Restored previous versions for files that were corrupted by the automated PSScriptAnalyzer fixes. Please review and reapply safe fixes manually.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Add -STA parameter when launching endpoint-signals collector for clipboard access
- Move launch-watchers lock files from ProgramData to TEMP to avoid permission issues
- This fixes DLP endpoint collector startup in RDP sessions
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Replace default config paths from C:\ProgramData\ActivityWatch to C:\ProgramData\AWatch-rus
in dlp-endpoint-signals-collector.ps1 and email-outbound-collector.ps1
- Add isLikelyClientHost() function to reject IP/localhost as valid hostname
for bucket selection in aw-ru-patch.js
- Add docs/dlp-reliability-roadmap.md and docs/powershell-analysis.md
- Update README.md with links to new documentation
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Print document naming:
- Add Test-IsGenericDocumentName() to detect placeholder names like
'Печать документа', 'Print Document', 'Remote Downlevel Document', etc.
- Add Test-NeedsBetterDocumentName() that combines mojibake, generic and
numeric-only checks into a single gate for PrintService event log fallback
- Replace Test-LooksLikeMojibakeQuestionMarks with Test-NeedsBetterDocumentName
in Win32_PrintJob polling and Get-PrintServiceDocumentFallback
Email collector deployment integration:
- Ansible: add email-outbound-collector.ps1 to deploy_aw_windows.yml file list
- Ansible: add aw_windows_email_collector_enabled/mode vars
- InnoSetup: add email-outbound-collector.ps1 to [Files] section
- Common module: add EmailCollectorScript to Copy-ActivityWatchCollectorAssets,
New-ActivityWatchDeploymentConfig, launch-watchers script
- Deploy scripts: pass EmailCollectorScript through pipeline
- Deployment configs: add emailCollectorScript path
- Sync all changes to install-kit copy
Co-Authored-By: Fashion Lisa <igor04091968@gmail.com>
Two collection modes:
- outlook: polls Sent Items via COM, extracts metadata (subject hash,
recipients hash, attachment names, body length)
- smtp: monitors SMTP connections (25/587/465/2525) via Get-NetTCPConnection
DLP policy rules: endpoint.email[] with regex matching on subject,
recipients, sender, attachments, externalOnly flag.
Enforcement: action=block moves mail to Drafts (Outlook mode).
Privacy: subject/recipients stored as SHA256, body never read.
Co-Authored-By: Fashion Lisa <igor04091968@gmail.com>
Phase 2.5: when DLP policy rule has action="block", the collector
now actively prevents the action instead of just logging:
- USB: Set-Disk -IsReadOnly via Get-Partition/Get-Disk pipeline
- Print: Remove-CimInstance Win32_PrintJob for matching jobs
- Clipboard: Set-Clipboard -Value $null to clear sensitive content
Each enforcement adds enforced=true/false to incident telemetry.
Windows balloon notification shown to user on every block action.
Backward-compatible: existing action="alert" rules unchanged.
Co-Authored-By: Fashion Lisa <igor04091968@gmail.com>
igor04091968