{
  "$schema": "../schema/ime-log-pattern.schema.json",
  "rules": [
    {
      "patternId": "HS-COMPLIANCE",
      "category": "always",
      "pattern": "\\[HS\\] the pre-remdiation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
      "action": "scriptCompleted",
      "parameters": {
        "scriptType": "remediation",
        "part": "detection"
      },
      "description": "Captures the detection compliance result for a remediation script. True = compliant (no remediation needed), False = non-compliant (remediation will run).",
      "enabled": true
    },
    {
      "patternId": "HS-EXITCODE",
      "category": "always",
      "pattern": "\\[HS\\] exit code of the script is (?<exitCode>-?\\d+)",
      "action": "scriptExitCode",
      "parameters": {
        "scriptType": "remediation"
      },
      "description": "Captures the exit code of a remediation script.",
      "enabled": true
    },
    {
      "patternId": "HS-RUN-CONTEXT",
      "category": "always",
      "pattern": "\\[HS\\] The policy needs be run as (?<context>System|User)",
      "action": "scriptContext",
      "parameters": {
        "scriptType": "remediation"
      },
      "description": "Captures whether a remediation script runs as System or User context.",
      "enabled": true
    },
    {
      "patternId": "HS-SCRIPT-START",
      "category": "always",
      "pattern": "\\[HS\\] ProcessScript PolicyId: (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) PolicyType: (?<policyType>\\d+)",
      "action": "scriptStarted",
      "parameters": {
        "scriptType": "remediation"
      },
      "description": "Detects when a Proactive Remediation (Health Script) starts processing. Captures PolicyId and PolicyType (6 = remediation).",
      "enabled": true
    },
    {
      "patternId": "HS-STDERR",
      "category": "always",
      "pattern": "\\[HS\\] err output = (?<output>.*)",
      "action": "scriptOutput",
      "parameters": {
        "scriptType": "remediation",
        "outputType": "stderr"
      },
      "description": "Captures standard error output (stderr) from a remediation script execution.",
      "enabled": true
    },
    {
      "patternId": "HS-STDOUT",
      "category": "always",
      "pattern": "\\[HS\\] std output = (?<output>.*)",
      "action": "scriptOutput",
      "parameters": {
        "scriptType": "remediation",
        "outputType": "stdout"
      },
      "description": "Captures standard output (stdout) from a remediation script execution.",
      "enabled": true
    },
    {
      "patternId": "IME-AGENT-VERSION",
      "category": "always",
      "pattern": "Agent version is: (?<agentVersion>[\\d.]+)",
      "action": "imeAgentVersion",
      "description": "Captures the Intune Management Extension agent version number.",
      "enabled": true
    },
    {
      "patternId": "IME-ALREADY-DETECTED-1",
      "category": "otherPhases",
      "pattern": "\\[Win32App\\] Completed detectionManager SideCar\\w+?DetectionManager, applicationDetectedByCurrentRule: True",
      "action": "ignoreCompletedApp",
      "description": "Detects when an app from a previous ESP phase is detected as already installed, so it should be ignored in the current phase.",
      "enabled": true
    },
    {
      "patternId": "IME-ALREADY-DETECTED-2",
      "category": "otherPhases",
      "pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
      "action": "ignoreCompletedApp",
      "description": "Detects enforcement success in a non-current phase, indicating an app completed in a previous phase should be ignored.",
      "enabled": true
    },
    {
      "patternId": "IME-DECRYPT-FAILED",
      "category": "currentPhase",
      "pattern": "Decryption is failed for appId {GUID}",
      "action": "updateStateError",
      "description": "Detects when app content decryption fails, indicating a corrupted or tampered download.",
      "enabled": true
    },
    {
      "patternId": "IME-DETECTED-INSTALLED-1",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DetectionState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"Installed\"\"",
      "action": "updateStateInstalled",
      "description": "Detects when an app's detection state transitions to Installed (new ReportingManager format).",
      "enabled": true
    },
    {
      "patternId": "IME-DETECTED-INSTALLED-2",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: {GUID} resulted in action status: Success and detection state: Detected",
      "action": "updateStateInstalled",
      "description": "Detects when an app's detection action handler reports successful detection (app is installed).",
      "enabled": true
    },
    {
      "patternId": "IME-DETECTED-OLD",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Detected app {GUID} ",
      "action": "updateStateInstalled",
      "description": "Detects when an app is detected as installed (old log format).",
      "enabled": true
    },
    {
      "patternId": "IME-DO-TEL",
      "category": "currentPhase",
      "pattern": "\\[DO TEL\\] = (?<doTelJson>\\{.*\\})",
