feat(mxc): add Windows ETW-to-OCSF audit trail - #3015

Merged

drew merged 27 commits into

NVIDIA:mainfrom

araza008:akberr/etw-to-ocsf-mapping

Sep 11, 2026

Commits on Sep 9, 2026

feat(mxc): ETW->OCSF audit consumer + Windows OCSF JSONL parity (cp6 P1)

jamieknvidia
authored and
araza008
committed
2015c2b
feat(mxc): map remaining Sandboxing ETW events to OCSF

jamieknvidia
authored and
araza008
committed
337dc8f
fix(mxc): seed ETW attribution under registry lock + Device tests

jamieknvidia
authored and
araza008
committed
2ae8620
fix(mxc-etw): buffer+replay racing events and harden attribution keys

jamieknvidia
authored and
araza008
committed
e28cffe
docs(mxc-etw): note cmd_line is captured raw with no privacy filtering

jamieknvidia
authored and
araza008
committed
416be51
fix(mxc-etw): open ETW trace on caller thread so start_session reports real status

jamieknvidia
authored and
araza008
committed
65647db
fix(mxc-etw): guard pending-event replay against PID recycling

jamieknvidia
authored and
araza008
committed
2251252
fix(mxc-etw): surface unexpected ProcessTrace termination (review #4)

jamieknvidia
authored and
araza008
committed
6a9f3db
feat(mxc-ocsf): add ETW->OCSF audit-trail example kit; fix proxy-configured message

jamieknvidia
authored and
araza008
committed
8bde61c
feat(mxc-ocsf): clearer audit report + client-safe run-ocsf-audit.ps1

jamieknvidia
authored and
araza008
committed
6ca7343
fix(mxc): configure OCSF audit workloads per sandbox
araza008
committed
5cdf440
fix(mxc): omit command arguments from OCSF audit logs
araza008
committed
6f05a7d
feat(etw): enhance ETW session management with distinct naming for concurrent gateways
araza008
committed
64f6325
fix(etw): bound the audit queue during overload
araza008
committed
28281e4
fix(etw): harden sandbox audit attribution
araza008
committed
f98aede
chore(mxc): address rebase follow-ups

drew
authored and
araza008
committed
48b1043
fix(mxc): align OCSF audit example with driver config
araza008
committed
13185f6
fix(etw): redact command-line secrets in DecodedEtwEvent summary
araza008
committed
742fc56
fix(etw): enhance PID resolution and event attribution logic for ETW records
araza008
committed
043415d
fix(ocsf): restrict gateway-local JSONL sink to Windows/MXC path with opt-in configuration
araza008
committed
21b4c4a
address rebase issues
araza008
committed
ef0f3eb

Commits on Sep 10, 2026

fix(mxc): address ETW audit review feedback
drew
committed
0ba0dfe
Merge branch 'main' into akberr/etw-to-ocsf-mapping
araza008
authored
f443a0a

Navigation Menu

Uh oh!

feat(mxc): add Windows ETW-to-OCSF audit trail - #3015

feat(mxc): add Windows ETW-to-OCSF audit trail#3015
drew merged 27 commits into
NVIDIA:mainfrom
araza008:akberr/etw-to-ocsf-mapping

Commits on Sep 9, 2026

feat(mxc): ETW->OCSF audit consumer + Windows OCSF JSONL parity (cp6 P1)

feat(mxc): map remaining Sandboxing ETW events to OCSF

fix(mxc): seed ETW attribution under registry lock + Device tests

fix(mxc-etw): buffer+replay racing events and harden attribution keys

docs(mxc-etw): note cmd_line is captured raw with no privacy filtering

fix(mxc-etw): open ETW trace on caller thread so start_session reports real status

fix(mxc-etw): guard pending-event replay against PID recycling

fix(mxc-etw): surface unexpected ProcessTrace termination (review #4)

feat(mxc-ocsf): add ETW->OCSF audit-trail example kit; fix proxy-configured message

feat(mxc-ocsf): clearer audit report + client-safe run-ocsf-audit.ps1

fix(mxc): configure OCSF audit workloads per sandbox

fix(mxc): omit command arguments from OCSF audit logs

feat(etw): enhance ETW session management with distinct naming for concurrent gateways

fix(etw): bound the audit queue during overload

fix(etw): harden sandbox audit attribution

chore(mxc): address rebase follow-ups

fix(mxc): align OCSF audit example with driver config

fix(etw): redact command-line secrets in DecodedEtwEvent summary

fix(etw): enhance PID resolution and event attribution logic for ETW records

fix(ocsf): restrict gateway-local JSONL sink to Windows/MXC path with opt-in configuration

address rebase issues

Commits on Sep 10, 2026

fix(mxc): address ETW audit review feedback

Merge branch 'main' into akberr/etw-to-ocsf-mapping

Commits on Sep 11, 2026

fix(mxc): resolve main merge conflicts and OCSF integration

fix(mxc): fail closed across ambiguous PID reuse

chore: merge main into MXC audit branch

fix(mxc): bind ETW attribution to process generation