CC SecurityThird Party Software License Notices
CC Security includes its own implementations, third-party open-source components, and runtimes distributed under Microsoft terms. This document explains the provenance and licensing of the main components in the current version and how to obtain corresponding source code. Your rights in third-party components are governed by the full text of their respective licenses. The End User License Agreement for CC's own components cannot restrict those rights.
1 Applicable Version and How to Read This Document
This document applies to CC Security 26H2-11-10001, including the October 22, 2026 EDR command-correlation revision. For different revisions sharing the same version label, also check the release manifest, source package, and installer hashes. Do not assume binaries are identical based only on the interface version.
The component inventory is grouped by function and does not list every .NET system assembly as a separate product. Author, copyright, license, and modification notices in upstream source code must be retained. The summaries below aid navigation; they do not replace full license texts or provide additional assurances of upstream security.
2 Detection Engine and Rules
Component and version | Purpose | License and source |
|---|---|---|
Gene v2.3.0 | Local event rule matching | GPL 3.0github.com/0xrawsec/gene |
CC EDR adapter and 16 configurations | JSON lines integration and original correlation configurations | GPL 3.0 onlyEdr/LICENSE in the source code |
golang utils v1.3.2 | Utility code required by Gene | GPL 3.0github.com/0xrawsec/golang-utils |
go toml v1.9.3 | Engine configuration parsing dependency | Primarily MITSome files Apache 2.0 |
Sigma pinned revision 8a4813404ea3 | Selected and converted detection rules | DRL 1.1SigmaHQ/sigma |
Intelligent EDR Engine uses the actual Gene engine for local matching. There are currently 16 CC-authored correlation configurations; 013 through 016 are the independently expressed command-correlation configurations in this revision. Interface branding does not change the provenance or licenses of Gene and related dependencies. This integration is not the complete WHIDS product and does not mean that all its rules, management services, or sensors have been deployed.
Sigma rules are selected and converted according to the events and fields CC can actually process, while retaining each original rule's author, source, revision, and license information. There are currently 1,320 imported Sigma rules. CC's built-in rules, correlation configurations, and other policies are counted separately. The total must not be interpreted as complete coverage of the upstream rule repository.
3 Interface Runtimes and Icons
Component or material | Current version or scope | License information |
|---|---|---|
Microsoft .NET and Windows Desktop | 10.0.13 self-contained runtime | Open-source portions follow their respective project licensesRetain Microsoft and third-party notices |
WebView2 SDK and interop components | SDK 1.0.3719.77Windows SDK interop 10.0.19041.57 | Microsoft bundled licensesRuntime separately governed by Microsoft terms |
TraceEvent and managed dependencies | TraceEvent 3.2.8.NETCore.Client 0.2.510501 and others | MIT and other bundled package licensesRetain corresponding notices |
Microsoft Fluent System Icons | 14 iconsPinned commit 83b26348c811 | MIT and bundled NOTICE |
Lucide and derived Feather icons | Icon materials retained in the package | Lucide ISCRelevant Feather portions MIT |
Distinguish the Microsoft WebView2 SDK from the WebView2 Runtime. The SDK version identifies the build dependency, while the runtime actually installed on a device may differ because of Microsoft updates. WebView2 does not become CC-owned code because it is installed with CC. Its distribution and use follow the accompanying Microsoft licenses.
The .NET runtime and some underlying native libraries may also include third-party notices. Before copying or redistributing these components, consult each project's LICENSE and THIRD-PARTY-NOTICES and the Microsoft runtime terms. Do not infer from this table that all Microsoft binaries share a single open-source license.
4 Other Materials in the Installer and Source Archive
The installer is built with Inno Setup 6.7.3 and is subject to the Inno Setup License. Its authors include Jordan Russell and Martijn Laan. The Simplified Chinese installer translation is subject to the MIT license and kirakira copyright notice retained with the source. Using the installation system does not make CC the original author of Inno Setup.
The corresponding source archive also retains historical source materials for liquidGL 3.0.0 and liquid-glass-studio, including their original MIT licenses and pinned provenance information. These materials are not loaded by the current active interface. Their presence in the source directory does not establish that the current product uses their renderers.
Current desktop Gaussian blur uses CC's native Windows Composition background module. Using Windows platform APIs does not relicense Windows itself under an open-source license. The Go runtime and standard library included in the Go worker are governed by the Go project's BSD-style license and corresponding third-party notices.
5 Obtaining Corresponding Source Code and Full Licenses
The Sources directory in the complete installer provides the source archive delivered with this version, named CCSecurity-26H2-11-10001-source.zip. Extracting this archive, reading it, or modifying its third-party open-source portions under their applicable licenses is not subject to the general unpacking or reverse-engineering restrictions on CC's own components.
Within the source package, work/src/Edr/LICENSE, README.md, and provenance.json document the licenses and provenance of the EDR adapter and configurations. The vendor directory contains the corresponding source code and licenses for Gene, golang-utils, and go-toml. The go-toml LICENSE also states that certain files originating from Google civil use Apache 2.0; retaining only the MIT license is insufficient.
work/src/Hips/Rules/LICENSE.Detection.Rules.md and provenance.json retain the DRL 1.1 license and per-rule provenance for Sigma rules. work/src/UI/WebAssets/fluent retains the Fluent license and provenance. icons/LICENSE.txt retains the Lucide and Feather notices, and work/src/docs/TraceEvent-NOTICE.txt retains the TraceEvent notices. The Installer directory includes the Chinese translation license.
If release materials omit required licenses, notices, or corresponding source code, or if the included source does not match the revision of the binaries you obtained, send the version, revision, and file hashes to kelematubako@gmail.com to request clarification and missing materials. Personal documents, passwords, and remote-control access to your device are not required.
6 Third Party Rights Take Precedence
For GPL-covered programs and corresponding modifications, you lawfully hold the rights granted by that license, including running, studying, modifying, and redistributing them. Distribution also requires fulfillment of the corresponding source-code and license obligations. General terms for CC's own components must not impose additional restrictions on these components that conflict with the GPL.
Follow the original terms of MIT, ISC, BSD, Apache, and other licenses concerning grants of rights, attribution, notices, disclaimers, and other requirements. DRL 1.1 includes specific requirements for identifying original authors, sources, and licenses in rules and rule-matching information. This document does not combine different licenses into a single uniform restriction.
Third-party trademarks, project names, and copyrights remain the property of their respective rights holders. Listing a component or integrating it into the interface does not constitute official certification, joint-development endorsement, or a security warranty from an upstream product, Microsoft, OpenAI, or any other entity.
7 Excluded Projects and Future Changes
The EDR and active-defense designs of XIGUASecurity10x and PYAS were studied during this work, but their source code, original rule arrays, models, and allowlists were not included in the current CC release package. Research references to these projects do not constitute module authorization, and renaming or making minor changes cannot replace compliance with their license requirements.
When components are added or removed, these notices should be updated with the corresponding version. Lawfully acquired open-source rights cannot be retroactively revoked by branding changes or updates to these notices. Report omissions, incorrect attribution, or license conflicts through the contact email.
8 Full Licenses and Project Links
GNU GPL version 3 https://www.gnu.org/licenses/gpl-3.0.html
Gene https://github.com/0xrawsec/gene
Sigma and DRL https://github.com/SigmaHQ/sigma
Microsoft Fluent System Icons https://github.com/microsoft/fluentui-system-icons
Microsoft WebView2 distribution guidance https://learn.microsoft.com/microsoft-edge/webview2/concepts/distribution
Inno Setup License https://jrsoftware.org/files/is/license.txt