mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 04:32:32 +00:00
Oliver Kieselbach
e5cb3c4f5e
All 54 shipped analyze rules get role, summary, subject and key facts as
{{signal.key}} templates, each with a minor version bump so the self-seed
picks them up. Values were checked against stored findings, the rows that
receive the block at read time.
- ENRL-001 repeats the outcome only: the 0x87D1041C paragraph and the
placeholder note are gone, labels read "ESP step that failed" / "ESP
error code", remediation is "Find the cause". This changes its alert text.
- ENRL-002 says the sweep "closed" the session (it can end Incomplete).
- ID-002 and ID-004 gain evidence-only conditions (unexpected account
names; IME token failure count and codes); firing and confidence are
unchanged.
- Resolution: facts sharing a label are alternatives, an exact repeat of
label and value is left out (new shared fixture case, web module and
its generated MCP copy).
- Ratchet: every built-in presentation passes the save validator, uses
qualified tokens only, and each token names a condition of the rule and
a key its source records (RuleTemplateInterpolator.TokenRegex internal).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
100 lines
3.2 KiB
JSON
100 lines
3.2 KiB
JSON
{
|
|
"$schema": "../schema/analyze-rule.schema.json",
|
|
"ruleId": "ANALYZE-DEV-006",
|
|
"title": "OS Build Changed During Enrollment",
|
|
"description": "Informational: the OS build (CurrentBuild.UBR) changed across a reboot during enrollment — an update was installed, regardless of which servicing path delivered it. Deterministic corroboration that works even when the Windows Update event channel shows nothing (registry comparison across restart cannot be lost to timing or logging-path differences).",
|
|
"severity": "info",
|
|
"category": "device",
|
|
"version": "1.2.0",
|
|
"enabled": true,
|
|
"evaluateOn": [
|
|
"enrollment_end",
|
|
"whiteglove_sealed"
|
|
],
|
|
"trigger": "single",
|
|
"baseConfidence": 70,
|
|
"confidenceThreshold": 50,
|
|
"conditions": [
|
|
{
|
|
"signal": "build_changed",
|
|
"source": "event_type",
|
|
"eventType": "os_build_changed",
|
|
"operator": "exists",
|
|
"value": "",
|
|
"required": true
|
|
},
|
|
{
|
|
"signal": "previous_build",
|
|
"source": "event_data",
|
|
"eventType": "os_build_changed",
|
|
"dataField": "previousBuild",
|
|
"operator": "exists",
|
|
"value": "",
|
|
"required": false
|
|
},
|
|
{
|
|
"signal": "current_build",
|
|
"source": "event_data",
|
|
"eventType": "os_build_changed",
|
|
"dataField": "currentBuild",
|
|
"operator": "exists",
|
|
"value": "",
|
|
"required": false
|
|
},
|
|
{
|
|
"signal": "wu_channel_blind",
|
|
"source": "event_type",
|
|
"eventType": "windows_update_channel_census",
|
|
"operator": "exists",
|
|
"value": "",
|
|
"required": false
|
|
}
|
|
],
|
|
"confidenceFactors": [
|
|
{
|
|
"signal": "wu_channel_blind",
|
|
"condition": "exists",
|
|
"weight": 10
|
|
}
|
|
],
|
|
"explanation": "The OS build changed from **{{previousBuild}}** to **{{currentBuild}}** across a reboot during enrollment — a Windows update was installed mid-provisioning. This is normal when quality updates run during OOBE, but it adds a reboot and extends enrollment time. If a windows_update_channel_census event is also present, the update installed via a servicing path the Windows Update watcher does not capture yet — its EventID histogram tells which IDs to enable.",
|
|
"remediation": [
|
|
{
|
|
"title": "Optional review",
|
|
"steps": [
|
|
"No action required — this is informational context for enrollment duration and reboot analysis.",
|
|
"Correlate the build jump with reboots and any behavior change after enrollment.",
|
|
"If quality updates during OOBE are not desired for this Autopilot profile, review the ESP 'Install quality updates during OOBE' setting."
|
|
]
|
|
}
|
|
],
|
|
"markSessionAsFailedDefault": false,
|
|
"presentation": {
|
|
"role": "context",
|
|
"summary": "Windows was updated from build {{previous_build.value}} to {{current_build.value}}",
|
|
"subject": {
|
|
"kind": "device",
|
|
"key": "os",
|
|
"name": "Windows version"
|
|
},
|
|
"facts": [
|
|
{
|
|
"label": "Build before",
|
|
"value": "{{previous_build.value}}",
|
|
"format": "code"
|
|
},
|
|
{
|
|
"label": "Build after",
|
|
"value": "{{current_build.value}}",
|
|
"format": "code"
|
|
}
|
|
]
|
|
},
|
|
"tags": [
|
|
"device",
|
|
"windows-update",
|
|
"oobe",
|
|
"reboot"
|
|
]
|
|
}
|