utmstack · Kbayero · Jul 31, 2026 · Jul 29, 2026 · Jul 29, 2026 · Jul 29, 2026
diff --git a/backend/modules/compliance/usecase/evaluator.go b/backend/modules/compliance/usecase/evaluator.go
@@ -127,6 +127,17 @@ func (e *evaluator) SetStatusOverride(ctx context.Context, frameworkKey, control
 	if !domain.ValidStatus(status) {
 		return domain.ErrInvalidStatus
 	}
+
+	note:=domain.UtmComplianceControlNote{
+		ControlID:    controlID,
+		Note: 		  reason,
+	}
+
+	err:=e.notes.Upsert(ctx,&note)
+	if err!=nil{
+		return err
+	}
+
 	return e.overrides.Upsert(ctx, &domain.UtmComplianceControlStatusOverride{
 		FrameworkKey: frameworkKey,
 		ControlID:    controlID,
@@ -370,12 +381,9 @@ func tally(s *domain.ReportSummary, status string) {
 	}
 }
 
-// finalizeSummary computes the compliance score over the controls that were
-// actually evaluated (compliant + non-compliant + at-risk); governance, pending
-// and not-covered are excluded from the percentage.
 func finalizeSummary(s *domain.ReportSummary) {
-	evaluated := s.Compliant + s.NonCompliant + s.AtRisk
+	evaluated := s.Compliant + s.NonCompliant + s.AtRisk + s.Pending
 	if evaluated > 0 {
-		s.CompliantPct = s.Compliant * 100 / evaluated
+		s.CompliantPct = (s.Compliant  / evaluated) * 100
 	}
 }
diff --git a/definitions/compliance/controls/banking-audit/banking-audit-838.yaml b/definitions/compliance/controls/banking-audit/banking-audit-838.yaml
@@ -0,0 +1,21 @@
+id: banking-audit-838
+family: banking-audit
+familyName: BANKING AUDIT
+name: Windows Account Logon Success
+scope: data
+statement: "The Windows Account Logon Success Report provides a comprehensive view of successful logon events, serving as a crucial tool for compliance within the Banking Audit framework. This report ensures alignment with security controls that manage and monitor user access, safeguarding sensitive financial information and meeting regulatory requirements.<br/>\t•\tBanking Regulations: Supports compliance with financial regulations, such as the Safeguards Rule under GLBA, by demonstrating a security program that protects customer data.<br/>\t•\tAccess Control: Reinforces principles of access management by tracking and validating that only authorized users can access banking systems, aligning with PCI DSS Requirement 8.<br/>\t•\tAudit Readiness: Provides evidence for maintaining security and access control, essential for audits and adherence to standards like ISO 27001 and SOC2 Type 2, ensuring secure access is granted only to legitimate users.<br/>\t•\tIncident Detection and Prevention: Helps detect unauthorized access attempts by analyzing patterns of successful logons, thereby reducing the risk of data breaches.<br/>\t•\tData Protection: Aligns with global frameworks such as GDPR Article 32, ensuring access to sensitive financial data is restricted to authorized individuals to prevent unauthorized data processing.<br/><br/>By centralizing and monitoring logon events, this report strengthens an organization’s ability to maintain cybersecurity resilience, protect financial systems, and achieve compliance with stringent banking audit requirements."
