topics against the shipped build
Verified the new topics against a Threat Prevention 8.1.0.978 install and
its Administration Console, and corrected what the written source got
wrong. Adds real 8.1 screenshots for the affected topics.
Process Guardian:
- The unresolved-folder option and the PID 4 option are on the
Requesting Processes tab, not Target Processes. Removes that claim and
the cross-reference it added to the Target Processes section.
- Restores "Monitor if Checksum Unavailable". It exists as a per-entry
grid column, not a single option, alongside "Use Checksum" and
"SHA-256".
- There's no separate folder field: a name or a full image path goes in
the same Process (name or path) column, and both are case insensitive.
Rewrites the section accordingly and documents "Use Checksum".
- Documents "Ignore Windows System Process (PID = 4)", the monitoring
policy's counterpart to "Never Block Windows System Process (PID = 4)".
- The filters are grids with Add, Remove, and Lookup buttons, not text
boxes.
Trusted Domains Blacklist:
- The menu path is confirmed as Configuration > Trusted Domains
Blacklist.
- Rewrites the procedure for the real dialog: a grid of Source Domain
(NetBIOS name, or * for every Agent) and Excluded Domains (DNS names
separated by semicolons), with Add Row, Add from Agent..., and Delete.
- Documents the Select Trusted Domains dialog, including the Agent (DC)
list and Connect.
AD Monitor logging:
- Logging.ini and ADMonitor_logs live in the Agent installation folder,
not an AD Monitor folder. Adds the real paths.
- EventTrace.log does take the context prefix; a TermEventTrace file
exists on a domain controller. Corrects the claim that it never does.
- PagedSearch isn't a valid DebugFilter value in the shipped file.
- Adds DotNetLoaderTrace.log, the rolled-over file naming, and a warning
that EventTrace.log is always buffered, so an LSASS crash loses up to
one flush interval.
Also: plsahlp.sys ships with the Agent, not the Enterprise Manager, and
LsassHookScan.exe isn't installed by either, so the LSASS hook scan
topic now points at Support for the tool. Adds SIAgentUpdater to the
managed log and configuration file lists.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs(kb/threatprevention): fix Vale/Dale/Derek findings and modernize article structure
Corrects a product-name misattribution ("Netwrix Threat Manager" -> "Netwrix
Threat Prevention", confirmed against the source Salesforce KB article),
fixes frontmatter (products ID, missing kb tag), converts the new 8.1 :::note
to KB blockquote format, and restructures both articles from legacy
Summary/Issue/Module/Salesforce Article ID sections to Overview/Instructions.
Also fixes Vale heading-case and contraction warnings, Dale passive-voice and
wordiness findings, bolds action-target UI elements, drops an empty code
block with no source content, and rewrites a filename-only image alt text.
* docs(kb/threatprevention): expand abrupt options intro sentence
Explains what each option involves (direct file edit vs. console-based log
level change) instead of just stating there are two, in both articles.
* fix(vale): auto-fix style issues (Vale + Dale)
* fix(threatprevention): register 8.1 version in products.js
Adds 8.1 to threatprevention.versions, promotes it to isLatest, and
sets defaultVersion to 8.1. Without this, docs/threatprevention/8.1/
and sidebars/threatprevention/8.1.js are never picked up by the
Docusoraus plugin generation, navbar, or KB copy script.
* fix(threatprevention): keep 8.0 as latest/default until 8.1 is confirmed ready
8.1 is now registered and reachable via the version switcher, but stays
isLatest: false so 8.0 remains the default landing version. Screenshots
still show the 8.0 UI and a few facts (Trusted Domains Blacklist menu
path, .log.config vs logconfig.xml naming, tab placement for the
unresolved-folder/unavailable-checksum options) came from a written
source rather than a verified build. Promote 8.1 to latest once those
are confirmed.
* revert(threatprevention): keep 8.1 unregistered in products.js
The PR intentionally leaves 8.1 out of products.js until release day —
per the PR description, this keeps the 296 new pages, screenshots (still
showing 8.0 UI), and a few unverified facts (Trusted Domains Blacklist
menu path, .log.config vs logconfig.xml naming, tab placement for the
unresolved-folder/unavailable-checksum options) completely unreachable
rather than just non-default. Registering 8.1 (even with isLatest:
false) would make it publicly browsable and indexed, which is more
exposure than intended. Registration remains a one-line change to make
when the release ships.
