mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
e5cb3c4f5e
All 54 shipped analyze rules get role, summary, subject and key facts as
{{signal.key}} templates, each with a minor version bump so the self-seed
picks them up. Values were checked against stored findings, the rows that
receive the block at read time.
- ENRL-001 repeats the outcome only: the 0x87D1041C paragraph and the
placeholder note are gone, labels read "ESP step that failed" / "ESP
error code", remediation is "Find the cause". This changes its alert text.
- ENRL-002 says the sweep "closed" the session (it can end Incomplete).
- ID-002 and ID-004 gain evidence-only conditions (unexpected account
names; IME token failure count and codes); firing and confidence are
unchanged.
- Resolution: facts sharing a label are alternatives, an exact repeat of
label and value is left out (new shared fixture case, web module and
its generated MCP copy).
- Ratchet: every built-in presentation passes the save validator, uses
qualified tokens only, and each token names a condition of the rule and
a key its source records (RuleTemplateInterpolator.TokenRegex internal).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
90 lines
2.6 KiB
JSON
90 lines
2.6 KiB
JSON
{
|
|
"$schema": "../schema/analyze-rule.schema.json",
|
|
"ruleId": "ANALYZE-DEV-002",
|
|
"title": "Sustained High Memory Usage During Enrollment",
|
|
"description": "Detects when memory usage stays above 90% across at least 3 performance snapshots during enrollment, indicating sustained memory pressure that can cause app installation failures or system instability.",
|
|
"severity": "warning",
|
|
"category": "device",
|
|
"version": "2.2.0",
|
|
"enabled": true,
|
|
"evaluateOn": [
|
|
"enrollment_end",
|
|
"whiteglove_sealed"
|
|
],
|
|
"baseConfidence": 55,
|
|
"conditions": [
|
|
{
|
|
"signal": "sustained_high_memory",
|
|
"source": "event_count",
|
|
"eventType": "performance_snapshot",
|
|
"operator": "count_gte",
|
|
"value": "3",
|
|
"filterField": "memory_used_percent",
|
|
"filterOperator": "gt",
|
|
"filterValue": "90",
|
|
"required": true
|
|
},
|
|
{
|
|
"signal": "app_failed",
|
|
"source": "event_type",
|
|
"eventType": "app_install_failed",
|
|
"operator": "exists",
|
|
"value": "",
|
|
"required": false
|
|
},
|
|
{
|
|
"signal": "enrollment_failed",
|
|
"source": "event_type",
|
|
"eventType": "enrollment_failed",
|
|
"operator": "exists",
|
|
"value": "",
|
|
"required": false
|
|
}
|
|
],
|
|
"confidenceFactors": [
|
|
{
|
|
"signal": "app_failed",
|
|
"condition": "exists",
|
|
"weight": 20
|
|
},
|
|
{
|
|
"signal": "enrollment_failed",
|
|
"condition": "exists",
|
|
"weight": 15
|
|
}
|
|
],
|
|
"explanation": "Memory usage exceeded 90% in at least 3 performance snapshots during this enrollment — sustained pressure, not a single transient spike. Persistent high memory usage can cause app installation failures, system slowdowns, and ESP timeouts, especially on devices with 8 GB RAM installing several apps concurrently.",
|
|
"remediation": [
|
|
{
|
|
"title": "Reduce memory pressure",
|
|
"steps": [
|
|
"Review which apps are being installed concurrently during ESP",
|
|
"Consider staggering resource-heavy installations",
|
|
"Check minimum RAM requirements for the device (8 GB recommended)",
|
|
"Investigate if background services are consuming excessive memory"
|
|
]
|
|
}
|
|
],
|
|
"presentation": {
|
|
"role": "context",
|
|
"summary": "Memory use was above 90% in {{sustained_high_memory.count}} snapshots",
|
|
"subject": {
|
|
"kind": "device",
|
|
"key": "memory",
|
|
"name": "Memory"
|
|
},
|
|
"facts": [
|
|
{
|
|
"label": "Snapshots above 90%",
|
|
"value": "{{sustained_high_memory.count}}",
|
|
"format": "number"
|
|
}
|
|
]
|
|
},
|
|
"tags": [
|
|
"device",
|
|
"memory",
|
|
"performance"
|
|
]
|
|
}
|