Consolidate Learning Mode analyzer coverage

[Richie Gomez (richiemsft)]

📖 Description

Consolidates Learning Mode block and permissive-event analysis behind the canonical ETL analyzer.

• centralizes the Event 27 UI-violation vocabulary and maps every current JOB_OBJECT_UILIMIT_* value;
• makes block and allow traces use the same provider/event filtering and denial composition;
• recovers capability denials from permissive Event 14 DACL ACEs, including the flattened TDH shape emitted by real V2 traces;
• resolves capability SIDs to policy names while ignoring unrelated token-level CapabilitySid properties;
• accepts only allowed ACEs with nonzero access masks and omits unidentified capability events.

🔗 References

• Builds on Update Learning Mode to V2 API contracts #739.
• Incorporates and adapts analyzer/UI coverage from @lily-barkley's existing PR Permissive Learning Mode 5/6 UI Policy #588. We plan to close Permissive Learning Mode 5/6 UI Policy #588 as superseded after this PR merges, while retaining attribution for the work reused here.

🔍 Validation

• cargo test -p learning_mode_windows --all-targets — 140 passed.
• cargo fmt --all -- --check
• cargo clippy -p learning_mode_windows --all-targets -- -D warnings

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Richie Gomez (richiemsft)]

Lily Barkley (@lilybarkley-msft)

[Richie Gomez (richiemsft)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Consolidates Learning Mode ETL analysis so block/permissive traces share the same canonical UI vocabulary and capability-denial extraction (including permissive Event 14 DACL-derived capability denials).

Changes:

• Added a canonical UI violation vocabulary module and updated Learning Mode violation extraction to use it.
• Extended TDH decoding to render binary properties as hex: strings and added capability recovery from permissive Event 14 DACL data.
• Updated ETL analyzer composition/tests to include recovered capability denials and enforce provider/event vocabulary.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/backends/learning_mode/windows/src/ui.rs	Introduces canonical Event 27 UI violation naming and tests.
src/backends/learning_mode/windows/src/tdh_decode.rs	Adds TDH_INTYPE_BINARY formatting as hex: for downstream parsing.
src/backends/learning_mode/windows/src/lib.rs	Registers new capability_dacl and ui modules on Windows.
src/backends/learning_mode/windows/src/extractors.rs	Switches Event 27 parsing to numeric category/detail and canonical UI names; adds tests.
src/backends/learning_mode/windows/src/etl_decode.rs	Composes DACL-derived capability denials alongside canonical extraction; updates tests/helpers.
src/backends/learning_mode/windows/src/capability_dacl.rs	New module to recover capability denials from permissive Event 14 DACL/ACE data with tests.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.