feat(bec): add full BEC case workflow - #490
Draft
Zacgoose wants to merge 9 commits into
Draft
Conversation
Zacgoose
force-pushed
the
preview/bec-case-workflow
branch
5 times, most recently
from
September 4, 2026 14:02
2628cd4 to
b3f5d2b
Compare
Replace the old single-user BEC check/remediate flow with a full case-based investigation system. This adds new backend collectors, heuristics/scoring, report storage, containment orchestration, evidence export, Purview content-search actions, bulk queueing, and progress tracking; updates alert automation and logging context; and introduces new user/report pages and components for run history, containment, phishing spread, evidence export, and BEC reports. Documentation and broad backend/frontend tests were added to cover the new behavior.
…olete 50-user cap test The committed openapi.json carried ExecBECContentSearch's StartDate/EndDate in format-first key order, which no longer matches the deterministic ([ordered]) generator - a full rebuild produces type-first and CI -Check would report drift. Regenerate so the two date-time leaves are type-first. ExecBECBulkCheck no longer caps the user count, but the endpoint test still asserted a 50-user refusal. Replace that assertion with a positive check that a list over 50 is accepted and every resolvable user is queued, and keep the empty-selection guard.
Zacgoose
force-pushed
the
preview/bec-case-workflow
branch
from
September 4, 2026 14:51
b3f5d2b to
dfc270a
Compare
Move BEC from the old per-user/remediation report flow into a dedicated `/identity/bec` hub and `/identity/bec/case` workspace, with new triage/objective-group UI components and updated navigation/action links. Remove the Purview content-search endpoint and related compliance-search helpers/tests, and simplify remediation action payloads. Add collector skip semantics (`Skipped`/`Requirement`), centralized BEC error classification, and preflight gating for mailbox/Entra P2/Defender checks so unsupported checks are marked as not checked instead of passing or hard-failing; update backend/frontend tests and add a BEC simulation data tool.
Expand BEC inbox-rule heuristics to better catch high-risk behavior: external forwarding, delete/hide patterns, rules that act on all mail, and sensitive keyword targeting. Push-BECRun now emits a `Suspicious` flag and stronger risk reasons, scoring uses that flag for suspicious-rule signal counts, and tests cover the new detection path. Frontend BEC findings now highlight only suspicious rules (with backward-compatible fallback), and includes small UX/content fixes (BEC docs path mapping, icon update, and flex gap layout tweak).
Reshapes the BEC experience around clearer triage and reporting: adds a plain-language “What We Found” section, trims summary-only report output, and moves multi-run case switching into the triage header. The BEC runs page now uses a single CippTablePage for both flat and by-user views (removing the separate grouped-runs component), with mode-aware actions/columns. Evidence export was simplified to a single button with tooltip-based status (last SHA/error) instead of a popover panel, and timeline flow styling was adjusted for better dark-mode readability. Also ignores node_modules and drops a generated vitest result artifact.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace the old single-user BEC check/remediate flow with a full case-based investigation system. This adds new backend collectors, heuristics/scoring, report storage, containment orchestration, evidence export, Purview content-search actions, bulk queueing, and progress tracking; updates alert automation and logging context; and introduces new user/report pages and components for run history, containment, phishing spread, evidence export, and BEC reports. Documentation and broad backend/frontend tests were added to cover the new behavior.