+strategy: ANY
+checks:
+  - key: windows-user-successful-logon-event-by-host
+    name: Windows User Successful Logon Event by Host
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id IN ('4624', '4672') AND logx.wineventlog.event_data.TargetUserName NOT LIKE '%$')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+  - key: windows-logon-success-by-host
+    name: Windows Logon success by Host
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id IN ('4624', '4324') AND logx.wineventlog.event_data.TargetUserName NOT LIKE '%$' AND logx.wineventlog.event_data.TargetUserName.keyword <> '-' AND logx.wineventlog.event_data.LogonType.keyword IN ('3', '2'))
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+source: Migrated from UTMStack v11
diff --git a/definitions/compliance/controls/banking-audit/banking-audit-839.yaml b/definitions/compliance/controls/banking-audit/banking-audit-839.yaml
@@ -0,0 +1,21 @@
+id: banking-audit-839
+family: banking-audit
+familyName: BANKING AUDIT
+name: Windows  Account Logon Failure
+scope: data
+statement: "The Windows Account Logon Failure Report provides a consolidated overview of failed logon attempts, playing a vital role in compliance within the Banking Audit framework. This report enables organizations to monitor, detect, and address unauthorized access attempts, ensuring the protection of sensitive financial systems and data.<br/>\t•\tBanking Regulations: Supports compliance with financial regulations, such as the Safeguards Rule under GLBA, by demonstrating measures to prevent unauthorized access to customer data.<br/>\t•\tAccess Control: Tracks failed logon attempts to identify potential unauthorized access or brute force attacks, aligning with PCI DSS Requirement 10 for monitoring access control events.<br/>\t•\tAudit Readiness: Provides evidence of failed access attempts, contributing to the transparency required by standards like SOC2 Type 2 and ISO 27001, ensuring security incidents are logged and reviewed.<br/>\t•\tIncident Response: Enhances threat detection by identifying patterns of failed logon attempts, enabling organizations to respond to suspicious activity promptly.<br/>\t•\tData Protection: Aligns with global frameworks such as GDPR Article 32, showcasing controls that prevent unauthorized access to financial systems, protecting sensitive customer data.<br/><br/>By centralizing data on logon failures, this report empowers organizations to enhance their security posture, reduce the risk of data breaches, and comply with stringent banking audit requirements."
+strategy: ANY
+checks:
+  - key: windows-failed-logon-attempts-by-reason-status
+    name: Windows Failed Logon Attempts by Reason Status
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-*
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+  - key: windows-logon-failure-by-user-and-host
+    name: Windows Logon Failure by User and Host
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_data.StatusDescription.keyword IN ('Logon failure', 'Clients credentials have been revoked', 'Pre-authentication information was invalid', 'Account restriction') AND logx.wineventlog.event_data.TargetUserName NOT LIKE '%$')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+source: Migrated from UTMStack v11
diff --git a/definitions/compliance/controls/banking-audit/banking-audit-840.yaml b/definitions/compliance/controls/banking-audit/banking-audit-840.yaml
@@ -0,0 +1,21 @@
+id: banking-audit-840
+family: banking-audit
+familyName: BANKING AUDIT
+name: Windows Account Logoff
+scope: data
+statement: The Windows Account Logoff Report provides a comprehensive view of user logoff events, serving as a critical compliance tool within the Banking Audit framework. This report ensures transparency and accountability in user sessions, enabling organizations to track session terminations and ensure adherence to access control policies.
+strategy: ANY
+checks:
+  - key: windows-account-logoff
+    name: Windows Account Logoff
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4634')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+  - key: windows-account-logoff-by-user
+    name: Windows Account Logoff by User
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4647')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+source: Migrated from UTMStack v11
diff --git a/definitions/compliance/controls/banking-audit/banking-audit-841.yaml b/definitions/compliance/controls/banking-audit/banking-audit-841.yaml
@@ -0,0 +1,21 @@
+id: banking-audit-841
+family: banking-audit
+familyName: BANKING AUDIT
+name: Windows Logins with explicit credentials
+scope: data
+statement: The Windows Logins with Explicit Credentials Report provides a detailed record of login events where explicit credentials (e.g., usernames and passwords) were used. This report plays a vital role in ensuring compliance within the Banking Audit framework by monitoring authentication activities and safeguarding sensitive financial systems.
+strategy: ANY
+checks:
+  - key: windows-logins-with-explicit-credentials
+    name: Windows Logins with explicit credentials
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4648')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+  - key: windows-logins-with-explicit-credentials-by-user
+    name: Windows Logins with explicit credentials by User
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4648')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+source: Migrated from UTMStack v11
diff --git a/definitions/compliance/controls/banking-audit/banking-audit-842.yaml b/definitions/compliance/controls/banking-audit/banking-audit-842.yaml
@@ -0,0 +1,21 @@
+id: banking-audit-842
+family: banking-audit
+familyName: BANKING AUDIT
+name: Windows Cleaned Event Log
+scope: data
+statement: The Windows Cleaned Event Log Report provides a detailed record of actions where system event logs have been cleared. This report is critical within the Banking Audit framework, as it helps detect potential tampering with log integrity and supports regulatory compliance by monitoring log management activities.
