From d295eea390eaac9d71b1cc84f71a686c8b3bd6a5 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Mon, 27 Apr 2026 21:55:05 +0200 Subject: [PATCH] fix(rules): align ANALYZE-APP-007 + SEC-001 with V2 emit + flat data lookup ANALYZE-APP-007: dataField errorCount -> failedApps. V1 emitted errorCount in app_tracking_summary; V2 emits failedApps. Pulling the rule to V2-naming removes the V1-compat alias debt from the agent. ANALYZE-SEC-001: drop the data. prefix from dataField. RuleEngine's GetDataFieldValue does flat dictionary lookup; the data. prefix matched nothing under V1 or V2. Both V1 and V2 emit uefiCA2023Status / uefiSecureBootEnabled at the root of Data, so the rule was a long-standing no-match. Regenerated rules/dist/analyze-rules.json from the source files via rules/scripts/combine.js. Co-Authored-By: Claude Opus 4.7 (1M context) --- rules/analyze/ANALYZE-APP-007.json | 2 +- rules/analyze/ANALYZE-SEC-001.json | 6 +++--- rules/dist/analyze-rules.json | 8 ++++---- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/rules/analyze/ANALYZE-APP-007.json b/rules/analyze/ANALYZE-APP-007.json index b344cd3b..059bfe09 100644 --- a/rules/analyze/ANALYZE-APP-007.json +++ b/rules/analyze/ANALYZE-APP-007.json @@ -12,7 +12,7 @@ "signal": "summary_errors", "source": "event_type", "eventType": "app_tracking_summary", - "dataField": "errorCount", + "dataField": "failedApps", "operator": "gte", "value": "2", "required": true diff --git a/rules/analyze/ANALYZE-SEC-001.json b/rules/analyze/ANALYZE-SEC-001.json index 171f5eea..337fc83f 100644 --- a/rules/analyze/ANALYZE-SEC-001.json +++ b/rules/analyze/ANALYZE-SEC-001.json @@ -12,7 +12,7 @@ "signal": "ca2023_not_updated", "source": "event_data", "eventType": "secureboot_status", - "dataField": "data.uefiCA2023Status", + "dataField": "uefiCA2023Status", "operator": "not_equals", "value": "Updated", "required": true @@ -21,7 +21,7 @@ "signal": "secureboot_enabled", "source": "event_data", "eventType": "secureboot_status", - "dataField": "data.uefiSecureBootEnabled", + "dataField": "uefiSecureBootEnabled", "operator": "equals", "value": "true", "required": true @@ -31,7 +31,7 @@ { "signal": "ca2023_notfound", "condition": "equals:notfound", "weight": 20 }, { "signal": "ca2023_error", "condition": "exists", "weight": 10 } ], - "explanation": "This device has Secure Boot enabled but the **Windows UEFI CA 2023** certificate has not been deployed to the Secure Boot DB yet.\n\nThe original Windows UEFI CA 2011 certificates expire on **June 27, 2026**. After expiration, devices without the 2023 certificate will no longer receive Secure Boot security updates and may fail to boot with updated boot managers.\n\nCurrent UEFI CA 2023 status: `{{data.uefiCA2023Status}}`", + "explanation": "This device has Secure Boot enabled but the **Windows UEFI CA 2023** certificate has not been deployed to the Secure Boot DB yet.\n\nThe original Windows UEFI CA 2011 certificates expire on **June 27, 2026**. After expiration, devices without the 2023 certificate will no longer receive Secure Boot security updates and may fail to boot with updated boot managers.\n\nCurrent UEFI CA 2023 status: `{{uefiCA2023Status}}`", "remediation": [ { "title": "Deploy UEFI CA 2023 certificate", diff --git a/rules/dist/analyze-rules.json b/rules/dist/analyze-rules.json index ba7d6d93..d2eb26f7 100644 --- a/rules/dist/analyze-rules.json +++ b/rules/dist/analyze-rules.json @@ -254,7 +254,7 @@ "signal": "summary_errors", "source": "event_type", "eventType": "app_tracking_summary", - "dataField": "errorCount", + "dataField": "failedApps", "operator": "gte", "value": "2", "required": true @@ -1326,7 +1326,7 @@ "signal": "ca2023_not_updated", "source": "event_data", "eventType": "secureboot_status", - "dataField": "data.uefiCA2023Status", + "dataField": "uefiCA2023Status", "operator": "not_equals", "value": "Updated", "required": true @@ -1335,7 +1335,7 @@ "signal": "secureboot_enabled", "source": "event_data", "eventType": "secureboot_status", - "dataField": "data.uefiSecureBootEnabled", + "dataField": "uefiSecureBootEnabled", "operator": "equals", "value": "true", "required": true @@ -1353,7 +1353,7 @@ "weight": 10 } ], - "explanation": "This device has Secure Boot enabled but the **Windows UEFI CA 2023** certificate has not been deployed to the Secure Boot DB yet.\n\nThe original Windows UEFI CA 2011 certificates expire on **June 27, 2026**. After expiration, devices without the 2023 certificate will no longer receive Secure Boot security updates and may fail to boot with updated boot managers.\n\nCurrent UEFI CA 2023 status: `{{data.uefiCA2023Status}}`", + "explanation": "This device has Secure Boot enabled but the **Windows UEFI CA 2023** certificate has not been deployed to the Secure Boot DB yet.\n\nThe original Windows UEFI CA 2011 certificates expire on **June 27, 2026**. After expiration, devices without the 2023 certificate will no longer receive Secure Boot security updates and may fail to boot with updated boot managers.\n\nCurrent UEFI CA 2023 status: `{{uefiCA2023Status}}`", "remediation": [ { "title": "Deploy UEFI CA 2023 certificate",