{
  "$schema": "../schema/gather-rule.schema.json",
  "rules": [
    {
      "ruleId": "GATHER-APPS-001",
      "title": "IME Logs directory check",
      "description": "Checks whether the Intune Management Extension log directory exists and reports file sizes. Useful to verify IME is active and logs are being written.",
      "category": "apps",
      "version": "1.0.0",
      "author": "Autopilot Monitor",
      "enabled": false,
      "collectorType": "file",
      "target": "C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
      "trigger": "startup",
      "outputEventType": "gather_ime_logs_directory",
      "outputSeverity": "Info",
      "tags": [
        "apps",
        "ime",
        "logs"
      ]
    },
    {
      "ruleId": "GATHER-DEVICE-001",
      "title": "Collect dsregcmd join status",
      "description": "Runs dsregcmd /status to capture the Azure AD / Entra join state when the device enters the Account Setup phase.",
      "category": "device",
      "version": "1.0.1",
      "author": "Autopilot Monitor",
      "enabled": false,
      "collectorType": "command_allowlisted",
      "target": "dsregcmd /status",
      "trigger": "phase_change",
      "triggerPhase": "AccountSetup",
      "outputEventType": "gather_dsregcmd_status",
      "outputSeverity": "Info",
      "tags": [
        "device",
        "entra",
        "join"
      ]
    },
    {
      "ruleId": "GATHER-DEVICE-002",
      "title": "Collect last system startup event",
      "description": "Collects the most recent Event ID 12 (Kernel-General) from the System log which indicates the last OS startup time.",
      "category": "device",
      "version": "1.0.0",
      "author": "Autopilot Monitor",
      "enabled": false,
      "collectorType": "eventlog",
      "target": "System",
      "parameters": {
        "eventId": "12",
        "source": "Microsoft-Windows-Kernel-General",
        "maxEntries": "1"
      },
      "trigger": "startup",
      "outputEventType": "gather_last_startup_event",
      "outputSeverity": "Info",
      "tags": [
        "device",
        "startup",
        "boot"
      ]
    },
    {
      "ruleId": "GATHER-DEVICE-003",
      "title": "BIOS information",
      "description": "Queries WMI for BIOS details including manufacturer, version, serial number, and release date. Helps correlate firmware-level issues with enrollment problems.",
      "category": "device",
      "version": "1.0.0",
      "author": "Autopilot Monitor",
      "enabled": false,
      "collectorType": "wmi",
      "target": "SELECT * FROM Win32_BIOS",
      "trigger": "startup",
      "outputEventType": "gather_bios_info",
      "outputSeverity": "Info",
      "tags": [
        "device",
        "bios",
        "hardware"
      ]
    },
    {
      "ruleId": "GATHER-DEVICE-004",
      "title": "Windows Update history snapshot",
      "description": "Lists recently installed hotfixes/updates (Get-HotFix) at agent startup as secondary corroboration of updates applied during enrollment. Complements the live WindowsUpdate watcher — catches updates whose events fell outside the watcher's backfill window. Opt-in: Get-HotFix spawns a PowerShell cmdlet and only reports QFE-registered updates (it misses some cumulative/driver updates and all failures), so enable per tenant after weighing the OOBE cost.",
      "category": "device",
      "version": "1.1.0",
      "author": "Autopilot Monitor",
      "enabled": false,
      "collectorType": "command_allowlisted",
      "target": "Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description",
      "trigger": "startup",
      "outputEventType": "windows_update_history",
      "outputSeverity": "Info",
      "tags": [
        "device",
        "windows-update",
        "hotfix",
        "oobe"
      ]
    },
    {
      "ruleId": "GATHER-DEVICE-005",
      "title": "Windows Update pending reboot",
      "description": "Checks the Component Based Servicing RebootPending registry key at agent startup and emits windows_update_reboot_pending ONLY when a reboot is actually pending (the key exists). A pending reboot present when the agent starts is a high-confidence corroborator that a Windows Update (often a quality/cumulative update installed during the OOBE 'Getting updates' phase, before the agent started) landed and now needs a restart — which can delay or block enrollment completion.",
      "category": "device",
      "version": "1.2.0",
      "author": "Autopilot Monitor",
      "enabled": true,
      "collectorType": "registry",
      "target": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing\\RebootPending",
      "parameters": {
        "emitOnlyIfExists": "true",
        "severityIfExists": "Warning"
      },
      "trigger": "startup",
      "outputEventType": "windows_update_reboot_pending",
      "outputSeverity": "Info",
      "tags": [
        "device",
        "windows-update",
        "reboot",
        "servicing",
        "oobe"
      ]
    },
    {
      "ruleId": "GATHER-DEVICE-006",
      "title": "Collect dsregcmd join status on pending user affinity",
      "description": "Runs dsregcmd /status the moment the agent reports that the signed-in user still has no Entra user token (entra_user_affinity_pending), capturing the device join and registration state at exactly the point where ANALYZE-ID-004 draws its evidence. Complements GATHER-DEVICE-001 (snapshot on entering Account Setup). Note: the agent runs as SYSTEM, so the output shows device join state — the per-user SSO/PRT state still requires running dsregcmd as the signed-in user.",
      "category": "device",
      "version": "1.1.0",
      "author": "Autopilot Monitor",
      "enabled": false,
      "collectorType": "command_allowlisted",
      "target": "dsregcmd /status",
      "trigger": "on_event",
      "triggerEventType": "entra_user_affinity_pending",
      "outputEventType": "gather_dsregcmd_status",
      "outputSeverity": "Info",
