Repository navigation
Conversation
…ations - Introduced Connect-DefenderServices.ps1 for establishing Defender service connections and verifying tenant scope. - Added DefenderRunLog.ps1 for structured logging of Defender deployments, including JSON output and sensitive data protection. - Implemented Invoke-WithTransientRetry.ps1 to handle transient errors during API operations with retry logic. - Created Setup-DefenderForBusiness.ps1, Setup-DefenderForCloudApps.ps1, Setup-DefenderPreflight.ps1, Setup-MdeAdvanced.ps1, Setup-MdoEopBaseline.ps1 for various Defender setup operations with logging. - Developed Write-DefenderHtmlReport.ps1 to generate HTML reports from logging entries, enhancing visibility into deployment outcomes.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
There are confirmed noninteractive-mode correctness and evidence redaction gaps (plus retry/logging contract mismatches) that should be addressed before approval.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
This PR introduces a new Defender product scaffold alongside existing Purview automation, aiming to align cross-product engineering contracts (preflight/readiness checks, structured evidence logging/reporting, retry boundaries) and to extend repository verification to validate the Defender scaffold.
Changes:
- Add a new
Products/Defender/product boundary with an orchestrator, config contract, run-log (JSON) + HTML evidence reporting, connection helpers, and placeholder setup modules. - Extend
scripts/verify.ps1to validate the Defender scaffold contract and exercise a logger/report redaction fixture. - Update
CHANGELOG.md(Unreleased) and ignore.impeccable/in.gitignore.
File summaries
| File | Description |
|---|---|
| scripts/verify.ps1 | Adds Defender scaffold contract checks + a JSON/HTML logging fixture assertion. |
| Products/Defender/Deploy-DefenderBestPractice.ps1 | New Defender orchestrator: config contract validation, safety gates, module runner, report generation. |
| Products/Defender/Config/DefenderConfig.psd1 | Defines Defender config schema (BP items, license capability metadata, API readiness, report paths). |
| Products/Defender/Modules/Connect-DefenderServices.ps1 | Graph connection + tenant identity verification + Graph request wrapper. |
| Products/Defender/Modules/DefenderRunLog.ps1 | New structured run log with redaction and JSON persistence. |
| Products/Defender/Modules/Invoke-WithTransientRetry.ps1 | New retry boundary for transient API/cmdlet operations. |
| Products/Defender/Modules/Write-DefenderHtmlReport.ps1 | New HTML evidence report renderer with encoding + identity masking. |
| Products/Defender/Modules/Setup-DefenderPreflight.ps1 | Read-only preflight (API readiness + license inventory + guided-only dispositions). |
| Products/Defender/Modules/Setup-MdoEopBaseline.ps1 | Placeholder module emitting run-log entry (no enforcement yet). |
| Products/Defender/Modules/Setup-DefenderForBusiness.ps1 | Placeholder module emitting run-log entry (no enforcement yet). |
| Products/Defender/Modules/Setup-MdeAdvanced.ps1 | Placeholder module emitting run-log entry (no enforcement yet). |
| Products/Defender/Modules/Setup-DefenderForCloudApps.ps1 | Placeholder module emitting run-log entry (no enforcement yet). |
| CHANGELOG.md | Adds Unreleased notes documenting the Defender foundation + redaction/safety stance. |
| .gitignore | Ignores .impeccable/. |
Review details
- Files reviewed: 13/14 changed files
- Comments generated: 5
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
Comment on lines
+39
to
+41
| else { | ||
| Connect-MgGraph -Scopes $Scopes -NoWelcome -ErrorAction Stop | ||
| } |
Comment on lines
+88
to
+90
| Add-DefenderRunLogEntry -Module 'Setup-DefenderPreflight' ` | ||
| -Action 'ApiCapability' -Status 'Succeeded' ` | ||
| -Detail "Graph context available. AuthenticationType=$($graphContext.AuthType); Account=$($graphContext.Account)." |
Comment on lines
+111
to
+113
| if (-not $Context) { | ||
| throw 'F6 requires orchestrator context for Graph authentication.' | ||
| } |
| NonInteractive = $NonInteractive | ||
| ConnectGraph = $true | ||
| } | ||
| $connection = & $connectScript @connectArgs |
Comment on lines
+16
to
+30
| try { | ||
| return & $Action | ||
| } | ||
| catch { | ||
| $status = Get-DefenderHttpStatusCode -ErrorRecord $_ | ||
| $transient = $status -in @(408, 429, 500, 502, 503, 504) | ||
| if (-not $transient -or $attempt -eq $MaxAttempts) { | ||
| throw | ||
| } | ||
|
|
||
| Add-DefenderRunLogEntry -Module 'Invoke-WithTransientRetry' ` | ||
| -Action $Description -Status 'Retried' -Attempt $attempt ` | ||
| -HttpStatusCode $status -Detail $_.Exception.Message | ||
| Start-Sleep -Seconds ([math]::Min(30, [math]::Pow(2, $attempt))) | ||
| } |
Collaborator
Author
|
Closing this public-repository PR; development will continue in the private repository until publication is approved. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
{TenantDomain}encryption-rights handling universal.Validation
git diff --checkpassed.scripts/verify-internal.ps1could not run because the environment lacks a working PowerShell 7 runtime; Windows PowerShell 5.1 is rejected by the script.assistance: agentic-cli
type: refactor
agent-tool: copilot-cli
agent-model: gpt-5.6-luna
work-item: AB#n/a