      "action": "updateDoTelemetry",
      "description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration.",
      "enabled": true
    },
    {
      "patternId": "IME-DO-TIMEOUT-1",
      "category": "currentPhase",
      "pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b).*?intunewin-bin_{GUID}",
      "action": "updateStatePostponed",
      "description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in filename).",
      "enabled": true
    },
    {
      "patternId": "IME-DO-TIMEOUT-2",
      "category": "currentPhase",
      "pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b)",
      "action": "updateStatePostponed",
      "parameters": {
        "useCurrentApp": "true"
      },
      "description": "Detects when a Delivery Optimization download times out (generic, uses current app context).",
      "enabled": true
    },
    {
      "patternId": "IME-DOWNLOADING",
      "category": "currentPhase",
      "pattern": "\\[StatusService\\] Downloading app \\(id = {GUID}.*?\\) via (?<tech>\\w+), bytes (?<bytes>\\w+)/(?<ofbytes>\\w+) for user",
      "action": "updateStateDownloading",
      "description": "Captures app download progress including technology (DO/CDN), bytes downloaded, and total bytes.",
      "enabled": true
    },
    {
      "patternId": "IME-ENFORCEMENT-SUCCESS",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"InProgressDownloadCompleted\"\",\"\"NewValue\"\":\"\"Success\"\"",
      "action": "updateStateInstalled",
      "description": "Detects when an app's enforcement state transitions from InProgressDownloadCompleted to Success.",
      "enabled": true
    },
    {
      "patternId": "IME-ENFORCEMENT-SUCCESS-OLD",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
      "action": "updateStateInstalled",
      "parameters": {
        "useCurrentApp": "true"
      },
      "description": "Detects when enforcement state is set to Success for the current app (old log format).",
      "enabled": true
    },
    {
      "patternId": "IME-ERROR-DOWNLOAD",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Download state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"InProgress\"\",\"\"NewValue\"\":\"\"ErrorDownloadingContent\"\"",
      "action": "updateStateError",
      "description": "Detects when an app's enforcement state transitions to ErrorDownloadingContent.",
      "enabled": true
    },
    {
      "patternId": "IME-ERROR-ENFORCEMENT",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Setting enforcementState as\\W+Error\\b",
      "action": "updateStateError",
      "parameters": {
        "useCurrentApp": "true"
      },
      "description": "Detects when enforcement state is set to Error for the current app (old log format).",
      "enabled": true
    },
    {
      "patternId": "IME-ERROR-NO-CONTENT",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Didn't get content info from service",
      "action": "updateStateError",
      "parameters": {
        "useCurrentApp": "true"
      },
      "description": "Detects when IME cannot retrieve content info from the Intune service for the current app.",
      "enabled": true
    },
    {
      "patternId": "IME-ERROR-REPORT",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"(?<from>\\w+)\"\",\"\"NewValue\"\":\"\"(?<to>\\w+)\"\"",
      "action": "updateStateError",
      "parameters": {
        "checkTo": "true"
      },
      "description": "Captures enforcement state transitions via ReportingManager. Only triggers error when 'to' value indicates an error state.",
      "enabled": true
    },
    {
      "patternId": "IME-ERROR-TIMEOUT",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Installation is timeout",
      "action": "updateStateError",
      "parameters": {
        "useCurrentApp": "true"
      },
      "description": "Detects when an app installation times out.",
      "enabled": true
    },
    {
      "patternId": "IME-ERROR-UNMAPPED-EXIT",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Admin did NOT set mapping for lpExitCode\\W+\\d+ of app\\W+{GUID}",
      "action": "updateStateError",
      "description": "Detects when an app installer returned an exit code that has no mapping configured in Intune.",
      "enabled": true
    },
    {
      "patternId": "IME-ESP-PHASE",
      "category": "always",
      "pattern": "\\[Win32App\\] (?:In|The) EspPhase: (?<espPhase>\\w+)",
      "action": "espPhaseDetected",
      "description": "Detects ESP phase transitions reported by IME Win32App processing (e.g., DeviceSetup, AccountSetup).",
      "enabled": true
    },
    {
      "patternId": "IME-ESP-TRACK-STATUS",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}\\.",
      "action": "espTrackStatus",
      "description": "Captures ESP tracked install status transitions (e.g., InProgress to Installed) for a specific app.",
      "enabled": true
    },
    {
      "patternId": "IME-IMPERSONATION",
      "category": "always",
      "pattern": "After impersonation: (?<user>.*?)$",
      "action": "imeImpersonation",
