gsadmin/AutopilotMonitor
1
0
Fork 0
mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 04:32:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(rules): align ANALYZE-APP-007 + SEC-001 with V2 emit + flat data lookup

Browse Source 
ANALYZE-APP-007: dataField errorCount -> failedApps. V1 emitted errorCount
in app_tracking_summary; V2 emits failedApps. Pulling the rule to V2-naming
removes the V1-compat alias debt from the agent.

ANALYZE-SEC-001: drop the data. prefix from dataField. RuleEngine's
GetDataFieldValue does flat dictionary lookup; the data. prefix matched
nothing under V1 or V2. Both V1 and V2 emit uefiCA2023Status /
uefiSecureBootEnabled at the root of Data, so the rule was a long-standing
no-match.

Regenerated rules/dist/analyze-rules.json from the source files via
rules/scripts/combine.js.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Oliver Kieselbach
2026-04-27 21:55:05 +02:00
parent 143829f902
commit d295eea390
3 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/analyze/ANALYZE-APP-007.json
+1 -1
View File
@@ -12,7 +12,7 @@
"signal": "summary_errors",
"source": "event_type",
"eventType": "app_tracking_summary",
"dataField": "errorCount",
"dataField": "failedApps",
"operator": "gte",
"value": "2",
"required": true
rules/analyze/ANALYZE-SEC-001.json
+3 -3
View File
@@ -12,7 +12,7 @@
"signal": "ca2023_not_updated",
"source": "event_data",
"eventType": "secureboot_status",
"dataField": "data.uefiCA2023Status",
"dataField": "uefiCA2023Status",
"operator": "not_equals",
"value": "Updated",
"required": true
@@ -21,7 +21,7 @@
"signal": "secureboot_enabled",
"source": "event_data",
"eventType": "secureboot_status",
"dataField": "data.uefiSecureBootEnabled",
"dataField": "uefiSecureBootEnabled",
"operator": "equals",
"value": "true",
"required": true
@@ -31,7 +31,7 @@
{ "signal": "ca2023_notfound", "condition": "equals:notfound", "weight": 20 },
{ "signal": "ca2023_error", "condition": "exists", "weight": 10 }
],
"explanation": "This device has Secure Boot enabled but the **Windows UEFI CA 2023** certificate has not been deployed to the Secure Boot DB yet.\n\nThe original Windows UEFI CA 2011 certificates expire on **June 27, 2026**. After expiration, devices without the 2023 certificate will no longer receive Secure Boot security updates and may fail to boot with updated boot managers.\n\nCurrent UEFI CA 2023 status: `{{data.uefiCA2023Status}}`",
"explanation": "This device has Secure Boot enabled but the **Windows UEFI CA 2023** certificate has not been deployed to the Secure Boot DB yet.\n\nThe original Windows UEFI CA 2011 certificates expire on **June 27, 2026**. After expiration, devices without the 2023 certificate will no longer receive Secure Boot security updates and may fail to boot with updated boot managers.\n\nCurrent UEFI CA 2023 status: `{{uefiCA2023Status}}`",
"remediation": [
{
"title": "Deploy UEFI CA 2023 certificate",
rules/dist/analyze-rules.json
Generated Vendored
+4 -4
View File
@@ -254,7 +254,7 @@
"signal": "summary_errors",
"source": "event_type",
"eventType": "app_tracking_summary",
"dataField": "errorCount",
"dataField": "failedApps",
"operator": "gte",
"value": "2",
"required": true
@@ -1326,7 +1326,7 @@
"signal": "ca2023_not_updated",
"source": "event_data",
"eventType": "secureboot_status",
"dataField": "data.uefiCA2023Status",
"dataField": "uefiCA2023Status",
"operator": "not_equals",
"value": "Updated",
"required": true
@@ -1335,7 +1335,7 @@
"signal": "secureboot_enabled",
"source": "event_data",
"eventType": "secureboot_status",
"dataField": "data.uefiSecureBootEnabled",
"dataField": "uefiSecureBootEnabled",
"operator": "equals",
"value": "true",
"required": true
@@ -1353,7 +1353,7 @@
"weight": 10
}
],
"explanation": "This device has Secure Boot enabled but the **Windows UEFI CA 2023** certificate has not been deployed to the Secure Boot DB yet.\n\nThe original Windows UEFI CA 2011 certificates expire on **June 27, 2026**. After expiration, devices without the 2023 certificate will no longer receive Secure Boot security updates and may fail to boot with updated boot managers.\n\nCurrent UEFI CA 2023 status: `{{data.uefiCA2023Status}}`",
"explanation": "This device has Secure Boot enabled but the **Windows UEFI CA 2023** certificate has not been deployed to the Secure Boot DB yet.\n\nThe original Windows UEFI CA 2011 certificates expire on **June 27, 2026**. After expiration, devices without the 2023 certificate will no longer receive Secure Boot security updates and may fail to boot with updated boot managers.\n\nCurrent UEFI CA 2023 status: `{{uefiCA2023Status}}`",
"remediation": [
{
"title": "Deploy UEFI CA 2023 certificate",