mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 04:32:32 +00:00
Oliver Kieselbach
e5cb3c4f5e
All 54 shipped analyze rules get role, summary, subject and key facts as
{{signal.key}} templates, each with a minor version bump so the self-seed
picks them up. Values were checked against stored findings, the rows that
receive the block at read time.
- ENRL-001 repeats the outcome only: the 0x87D1041C paragraph and the
placeholder note are gone, labels read "ESP step that failed" / "ESP
error code", remediation is "Find the cause". This changes its alert text.
- ENRL-002 says the sweep "closed" the session (it can end Incomplete).
- ID-002 and ID-004 gain evidence-only conditions (unexpected account
names; IME token failure count and codes); firing and confidence are
unchanged.
- Resolution: facts sharing a label are alternatives, an exact repeat of
label and value is left out (new shared fixture case, web module and
its generated MCP copy).
- Ratchet: every built-in presentation passes the save validator, uses
qualified tokens only, and each token names a condition of the rule and
a key its source records (RuleTemplateInterpolator.TokenRegex internal).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
59 lines
1.6 KiB
JSON
59 lines
1.6 KiB
JSON
{
|
|
"$schema": "../schema/analyze-rule.schema.json",
|
|
"ruleId": "ANALYZE-APP-005",
|
|
"title": "Content Download Timeout",
|
|
"description": "Detects when app content download times out or fails.",
|
|
"severity": "high",
|
|
"category": "apps",
|
|
"enabled": true,
|
|
"evaluateOn": [
|
|
"enrollment_end",
|
|
"whiteglove_sealed"
|
|
],
|
|
"baseConfidence": 70,
|
|
"conditions": [
|
|
{
|
|
"signal": "download_timeout",
|
|
"source": "event_type",
|
|
"eventType": "app_install_failed",
|
|
"dataField": "errorPatternId",
|
|
"operator": "regex",
|
|
"value": "IME-DO-TIMEOUT|IME-ERROR-DOWNLOAD|IME-ERROR-NO-CONTENT",
|
|
"required": true
|
|
}
|
|
],
|
|
"explanation": "App content download timed out or failed. This is usually caused by network issues, proxy interference, or CDN problems. The IME log shows a Delivery Optimization timeout or download content error.",
|
|
"remediation": [
|
|
{
|
|
"title": "Improve download speed",
|
|
"steps": [
|
|
"Check network bandwidth",
|
|
"Verify proxy doesn't block *.delivery.mp.microsoft.com",
|
|
"Consider Delivery Optimization configuration"
|
|
]
|
|
}
|
|
],
|
|
"presentation": {
|
|
"role": "cause",
|
|
"summary": "The content download of {{download_timeout.appName}} timed out or failed",
|
|
"subject": {
|
|
"kind": "app",
|
|
"key": "{{download_timeout.appId}}",
|
|
"name": "{{download_timeout.appName}}"
|
|
},
|
|
"facts": [
|
|
{
|
|
"label": "Error",
|
|
"value": "{{download_timeout.errorCode}}",
|
|
"format": "errorCode"
|
|
}
|
|
]
|
|
},
|
|
"tags": [
|
|
"apps",
|
|
"download",
|
|
"timeout"
|
|
],
|
|
"version": "1.2.0"
|
|
}
|