      "description": "Detects when IME impersonates a user context for app installation.",
      "enabled": true
    },
    {
      "patternId": "IME-INSTALL-HANDLER",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[ExecutionActionHandler\\] Handler invoked with execution type: Install for policy with id: {GUID}",
      "action": "updateStateInstalling",
      "description": "Detects when the IME execution handler starts installing an app.",
      "enabled": true
    },
    {
      "patternId": "IME-LAUNCH-INSTALLER",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Launch Win32AppInstaller in \\w+? session",
      "action": "updateStateInstalling",
      "parameters": {
        "useCurrentApp": "true"
      },
      "description": "Detects when the Win32 app installer process is launched in a user or system session.",
      "enabled": true
    },
    {
      "patternId": "IME-NO-ACTION",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[ActionProcessor\\] No action required for app with id: {GUID}",
      "action": "updateStateSkipped",
      "description": "Detects when IME determines no action is required for an app (already in desired state).",
      "enabled": true
    },
    {
      "patternId": "IME-NOT-APPLICABLE-1",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[ApplicabilityActionHandler\\] Applicability check for policy with id: {GUID} resulted in action status: Success and applicability state: NotApplicable",
      "action": "updateStateSkipped",
      "description": "Detects when an app's applicability check returns NotApplicable (requirements not met).",
      "enabled": true
    },
    {
      "patternId": "IME-NOT-APPLICABLE-2",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Applicability state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"ApplicabilityState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"ScriptRequirementRuleNotMet\"\"",
      "action": "updateStateSkipped",
      "description": "Detects when an app's applicability state is set to ScriptRequirementRuleNotMet (PowerShell requirement script returned false).",
      "enabled": true
    },
    {
      "patternId": "IME-NOT-APPLICABLE-3",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DesiredState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"None\"\"",
      "action": "updateStateSkipped",
      "description": "Detects when an app's desired state is set to None (not targeted or not applicable).",
      "enabled": true
    },
    {
      "patternId": "IME-NOT-APPLICABLE-4",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DesiredState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"NotPresent\"\"",
      "action": "updateStateSkipped",
      "description": "Detects when an app's desired state is set to NotPresent (targeted for uninstall or not required).",
      "enabled": true
    },
    {
      "patternId": "IME-NOT-TARGETED-1",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, targeted intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
      "action": "updateStateSkipped",
      "description": "Detects when an app with RequiredInstall intent is classified as NotApplicableOrNotTargeted (new log format).",
      "enabled": true
    },
    {
      "patternId": "IME-NOT-TARGETED-2",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, effective intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
      "action": "updateStateSkipped",
      "description": "Detects when an app with effective RequiredInstall intent is classified as NotApplicableOrNotTargeted.",
      "enabled": true
    },
    {
      "patternId": "IME-POLICIES",
      "category": "currentPhase",
      "pattern": "Get policies =\\s*(?<policies>.*)",
      "action": "policiesDiscovered",
      "description": "Captures the JSON policies list discovered by IME, used to build the app inventory.",
      "enabled": true
    },
    {
      "patternId": "IME-SESSION-CHANGE",
      "category": "always",
      "pattern": "OnSessionChange:? (?<change>.*?)$",
      "action": "imeSessionChange",
      "description": "Detects Windows session change events (logon, logoff, lock, unlock) reported by IME.",
      "enabled": true
    },
    {
      "patternId": "IME-SET-CURRENT-1",
      "category": "always",
      "pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name",
      "action": "setCurrentApp",
      "description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app.",
      "enabled": true
    },
    {
      "patternId": "IME-SET-CURRENT-2",
      "category": "always",
      "pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?\\bid\\W+{GUID}",
      "action": "setCurrentApp",
      "description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current.",
      "enabled": true
    },
    {
      "patternId": "IME-SET-CURRENT-3",
      "category": "always",
      "pattern": "\\[Win32App\\] ===Step=== Start to Present app {GUID}",
      "action": "setCurrentApp",
      "description": "Detects the start of app presentation step in IME, setting the app as current.",
      "enabled": true
    },
    {
      "patternId": "IME-SET-CURRENT-4",
