DET-H20: Attestation baseline re-established without a verified prior report¶
On upgrade, a host whose last stored report did not verify (possibly a forged one) has no state the drift rules (DET-H1/H2/H3/H19) can compare with: reports keep findings, not state, and a writer can file one claiming to be a collector's. Its next verified report re-establishes the baseline (state and check statuses), once, and this names the host and the measurement, firmware and debug values adopted: confirm them, since a change carried by that report was compared with nothing.
| Property | Value |
|---|---|
| Severity | medium |
| Platform | Hardware fleets |
| Group | hardware |
| Log source | Collector · verified report |
| Related check | SNP-MEAS-01: Launch measurement is in the fleet's expected set |
Fires when¶
an upgraded asset's last stored report was unverified AND a verified one re-establishes the baseline
How it runs¶
The hosted service evaluates this rule on what enrolled collectors report and on key-release decisions. There is nothing to run; see Enroll a collector.
A match appears in the console as a detection with this rule's ID and triggers your alerts; see Runtime detections.