From a1c9e9a5767ba55948ccf01665268a67f13a6574 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Sat, 28 Feb 2026 14:07:57 +0100 Subject: [PATCH] chagned gather rule phase definition --- rules/gather/GATHER-DEVICE-001.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/gather/GATHER-DEVICE-001.json b/rules/gather/GATHER-DEVICE-001.json index 5d8c7796..7b6b2b1d 100644 --- a/rules/gather/GATHER-DEVICE-001.json +++ b/rules/gather/GATHER-DEVICE-001.json @@ -2,7 +2,7 @@ "$schema": "../schema/gather-rule.schema.json", "ruleId": "GATHER-DEVICE-001", "title": "Collect dsregcmd join status", - "description": "Runs dsregcmd /status to capture the Azure AD / Entra join state when the device enters the Device Preparation phase.", + "description": "Runs dsregcmd /status to capture the Azure AD / Entra join state when the device enters the Account Setup phase.", "category": "device", "version": "1.0.0", "author": "Autopilot Monitor", @@ -10,7 +10,7 @@ "collectorType": "command_allowlisted", "target": "dsregcmd /status", "trigger": "phase_change", - "triggerPhase": "DevicePreparation", + "triggerPhase": "AccountSetup", "outputEventType": "gather_dsregcmd_status", "outputSeverity": "Info", "tags": ["device", "entra", "join"]