      "category": "always",
      "pattern": "\\[Win32App\\] SetCurrentDirectory:.*?\\\\{GUID}_\\d+",
      "action": "setCurrentApp",
      "description": "Detects when IME sets the working directory for an app's staging folder, setting it as current.",
      "enabled": true
    },
    {
      "patternId": "IME-SHUTDOWN",
      "category": "currentPhase",
      "pattern": "EMS Agent received shutdown signal",
      "action": "updateStatePostponed",
      "parameters": {
        "useCurrentApp": "true"
      },
      "description": "Detects when the IME agent receives a shutdown signal, postponing the current app installation.",
      "enabled": true
    },
    {
      "patternId": "IME-SKIP-APPLICABILITY-NOTMET",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] (?=.*?\\bapplicability\\b)(?=.*?NotMet\\b).*?\\bapp\\W+{GUID}\\b",
      "action": "updateStateSkipped",
      "description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads).",
      "enabled": true
    },
    {
      "patternId": "IME-SKIP-DEPENDENCY-DETECT",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] app\\W+{GUID}\\b.*?\\bis a dependency\\b.*?\\bDetect Only mode\\b.*?\\bfinished processing",
      "action": "updateStateSkipped",
      "description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed).",
      "enabled": true
    },
    {
      "patternId": "IME-SKIP-DETECTED",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Detected app {GUID}.*?skip next step",
      "action": "updateStateSkipped",
      "description": "Detects when an already-detected app is skipped for further processing steps (old log format).",
      "enabled": true
    },
    {
      "patternId": "IME-SKIP-FILTERS",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[V3Processor\\] All apps in the subgraph are not applicable due to assignment filters\\. Skipping processing\\.",
      "action": "updateStateSkipped",
      "parameters": {
        "useCurrentApp": "true"
      },
      "description": "Detects when all apps in a subgraph are skipped due to assignment filter exclusions.",
      "enabled": true
    },
    {
      "patternId": "IME-SKIP-INSTALL-DETECTED",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Detected app {GUID} and intent is to install, skip applicability check",
      "action": "updateStateSkipped",
      "description": "Detects when an app targeted for install is already detected/installed, so the install is skipped (old log format).",
      "enabled": true
    },
    {
      "patternId": "IME-SKIP-UNINSTALL-NOTDETECTED",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Not detected app {GUID} and intent is to un-install, skip applicability check",
      "action": "updateStateSkipped",
      "description": "Detects when an app targeted for uninstall is not detected, so the uninstall is skipped (old log format).",
      "enabled": true
    },
    {
      "patternId": "IME-SKIP-UNINSTALL-NOTDETECTED-2",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] NOT detected app {GUID}.*?skip un-installation",
      "action": "updateStateSkipped",
      "description": "Detects when an app is not detected and uninstall is skipped (alternate old log format).",
      "enabled": true
    },
    {
      "patternId": "IME-STARTED",
      "category": "always",
      "pattern": "EMS Agent Started",
      "action": "imeStarted",
      "description": "Detects when the Intune Management Extension (IME) agent starts up.",
      "enabled": true
    },
    {
      "patternId": "IME-SUBGRAPH",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\]\\[V3Processor\\] Processing subgraph with app ids: {GUID}",
      "action": "cancelStuckAndSetCurrent",
      "description": "Detects when V3Processor starts a new subgraph, cancelling any stuck app and setting the new app as current.",
      "enabled": true
    },
    {
      "patternId": "IME-TOKEN-SUCCESS",
      "category": "always",
      "pattern": "Successfully get the token",
      "action": "espPhaseDetected",
      "parameters": {
        "phase": "AccountSetup"
      },
      "description": "Detects successful token acquisition, indicating the AccountSetup ESP phase has started.",
      "enabled": true
    },
    {
      "patternId": "IME-UPDATE-NAME-1",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?name\\W+(?<name>.*?)\\W+id\\W+{GUID}",
      "action": "updateName",
      "description": "Captures the app name from ExecManager processing log (old format: name before id).",
      "enabled": true
    },
    {
      "patternId": "IME-UPDATE-NAME-2",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name (?<name>.*?)$",
      "action": "updateName",
      "description": "Captures the app name from ProcessAppWithDependencies log entry.",
      "enabled": true
    },
    {
      "patternId": "IME-UPDATE-NAME-3",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Processing app \\(id={GUID}, name = (?<name>.*?)\\)",
      "action": "updateName",
      "description": "Captures the app name from the Processing app log entry.",
      "enabled": true
    },
    {
