Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New Sophos replacement draft following the review of #2617. Includes XG Firewall and Central filters, their correlation rules, fabricated regression fixtures, and a source audit. The historical PR is unchanged.
XG fixes independent field extraction when subtype is absent, endpoint and numeric validation, rejection precedence, authentication/IDP/IP-spoofing matching, and history queries that previously counted unrelated traffic.
Central no longer treats successful malware cleanup as a fresh detection or a blocked peripheral as a compromised device. It adds guarded standard endpoint, severity, timestamp, hash and single-file remediation fields, while preserving vendor fields. Behavioral/PUA/tamper events reach the appropriate rules, and a new device-health rule covers unavailable endpoint protection. Endpoint context is distinguished from attacker identity. Histories require relevant events in the same account and endpoint scope.
Existing impact ratings and history thresholds are preserved. The rapid ZTNA failure rule no longer claims distinct-user password spraying. Unsupported exploitation/technique claims are removed from generic notifications. XG identifier 17913 alone no longer establishes an administrator authentication failure; 17925 remains a literal notification with its meaning unverified.
Validation uses SDK v1.1.31 and its official filter/rule/schema wiki: 159 fabricated raw fixtures, positive/negative checks for all 29 rule predicates, strict Event decoding, Alert-side checks, and nine SDK history-query tests against local mocks. Combined replacement-branch validation passes with no failures or file conflicts.
The extraction harness is an offline model, not the closed EventProcessor. Geolocation and production alert creation are not exercised. Shared grouping support is proposed separately in #2627. Review candidate-history warm-up, renamed-rule reconciliation, outcome/severity consumers, and the audit's unverified legacy variants before any rollout.
Draft for review only, targeting UTMStack v11. No merge, auto-merge or deployment.