* fix(vale): auto-fix style issues (Vale + Dale)
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: hilram7 <212961752+hilram7@users.noreply.github.com>
Bumps [@swc/html](https://github.com/swc-project/swc/tree/HEAD/packages/html) from 1.15.43 to 1.16.2. - [Release notes](https://github.com/swc-project/swc/releases) - [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md) - [Commits](https://github.com/swc-project/swc/commits/v1.16.2/packages/html) --- updated-dependencies: - dependency-name: "@swc/html" dependency-version: 1.16.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…l-1.16.2 build(deps): bump @swc/html from 1.15.43 to 1.16.2
* Add permission specifics and confirmation step to PPE config KB article Specify Read/Write and Deny permission guidance, and add a save-retry step to confirm the fix. Generated with AI Co-Authored-By: Claude Code <ai@netwrix.com> * fix(kb/passwordpolicyenforcer): apply style and content fixes to config access-denied article Reclassify title as Resolution (Error), sync frontmatter/H1/sidebar_label, expand keywords, fix product-name usage, and resolve formatting issues (bold action targets, list punctuation, note-callout indentation). Generated with AI Co-Authored-By: Claude Code <ai@netwrix.com> * Fix passive voice and error message formatting in PPE KB article Dale review flagged passive voice; error message now uses inline code formatting instead of curly quotes. Also bolds UI element names for consistency. Generated with AI Co-Authored-By: Claude Code <ai@netwrix.com> --------- Co-authored-by: Claude Code <ai@netwrix.com> Co-authored-by: hilram7 <212961752+hilram7@users.noreply.github.com>
The eight migration KB pages were written against an AA26 data model that changed before 26.1 shipped. An audit of all 352 factual claims in the section against access-analyzer v1.1.3 (98f4efb52) confirmed 103 are wrong, 24 of them badly enough that following the page fails outright. Three product changes landed after the pages were written: - Source Groups were removed (core-api migration 20260828010003, AA-470). Grouping is now labels on sources. The section says "source group" 78 times across 7 of the 8 pages. - Scanners were renamed to Agents (AA-663). routes.ts now has AGENTS: "/agents" with /scanners kept only as a redirect. - Scans became first-class objects, so schedules and agent labels moved off the group and onto the scan. Some errors are silent rather than obvious. The schedule pages tell the reader that AA26 stores cron in UTC and to set a Time Zone field, but the wizard has no such field and records the browser's zone automatically (buildScanPayload.ts:91). A migration engineer translating a 2am legacy trigger gets the wrong hour with no error. Marking the pages unlisted rather than deleting them: it removes them from the sidebar, search, and sitemap so nobody new follows them, while keeping the URLs alive for anyone holding a direct link. Each page also carries a revision warning for that case. No other page in the repo links into this section, so nothing breaks. Generated with AI Co-Authored-By: Claude Code <ai@netwrix.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unlists the eight pages under
docs/kb/accessanalyzer-26.1/migration/and adds a revision warning to each. Ref AA-773.Why
The section was written against an AA26 data model that changed before 26.1 shipped. I audited every factual claim in all eight pages against
access-analyzerv1.1.3 (98f4efb52, the current stable tag): 352 claims extracted, 103 confirmed wrong, 24 of those bad enough that following the page fails outright. Findings were validated by two independent passes and then put through an adversarial pass that killed 122 of 225 candidates, so what remains survived a hostile second look.Three product changes landed after the pages were written:
core-api/db/migrations/20260828010003_drop_source_groups.up.sql(AA-470),docs/GLOSSARY.md:119webapp/src/shared/config/routes.ts:65-68(AGENTS: "/agents",/scannerskept as a redirect), AA-663features/manage-scans/ui/CreateScanWizard/The section says "source group" 78 times across 7 of the 8 pages, so this is structural, not a find-and-replace.
The errors that argue for unlisting rather than leaving it up
Most are visibly wrong and a reader would stall. These are the ones that fail silently and produce a wrong configuration with no error:
buildScanPayload.ts:91). Translating a 2am legacy trigger lands on the wrong hour.AdvancedScheduleBuilder.tsx:24-27). The cron translation table is a reference the UI will not accept.Why unlisted and not deleted
unlisted: truedrops the pages from the sidebar, search, and sitemap so nobody new finds them, while keeping the URLs alive for anyone holding a direct link (the section was shared in Slack, so those links exist). Each page also carries a:::warningbanner for that case.draft: truewould 404 those readers and break the build, since_category_.jsonlinks toindex.No other page in the repo links into this section, so nothing breaks.
Note for whoever picks up the rewrite
AA-773 currently concludes this needs "a terminology pass, not a full rewrite." The audit does not support that. Renaming the nouns would leave the timezone, cron-entry, and one-scan-per-source errors in place.
migrate-target-serversandmigrate-schedulesneed restructuring.Two pages were nearly clean if you want to restore them separately:
audit-data-strategy(1 cosmetic finding of 24 claims) andmigrate-credentials(5 findings, both blockers being the same source-group prerequisite sentence).Full findings with per-claim evidence and proposed edits are attached to AA-773.
Generated with AI
Co-Authored-By: Claude Code ai@netwrix.com
Closes #1517