From d1d88f57df4021ff7cc4d4ab554507a4e1f7c40b Mon Sep 17 00:00:00 2001
From: okieselbach <26136457+okieselbach@users.noreply.github.com>
Date: Tue, 17 Mar 2026 21:44:00 +0000
Subject: [PATCH] chore: regenerate rules/dist from individual files

---
 rules/dist/gather-rules.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rules/dist/gather-rules.json b/rules/dist/gather-rules.json
index 61dbbcc8..69964189 100644
--- a/rules/dist/gather-rules.json
+++ b/rules/dist/gather-rules.json
@@ -202,7 +202,8 @@
       "enabled": true,
       "collectorType": "command_allowlisted",
       "target": "$c = Get-ChildItem Cert:\\LocalMachine\\My; if ($c) { $c | Select-Object Subject, Thumbprint, Issuer, NotBefore, NotAfter, HasPrivateKey | ConvertTo-Json } else { '{\"CertificateCount\": 0}' }",
-      "trigger": "startup",
+      "trigger": "phase_change",
+      "triggerPhase": "FinalizingSetup",
       "outputEventType": "gather_machine_cert_store",
       "outputSeverity": "Info",
       "tags": [