Summary
decode_direction's mapping of %%14592/%%14593 to Inbound/Outbound is unverified against a
real Windows Security log — the code's own comment already flags this. If swapped, every event's
reported direction is silently inverted.
Where
src/event_query.rs:296-304 — decode_direction, comment: "VERIFY on a real box: expected
%%14592 = Inbound, %%14593 = Outbound."
Detail
Not a new discovery — surfacing it here so it's tracked rather than lost as "already known" and
therefore never actually checked. No live Windows host was available in the review that produced
this ticket either, so the mapping remains unresolved. This is centrally load-bearing: direction is
used throughout scope-based attribution (scope.rs) and the UI's Dir column/filter.
Status: Suspected
Self-flagged by the code, not reproduced. Needs a real Windows box generating known-direction
traffic (e.g. an outbound request from a test process) and comparing the resulting 5156 event's
%% token against the observed direction.
Fix
Verify against a real Security log with --dump-filters/--export-support or a targeted test
capture; if confirmed correct, remove the "VERIFY" comment and add a regression test pinning the
mapping. If swapped, fix the mapping and add the same regression test.
Severity: Low/informational · Suspected · from REPO_CODE_REVIEW_2026-07-31 (F4)
Summary
decode_direction's mapping of%%14592/%%14593to Inbound/Outbound is unverified against areal Windows Security log — the code's own comment already flags this. If swapped, every event's
reported direction is silently inverted.
Where
src/event_query.rs:296-304—decode_direction, comment: "VERIFY on a real box: expected%%14592= Inbound,%%14593= Outbound."Detail
Not a new discovery — surfacing it here so it's tracked rather than lost as "already known" and
therefore never actually checked. No live Windows host was available in the review that produced
this ticket either, so the mapping remains unresolved. This is centrally load-bearing: direction is
used throughout scope-based attribution (
scope.rs) and the UI's Dir column/filter.Status: Suspected
Self-flagged by the code, not reproduced. Needs a real Windows box generating known-direction
traffic (e.g. an outbound request from a test process) and comparing the resulting 5156 event's
%%token against the observed direction.Fix
Verify against a real Security log with
--dump-filters/--export-supportor a targeted testcapture; if confirmed correct, remove the "VERIFY" comment and add a regression test pinning the
mapping. If swapped, fix the mapping and add the same regression test.
Severity: Low/informational · Suspected · from REPO_CODE_REVIEW_2026-07-31 (F4)