+strategy: ANY
+checks:
+  - key: windows-cleaned-event-log
+    name: Windows Cleaned Event Log
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '1102')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+  - key: windows-cleaned-event-log-by-source
+    name: Windows Cleaned Event Log by Source
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '1102')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+source: Migrated from UTMStack v11
diff --git a/definitions/compliance/controls/banking-audit/banking-audit-843.yaml b/definitions/compliance/controls/banking-audit/banking-audit-843.yaml
@@ -0,0 +1,21 @@
+id: banking-audit-843
+family: banking-audit
+familyName: BANKING AUDIT
+name: Windows Policy changes
+scope: data
+statement: The Windows Policy Changes Report provides a comprehensive record of system policy modifications, including changes to group policies, security configurations, and access controls. This report is critical within the Banking Audit framework, ensuring traceability and compliance with regulatory requirements by monitoring configuration changes that could impact the security of financial systems.
+strategy: ANY
+checks:
+  - key: windows-policy-changes
+    name: Windows Policy changes
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4663')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+  - key: windows-policy-changes-by-outcome
+    name: Windows Policy changes by outcome
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4719')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+source: Migrated from UTMStack v11
diff --git a/definitions/compliance/controls/banking-audit/banking-audit-844.yaml b/definitions/compliance/controls/banking-audit/banking-audit-844.yaml
@@ -0,0 +1,21 @@
+id: banking-audit-844
+family: banking-audit
+familyName: BANKING AUDIT
+name: Windows User Accounts Created
+scope: data
+statement: The Windows User Accounts Created Report provides a detailed record of all user account creation events in the system. This report plays a vital role in ensuring compliance within the Banking Audit framework by monitoring and controlling user account management processes to protect sensitive financial systems.
+strategy: ANY
+checks:
+  - key: windows-user-accounts-created
+    name: Windows User Accounts Created
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4720' AND logx.wineventlog.event_data.SubjectUserName NOT LIKE '%$' AND logx.wineventlog.event_data.TargetUserName NOT LIKE '%$')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+  - key: windows-new-accounts-created-over-time
+    name: Windows New Accounts Created Over Time
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4720')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+source: Migrated from UTMStack v11
diff --git a/definitions/compliance/controls/banking-audit/banking-audit-845.yaml b/definitions/compliance/controls/banking-audit/banking-audit-845.yaml
@@ -0,0 +1,21 @@
+id: banking-audit-845
+family: banking-audit
+familyName: BANKING AUDIT
+name: Windows Password Reset Attempts
+scope: data
+statement: The Windows Password Reset Attempts Report provides a comprehensive overview of password reset activities, tracking both successful and failed attempts. This report is a critical tool in the Banking Audit framework, ensuring accountability and security in the management of user credentials.The Windows Password Reset Attempts Report provides a comprehensive overview of password reset activities, tracking both successful and failed attempts. This report is a critical tool in the Banking Audit framework, ensuring accountability and security in the management of user credentials.
+strategy: ANY
+checks:
+  - key: windows-password-reset-attempts
+    name: Windows Password Reset Attempts
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4724')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+  - key: windows-password-reset-attempts-by-target-user
+    name: Windows Password Reset Attempts by Target User
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4724')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+source: Migrated from UTMStack v11
diff --git a/definitions/compliance/controls/banking-audit/banking-audit-846.yaml b/definitions/compliance/controls/banking-audit/banking-audit-846.yaml
@@ -0,0 +1,21 @@
+id: banking-audit-846
+family: banking-audit
+familyName: BANKING AUDIT
+name: 'Windows User Accounts Deleted '
+scope: data
+statement: The Windows User Accounts Deleted Report provides a detailed record of all user account deletion events within the system. This report is critical for maintaining accountability and ensuring compliance within the Banking Audit framework, as it helps monitor access control changes and detect potential security risks.