      "patternId": "IME-USER-SESSION-COMPLETED",
      "category": "always",
      "pattern": "\\[Win32App\\] \\.+ Completed user session \\d+, userId: (?<userId>[a-f0-9\\-]+), userSID: (?<userSid>S-[\\d\\-]+) \\.+",
      "action": "enrollmentCompleted",
      "description": "Detects when IME completes a user session, indicating enrollment has finished for that user.",
      "enabled": true
    },
    {
      "patternId": "IME-WIN32-STATE-1",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Got InstanceID: Win32App_{GUID}_\\d+, installationStateString: (?<state>\\d)",
      "action": "updateWin32AppState",
      "description": "Captures the Win32 app installation state string from instance ID tracking (old log format).",
      "enabled": true
    },
    {
      "patternId": "IME-WIN32-STATE-2",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] (?:Got|Set) (?:ESP )?win32App state (?<state>\\w+) for {GUID}",
      "action": "updateWin32AppState",
      "description": "Captures the Win32 app ESP state (e.g., Installed, InProgress) for a specific app.",
      "enabled": true
    },
    {
      "patternId": "IME-WINGET-INSTALLING-1",
      "category": "currentPhase",
      "pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID} and user = .*?- Operation Phase = Installing",
      "action": "updateStateInstalling",
      "description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 1).",
      "enabled": true
    },
    {
      "patternId": "IME-WINGET-INSTALLING-2",
      "category": "currentPhase",
      "pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID}.*?- Operation Phase = Installing",
      "action": "updateStateInstalling",
      "description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 2).",
      "enabled": true
    },
    {
      "patternId": "PS-AGENT-ERROR",
      "category": "always",
      "pattern": "error from script =(?<output>.*)",
      "action": "scriptOutput",
      "parameters": {
        "scriptType": "platform",
        "outputType": "stderr"
      },
      "description": "Captures error output from AgentExecutor.log when a platform script produces stderr content.",
      "enabled": true
    },
    {
      "patternId": "PS-AGENT-EXITCODE",
      "category": "always",
      "pattern": "Powershell exit code is (?<exitCode>-?\\d+)",
      "action": "scriptExitCode",
      "parameters": {
        "scriptType": "platform"
      },
      "description": "Captures the PowerShell exit code from AgentExecutor.log.",
      "enabled": true
    },
    {
      "patternId": "PS-AGENT-OUTPUT",
      "category": "always",
      "pattern": "write output done\\. output = (?<output>.*), error = (?<error>.*)",
      "action": "scriptOutput",
      "parameters": {
        "scriptType": "platform"
      },
      "description": "Captures both stdout and stderr from AgentExecutor.log when a platform script completes. The output group contains stdout, the error group contains stderr.",
      "enabled": true
    },
    {
      "patternId": "PS-AGENT-SCRIPT-START",
      "category": "always",
      "pattern": "Adding argument powershell with value C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1",
      "action": "scriptStarted",
      "parameters": {
        "scriptType": "platform",
        "source": "agentexecutor"
      },
      "description": "Detects platform script identification in AgentExecutor.log. Captures PolicyId from the script file path for stdout/stderr correlation.",
      "enabled": true
    },
    {
      "patternId": "PS-SCRIPT-CONTEXT",
      "category": "always",
      "pattern": "Launch powershell executor in (?<context>machine|user) session",
      "action": "scriptContext",
      "description": "Captures whether a PowerShell script runs in machine (System) or user session context.",
      "enabled": true
    },
    {
      "patternId": "PS-SCRIPT-EXITCODE",
      "category": "always",
      "pattern": "Powershell execution is done, exitCode = (?<exitCode>-?\\d+)",
      "action": "scriptExitCode",
      "description": "Captures the PowerShell exit code when script execution completes in the IME log.",
      "enabled": true
    },
    {
      "patternId": "PS-SCRIPT-GENERATED",
      "category": "always",
      "pattern": "Script file C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1 is generated",
      "action": "scriptStarted",
      "parameters": {
        "scriptType": "platform"
      },
      "description": "Detects when a platform PowerShell script file is generated by IME. Captures the PolicyId from the script file path.",
      "enabled": true
    },
    {
      "patternId": "PS-SCRIPT-RESULT",
      "category": "always",
      "pattern": "\\[PowerShell\\] User Id = [a-z0-9\\-]+, Policy id = (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}), policy result = (?<result>\\w+)",
      "action": "scriptCompleted",
      "parameters": {
        "scriptType": "platform"
      },
      "description": "Captures the final result (Success/Failed) of a platform PowerShell script execution with its PolicyId.",
      "enabled": true
    }
  ]
}