Update the Learning Mode network provider GUID

[Richie Gomez (richiemsft)]

Description

Fix missing network denials in native processContainer.captureDenials output.

The managed Learning Mode ETL already contains Microsoft-Windows-LearningMode-NetworkDecision events under the provider GUID {301EC03D-2951-5EFB-6D99-59C64628BBFC}. MXC used the obsolete GUID, so it discarded those records as unrelated provider traffic before decoding their payloads. This left both actionable network denials and verbose network signatures empty despite real WFP policy drops.

Replace the old GUID with the current GUID everywhere it is duplicated: event routing, extraction, verbose output, telemetry projection, existing test fixtures/assertions, and documentation.

The entire PR is 16 GUID-value line replacements across seven existing files. There are no added helpers, compatibility aliases, fallback paths, new tests, or other logic changes. The old provider is no longer recognized.

No schema, dependency, or network-policy changes.

References

• Related documentation: docs: describe WFP denial capture #1420
• Network denial sources

Validation

Automated checks from src:

• cargo fmt --all -- --check
• cargo test -p mxc-sdk --lib learning_mode --quiet - 332 passed, 1 manual benchmark ignored.
• cargo test -p mxc-sdk --lib capture_output --quiet - 21 passed.
• cargo test -p mxc-sdk --lib verbose_telemetry --quiet - 10 passed.
• cargo clippy -p mxc-sdk --lib --tests --quiet -- -D warnings
• cargo build --release --target x86_64-pc-windows-msvc -p wxc -p mxc_ffi --quiet

Manual verification on an x64 Windows 26711.1000 VM using rebuilt release executables and the public .NET V1 SDK:

• Independently decoded the original native ETL and confirmed three real Event ID 1 network decisions under the manifested GUID before changing MXC.
• Ran six CLI scenarios: COM block/allow, network default deny, combined COM/network block/allow, and network explicit deny.
• Ran two public .NET SDK combined scenarios in block and allow mode.
• Network default-deny and combined captures now contain three verbose network groups and three actionable endpoints: TCP 203.0.113.10:443, UDP 203.0.113.10:53, and TCP 198.51.100.20:8443.
• The explicit-deny scenario retains all three verbose groups but only two actionable endpoints; the authored explicit deny remains diagnostic-only.
• COM activation diagnostics and the ungranted-file block/allow controls remain working. Retained ETLs and actionable/verbose JSON were preserved locally. Telemetry was explicitly disabled.

Checklist

• Signed the Contributor License Agreement
• Linked to an issue (no issue supplied; related PR linked above)
• Updated documentation
• Updated Copilot instructions (not applicable; no build, architecture, or convention changes)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (not applicable; unchanged)

Issue Type

• Bug fix
• Feature
• Task

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟢 Approval recommended

The focused changes preserve existing validation and capture behavior, with regression coverage and no identified blocking issues.

0 open findings

What changed in this PR

Fixes missing network denials in ProcessContainer capture by recognizing the manifested provider GUID alongside the earlier identity.

Changes:

• Shares provider recognition across routing, extraction, classification, and decode-error handling.
• Preserves the observed GUID in verbose signatures.
• Adds regression coverage and updates documentation without changing schemas or network policy.

File	Description
src/​mxc-sdk/​src/​core/​learning_mode_windows/​network_extractors.rs	Defines shared recognition for both provider identities.
src/​mxc-sdk/​src/​core/​learning_mode_windows/​extractors.rs	Applies recognition to classification and process scoping.
src/​mxc-sdk/​src/​core/​learning_mode_windows/​etl_decode.rs	Updates routing, preserves observed GUIDs, and adds regression coverage.
docs/​logging-access-denied.md	Documents both identities and updates the verbose example.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The narrowly scoped GUID replacements are consistent across code, tests, and documentation, with no blocking issues identified.

0 open findings

🧠 Review effort: Balanced