+strategy: ANY
+checks:
+  - key: windows-user-accounts-deleted-over-time
+    name: Windows User Accounts Deleted Over Time
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4726')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+  - key: windows-user-accounts-deleted
+    name: Windows User Accounts Deleted
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4726' AND logx.wineventlog.event_data.SubjectUserName NOT LIKE '%$' AND logx.wineventlog.event_data.TargetUserName NOT LIKE '%$')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+source: Migrated from UTMStack v11
diff --git a/definitions/compliance/controls/banking-audit/banking-audit-847.yaml b/definitions/compliance/controls/banking-audit/banking-audit-847.yaml
@@ -0,0 +1,21 @@
+id: banking-audit-847
+family: banking-audit
+familyName: BANKING AUDIT
+name: Windows Protected Object Permission Change
+scope: data
+statement: The Windows Protected Object Permission Change Report provides a comprehensive overview of permission changes to critical system objects such as files, folders, registry keys, and other sensitive resources. This report is essential for compliance within the Banking Audit framework, ensuring the integrity of access control mechanisms and safeguarding sensitive financial systems.
+strategy: ANY
+checks:
+  - key: windows-protected-object-permission-change
+    name: Windows Protected Object Permission Change
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4670')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+  - key: windows-process-distribution-of-protected-object-permission-change
+    name: Windows Process Distribution of Protected Object Permission Change
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4670')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+source: Migrated from UTMStack v11
diff --git a/definitions/compliance/controls/banking-audit/banking-audit-848.yaml b/definitions/compliance/controls/banking-audit/banking-audit-848.yaml
@@ -0,0 +1,21 @@
+id: banking-audit-848
+family: banking-audit
+familyName: BANKING AUDIT
+name: Windows Access to critical files or specific directories
+scope: data
+statement: The Windows Access to Critical Files or Specific Directories Report provides detailed insights into access attempts—both successful and failed—on critical files and directories within the system. This report is a cornerstone for compliance within the Banking Audit framework, ensuring the protection of sensitive financial data and monitoring access to critical resources.
+strategy: ANY
+checks:
+  - key: windows-access-to-critical-files-or-specific-directories
+    name: Windows Access to critical files or specific directories
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4663')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+  - key: windows-distribution-of-access-results-to-critical-files-or-specific-directories
+    name: Windows Distribution of access results to critical files or specific directories
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4663')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+source: Migrated from UTMStack v11
diff --git a/definitions/compliance/controls/banking-audit/banking-audit-849.yaml b/definitions/compliance/controls/banking-audit/banking-audit-849.yaml
@@ -0,0 +1,21 @@
+id: banking-audit-849
+family: banking-audit
+familyName: BANKING AUDIT
+name: Windows Connection blocked by Windows Firewall
+scope: data
+statement: "The Windows Connection Blocked by Windows Firewall Report provides a detailed overview of network connection attempts that were denied by the firewall. This report is a critical compliance tool within the Banking Audit framework, helping organizations monitor and enforce network security policies while safeguarding sensitive financial systems.<br/>\t•\tBanking Regulations: Aligns with the GLBA Safeguards Rule, ensuring the protection of customer information by monitoring and controlling unauthorized network activity.<br/>\t•\tNetwork Security Compliance: Supports compliance with PCI DSS Requirement 1, which mandates the implementation of robust firewall configurations to secure sensitive networks.<br/>\t•\tAudit Readiness: Documents blocked connections, providing evidence for frameworks like SOC2 Type 2 and ISO 27001, demonstrating proper enforcement of network access policies.<br/>\t•\tIncident Detection: Identifies repeated or suspicious connection attempts, which could indicate network scanning, unauthorized access attempts, or malicious activity.<br/>\t•\tData Protection: Ensures compliance with GDPR Article 32, showcasing controls that protect sensitive data by preventing unauthorized network connections to critical systems."
+strategy: ANY
+checks:
+  - key: windows-connection-blocked-by-windows-firewall
+    name: Windows Connection blocked by Windows Firewall
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '5158')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+  - key: windows-connection-blocked-by-application
+    name: Windows Connection blocked by Application
+    indexPattern: v11-log-wineventlog-*
+    sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '5158')
+    rule: MIN_HITS_REQUIRED
+    ruleValue: 1
+source: Migrated from UTMStack v11