mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 04:32:32 +00:00
Oliver Kieselbach
e5cb3c4f5e
All 54 shipped analyze rules get role, summary, subject and key facts as
{{signal.key}} templates, each with a minor version bump so the self-seed
picks them up. Values were checked against stored findings, the rows that
receive the block at read time.
- ENRL-001 repeats the outcome only: the 0x87D1041C paragraph and the
placeholder note are gone, labels read "ESP step that failed" / "ESP
error code", remediation is "Find the cause". This changes its alert text.
- ENRL-002 says the sweep "closed" the session (it can end Incomplete).
- ID-002 and ID-004 gain evidence-only conditions (unexpected account
names; IME token failure count and codes); firing and confidence are
unchanged.
- Resolution: facts sharing a label are alternatives, an exact repeat of
label and value is left out (new shared fixture case, web module and
its generated MCP copy).
- Ratchet: every built-in presentation passes the save validator, uses
qualified tokens only, and each token names a condition of the rule and
a key its source records (RuleTemplateInterpolator.TokenRegex internal).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
86 lines
2.7 KiB
JSON
86 lines
2.7 KiB
JSON
{
|
|
"$schema": "../schema/analyze-rule.schema.json",
|
|
"ruleId": "ANALYZE-DEV-005",
|
|
"title": "Windows Update Installed During Enrollment",
|
|
"description": "Informational: a Windows quality/cumulative update installed during the OOBE / ESP enrollment window (WindowsUpdateClient EventID 19). Surfaces updates applied mid-enrollment — useful context when correlating enrollment duration, reboots, or later issues with a specific KB.",
|
|
"severity": "info",
|
|
"category": "device",
|
|
"version": "1.2.0",
|
|
"enabled": true,
|
|
"evaluateOn": [
|
|
"enrollment_end",
|
|
"whiteglove_sealed"
|
|
],
|
|
"trigger": "single",
|
|
"baseConfidence": 60,
|
|
"confidenceThreshold": 50,
|
|
"conditions": [
|
|
{
|
|
"signal": "wu_installed",
|
|
"source": "event_type",
|
|
"eventType": "windows_update_succeeded",
|
|
"operator": "exists",
|
|
"value": "",
|
|
"required": true
|
|
},
|
|
{
|
|
"signal": "wu_update_title",
|
|
"source": "event_data",
|
|
"eventType": "windows_update_succeeded",
|
|
"dataField": "updateTitle",
|
|
"operator": "exists",
|
|
"value": "",
|
|
"required": false
|
|
},
|
|
{
|
|
"signal": "reboot_pending",
|
|
"source": "event_data",
|
|
"eventType": "windows_update_reboot_pending",
|
|
"dataField": "exists",
|
|
"operator": "equals",
|
|
"value": "true",
|
|
"required": false
|
|
}
|
|
],
|
|
"confidenceFactors": [
|
|
{
|
|
"signal": "reboot_pending",
|
|
"condition": "exists",
|
|
"weight": 15
|
|
}
|
|
],
|
|
"explanation": "One or more Windows updates installed during enrollment (e.g. **{{updateTitle}}**). This is normal when Windows Update runs during OOBE, but it extends enrollment time and can trigger a reboot mid-ESP. Track it when correlating enrollment duration or reboot count with a specific cumulative update, or when a device behaves differently after a particular KB landed during provisioning.",
|
|
"remediation": [
|
|
{
|
|
"title": "Optional review",
|
|
"steps": [
|
|
"No action required for a successful install — this is informational.",
|
|
"If enrollment time or reboot count is a concern, review whether quality updates during OOBE are desired for your Autopilot profile.",
|
|
"Correlate the installed KB with any post-enrollment issues if the device behaves unexpectedly."
|
|
]
|
|
}
|
|
],
|
|
"markSessionAsFailedDefault": false,
|
|
"presentation": {
|
|
"role": "context",
|
|
"summary": "A Windows update installed during setup: {{wu_update_title.value}}",
|
|
"subject": {
|
|
"kind": "device",
|
|
"key": "windows-update",
|
|
"name": "Windows Update"
|
|
},
|
|
"facts": [
|
|
{
|
|
"label": "Installed",
|
|
"value": "{{wu_installed.timestamp}}",
|
|
"format": "timestamp"
|
|
}
|
|
]
|
|
},
|
|
"tags": [
|
|
"device",
|
|
"windows-update",
|
|
"oobe"
|
|
]
|
|
}
|