{
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "HS-RUN-CONTEXT",
  "category": "always",
  "pattern": "\\[HS\\] The policy needs be run as (?<context>System|User)",
  "action": "scriptContext",
  "parameters": { "scriptType": "remediation" },
  "description": "Captures whether a remediation script runs as System or User context.",
  "enabled": true
}