Add COM diagnostics and retain unrecognized Learning Mode events

[Jacob Dereje (jacobdereje-msft)]

Adds diagnostic labels for COM activation and interface calls. Retains unfamiliar providers and event IDs in verbose logs, extracting their properties where possible and recording a diagnostic reason when parsing fails.

Tests

Ran 219 decoder tests and Clippy locally; all passed. Validated native block/allow capture, COM events, deduplication, timeout, ETL retention and telemetry consent. Processing the same real traces before and after produced identical actionable JSON.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Copilot review overview

🟡 Changes recommended

Newly retained composite property values can expose private file paths in local verbose artifacts.

Review effort: Balanced
Findings: 1

Open (1)

• Unknown-event properties bypass path redaction in local artifacts · New

What changed in this PR

Expands Learning Mode diagnostics with COM-specific outcomes and retention of unfamiliar events, while keeping actionable denial extraction limited to known schemas.

Changes:

• Adds version-3 verbose diagnostics and nonfatal schema-failure reporting.
• Broadens process-scoped ETL retention and deduplicates sanitized telemetry.
• Adds decoder, relogging, and telemetry regression coverage.

File	Description
src/​testing/​wxc_e2e_tests/​tests/​e2e_telemetry_etw.rs	Updates fixtures and version expectations.
src/​host/​plm/​src/​elevated.rs	Uses relogged-trace analysis.
src/​core/​mxc_engine/​src/​verbose_telemetry.rs	Deduplicates signatures after removing sensitive properties.
src/​core/​learning_mode_platforms/​windows/​src/​tdh_decode.rs	Adds schema-cache test support.
src/​core/​learning_mode_platforms/​windows/​src/​extractors.rs	Classifies COM events and expands path detection.
src/​core/​learning_mode_platforms/​windows/​src/​etl_filter.rs	Retains unfamiliar process-scoped events.
src/​core/​learning_mode_platforms/​windows/​src/​etl_decode.rs	Records unfamiliar events and decode failures.
src/​core/​learning_mode_platforms/​windows/​Cargo.toml	Adds temporary-file test dependency.
src/​core/​learning_mode_core/​src/​verbose_logging.rs	Introduces version-3 providers and reasons.
src/​Cargo.lock	Records the test dependency.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Command-line properties can expose private paths, and supported-schema failures can leave incomplete analysis marked complete.

Review effort: Balanced
Findings: 3

Open (3)

• Mark analysis incomplete when supported event schemas are unavailable · New
• Redact embedded paths in retained command-line properties · New
• Unknown-event properties bypass path redaction in local artifacts

[Copilot]

Copilot review overview

🔵 Needs a closer look

Privileged trace-scoping changes need human validation, and supported-event schema failures can produce apparently complete but incomplete learned policies.

Review effort: Balanced
Findings: 2

Open (2)

• Mark analysis incomplete when supported event schemas are unavailable · New
• Mark analysis incomplete when supported event schemas are unavailable

Resolved since last review (2)

• Redact embedded paths in retained command-line properties
• Unknown-event properties bypass path redaction in local artifacts

[Copilot]

Copilot review overview

🟡 Changes recommended

Brokered schema failures can silently omit capability denials while reporting complete analysis, allowing incomplete adjusted policies.

Review effort: Balanced
Findings: 1

Open (1)

• Record truncation before PID resolution for failed brokered schemas · New

Resolved since last review (2)

• Mark analysis incomplete when supported event schemas are unavailable
• Mark analysis incomplete when supported event schemas are unavailable

Previously missed (1)

In code that hasn't changed since last review

Mark brokered events incomplete when schema lookup blocks PID recovery

src/​core/​learning_mode_platforms/​windows/​src/​etl_decode.rs:991

When a supported brokered Event 28 has no resolvable schema, its payload ProcessId cannot be recovered. If the broker's header PID is outside the sandbox lifetimes, this fallback silently drops the event. Subsequent analysis cannot detect the loss and can report deniedResourcesTruncated=false, allowing an incomplete adjusted policy. Keep schema failures fatal during brokered-event scoping, without retaining unscoped host events. Update relog_selection_skips_unattributable_capability_schema_failure to expect the failure.

[Copilot]

Copilot review overview

🟡 Changes recommended

Brokered schema failures can silently omit capability denials while guarded analysis reports complete results.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Do not drop schema failures before recording incomplete analysis · New
• Update capability documentation for version 3 behavior · New

Resolved since last review (1)

• Record truncation before PID resolution for failed brokered schemas

[Copilot]

Copilot review overview

🔵 Needs a closer look

Unresolved redaction and event-identity issues need correction, and privacy-sensitive privileged trace filtering warrants final human review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Sanitize TraceLogging property names before local artifact aggregation · New
• Update capability documentation for version 3 behavior

Resolved since last review (1)

• Do not drop schema failures before recording incomplete analysis

Previously missed (1)

In code that hasn't changed since last review

Preserve TraceLogging schema names in diagnostic signatures

src/​core/​learning_mode_platforms/​windows/​src/​etl_decode.rs:1059

TraceLogging events commonly share event ID 0 and are distinguished by schema-declared names. decode_event_parts reads that name but retains it only on failure. Two successfully decoded, differently named events from the same provider and PID with identical properties therefore collapse into one signature here, losing their identities and combining their counts. Carry the schema name into successful diagnostic signatures as sanitized metadata, keeping it distinct from payload fields, and test two differently named events with identical payloads. Telemetry can continue stripping this metadata.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Broader privileged trace retention and changed decoding and privacy behavior warrant Windows-focused human review of the reported native validation.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Sanitize TraceLogging property names before local artifact aggregation
• Update capability documentation for version 3 behavior

[Richie Gomez (richiemsft)]

Can you split this PR into:

1. Add COM diagnostics
2. retain unrecognized Learning Mode Events