feat(mxc): add Windows ETW-to-OCSF audit trail - #3015

Open

araza008 wants to merge 10 commits into

NVIDIA:mainfrom

araza008:akberr/etw-to-ocsf-mapping

Commits on Aug 28, 2026

feat(mxc): ETW->OCSF audit consumer + Windows OCSF JSONL parity (cp6 P1)

jamieknvidia
authored and
araza008
committed
1ebc297
feat(mxc): map remaining Sandboxing ETW events to OCSF

jamieknvidia
authored and
araza008
committed
75f667a
fix(mxc): seed ETW attribution under registry lock + Device tests

jamieknvidia
authored and
araza008
committed
8b9c423
fix(mxc-etw): buffer+replay racing events and harden attribution keys

jamieknvidia
authored and
araza008
committed
9467b46
docs(mxc-etw): note cmd_line is captured raw with no privacy filtering

jamieknvidia
authored and
araza008
committed
5efe3cd
fix(mxc-etw): open ETW trace on caller thread so start_session reports real status

jamieknvidia
authored and
araza008
committed
65bb41f
fix(mxc-etw): guard pending-event replay against PID recycling

jamieknvidia
authored and
araza008
committed
b28465c
fix(mxc-etw): surface unexpected ProcessTrace termination (review #4)

jamieknvidia
authored and
araza008
committed
661270a
feat(mxc-ocsf): add ETW->OCSF audit-trail example kit; fix proxy-configured message

jamieknvidia
authored and
araza008
committed
26fd113
feat(mxc-ocsf): clearer audit report + client-safe run-ocsf-audit.ps1

jamieknvidia
authored and
araza008
committed
3e46489