      "tags": [
        "device",
        "entra",
        "join",
        "hybrid"
      ]
    },
    {
      "ruleId": "GATHER-DEVICE-007",
      "title": "Collect Entra operational log on pending user affinity (event 1098)",
      "description": "Collects the most recent Entra token-broker operational events with ID 1098 from Microsoft-Windows-AAD/Operational the moment the agent reports that the signed-in user still has no Entra user token (entra_user_affinity_pending). Captures the OS-side token-broker record at exactly the point where ANALYZE-ID-004 draws its evidence. The event log collector filters on one event ID per rule; GATHER-DEVICE-008 collects event 1097 from the same channel.",
      "category": "device",
      "version": "1.0.0",
      "author": "Autopilot Monitor",
      "enabled": true,
      "collectorType": "eventlog",
      "target": "Microsoft-Windows-AAD/Operational",
      "parameters": {
        "eventId": "1098",
        "maxEntries": "20"
      },
      "trigger": "on_event",
      "triggerEventType": "entra_user_affinity_pending",
      "outputEventType": "gather_aad_operational_events",
      "outputSeverity": "Warning",
      "tags": [
        "device",
        "entra",
        "hybrid"
      ]
    },
    {
      "ruleId": "GATHER-DEVICE-008",
      "title": "Collect Entra operational log on pending user affinity (event 1097)",
      "description": "Collects the most recent Entra token-broker operational events with ID 1097 from Microsoft-Windows-AAD/Operational the moment the agent reports that the signed-in user still has no Entra user token (entra_user_affinity_pending). Captures the OS-side token-broker record at exactly the point where ANALYZE-ID-004 draws its evidence. The event log collector filters on one event ID per rule; GATHER-DEVICE-007 collects event 1098 from the same channel.",
      "category": "device",
      "version": "1.0.0",
      "author": "Autopilot Monitor",
      "enabled": true,
      "collectorType": "eventlog",
      "target": "Microsoft-Windows-AAD/Operational",
      "parameters": {
        "eventId": "1097",
        "maxEntries": "20"
      },
      "trigger": "on_event",
      "triggerEventType": "entra_user_affinity_pending",
      "outputEventType": "gather_aad_operational_events",
      "outputSeverity": "Warning",
      "tags": [
        "device",
        "entra",
        "hybrid"
      ]
    },
    {
      "ruleId": "GATHER-ENROLL-001",
      "title": "MDM enrollment diagnostic events",
      "description": "Collects recent events from the DeviceManagement Enterprise Diagnostics Provider at the FinalizingSetup phase. Captures MDM sync errors, policy application failures, and enrollment diagnostics accumulated throughout the session.",
      "category": "enrollment",
      "version": "1.0.0",
      "author": "Autopilot Monitor",
      "enabled": false,
      "collectorType": "eventlog",
      "target": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin",
      "parameters": {
        "maxEntries": "10"
      },
      "trigger": "phase_change",
      "triggerPhase": "FinalizingSetup",
      "outputEventType": "gather_mdm_enrollment_events",
      "outputSeverity": "Info",
      "tags": [
        "enrollment",
        "mdm",
        "diagnostics"
      ]
    },
    {
      "ruleId": "GATHER-ENROLL-002",
      "title": "Applied MDM device policies",
      "description": "Reads the PolicyManager registry key to list all MDM device policies that have been applied. Verifies that expected compliance and configuration policies landed on the device during enrollment.",
      "category": "enrollment",
      "version": "1.0.0",
      "author": "Autopilot Monitor",
      "enabled": false,
      "collectorType": "registry",
      "target": "HKLM\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device",
      "parameters": {
        "listSubkeys": "true"
      },
      "trigger": "phase_change",
      "triggerPhase": "FinalizingSetup",
      "outputEventType": "gather_mdm_device_policies",
      "outputSeverity": "Info",
      "tags": [
        "enrollment",
        "mdm",
        "policies",
        "compliance"
      ]
    },
    {
      "ruleId": "GATHER-ID-001",
      "title": "Machine certificates",
      "description": "Lists certificates in the local machine personal store (My). Verifies that the MDM enrollment certificate and any SCEP certificates have been provisioned.",
      "category": "identity",
      "version": "1.0.0",
      "author": "Autopilot Monitor",
      "enabled": false,
      "collectorType": "command_allowlisted",
      "target": "certutil -store My",
      "trigger": "startup",
      "outputEventType": "gather_machine_certificates",
      "outputSeverity": "Info",
      "tags": [
        "identity",
        "certificates",
        "scep"
      ]
    },
    {
      "ruleId": "GATHER-ID-002",
      "title": "Machine certificate store (PowerShell)",
      "description": "Enumerates certificates in the local machine personal store (Cert:\\LocalMachine\\My) using PowerShell. Returns structured JSON with subject, thumbprint, issuer, and validity dates for each certificate. Useful for verifying MDM enrollment certificates, SCEP certificates, and any other machine certificates provisioned during Autopilot enrollment.",
      "category": "identity",
      "version": "1.0.0",
      "author": "Community",
      "isCommunity": true,
      "enabled": true,
      "collectorType": "command_allowlisted",
      "target": "$c = Get-ChildItem Cert:\\LocalMachine\\My; if ($c) { $c | Select-Object Subject, Thumbprint, Issuer, NotBefore, NotAfter, HasPrivateKey | ConvertTo-Json } else { '{\"CertificateCount\": 0}' }",
      "trigger": "phase_change",
      "triggerPhase": "FinalizingSetup",
      "outputEventType": "gather_machine_cert_store",
      "outputSeverity": "Info",
      "tags": [
        "identity",
        "certificates",
        "machine-store",
        "powershell"
      ]
    }
  ]
}