gsadmin/AutopilotMonitor
1
0
Fork 0
mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 04:32:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix community gather cert rule

Browse Source
This commit is contained in:
Oliver Kieselbach
2026-03-17 22:43:17 +01:00
parent 1815159c80
commit c3b8f12300
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/gather/GATHER-ID-002.json
+2 -1
View File
@@ -10,7 +10,8 @@
"enabled": true,
"collectorType": "command_allowlisted",
"target": "$c = Get-ChildItem Cert:\\LocalMachine\\My; if ($c) { $c | Select-Object Subject, Thumbprint, Issuer, NotBefore, NotAfter, HasPrivateKey | ConvertTo-Json } else { '{\"CertificateCount\": 0}' }",
"trigger": "startup",
"trigger": "phase_change",
"triggerPhase": "FinalizingSetup",
"outputEventType": "gather_machine_cert_store",
"outputSeverity": "Info",
"tags": ["identity", "certificates", "machine-store", "powershell"]