mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
e5cb3c4f5e
All 54 shipped analyze rules get role, summary, subject and key facts as
{{signal.key}} templates, each with a minor version bump so the self-seed
picks them up. Values were checked against stored findings, the rows that
receive the block at read time.
- ENRL-001 repeats the outcome only: the 0x87D1041C paragraph and the
placeholder note are gone, labels read "ESP step that failed" / "ESP
error code", remediation is "Find the cause". This changes its alert text.
- ENRL-002 says the sweep "closed" the session (it can end Incomplete).
- ID-002 and ID-004 gain evidence-only conditions (unexpected account
names; IME token failure count and codes); firing and confidence are
unchanged.
- Resolution: facts sharing a label are alternatives, an exact repeat of
label and value is left out (new shared fixture case, web module and
its generated MCP copy).
- Ratchet: every built-in presentation passes the save validator, uses
qualified tokens only, and each token names a condition of the rule and
a key its source records (RuleTemplateInterpolator.TokenRegex internal).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
70 lines
3.0 KiB
JSON
70 lines
3.0 KiB
JSON
{
|
|
"$schema": "../schema/analyze-rule.schema.json",
|
|
"ruleId": "ANALYZE-DEV-009",
|
|
"title": "Battery Critically Low During Enrollment",
|
|
"description": "Detects that the device's battery dropped to 15% or less while enrolling on battery power (power_state_change threshold event from the agent's live power watcher). A device dying mid-enrollment leaves a half-provisioned state that typically needs a full reset; this rule surfaces the risk while there is still time to plug the device in. Uses a single required condition on the agent-stamped thresholdPercent field (the data field 'transition' on the event is unrelated to this rule's 'trigger' property).",
|
|
"severity": "high",
|
|
"category": "device",
|
|
"version": "1.1.0",
|
|
"enabled": true,
|
|
"evaluateOn": [
|
|
"enrollment_end",
|
|
"whiteglove_sealed",
|
|
"on_event:power_state_change"
|
|
],
|
|
"trigger": "single",
|
|
"baseConfidence": 90,
|
|
"confidenceThreshold": 60,
|
|
"conditions": [
|
|
{
|
|
"signal": "battery_threshold_15",
|
|
"source": "event_data",
|
|
"eventType": "power_state_change",
|
|
"dataField": "thresholdPercent",
|
|
"operator": "equals",
|
|
"value": "15",
|
|
"required": true
|
|
}
|
|
],
|
|
"explanation": "The device's battery fell below **{{thresholdPercent}}%** while the enrollment was running on battery power. If the battery drains completely mid-enrollment, the device is left in a half-provisioned state — apps, policies, or the user profile may be incomplete, and in most cases the device has to be reset and re-enrolled. The agent detected the threshold crossing live via a Windows power-status notification; the exact percentage at that moment is recorded on the matched power_state_change event in the session timeline.",
|
|
"remediation": [
|
|
{
|
|
"title": "Secure power for the running enrollment",
|
|
"steps": [
|
|
"Connect the device to AC power immediately — the enrollment continues normally once power is stable.",
|
|
"If the device shut down before completing, check whether the session reached the desktop; if not, reset the device (Autopilot reset or reimage) and re-enroll it plugged in.",
|
|
"For technician/White Glove flows, make AC power part of the bench checklist — pre-provisioning on battery is the most common source of this alert.",
|
|
"If this fires across many devices of one model, review that model's battery health (the hardware_spec event carries design vs. full-charge capacity)."
|
|
]
|
|
}
|
|
],
|
|
"markSessionAsFailedDefault": false,
|
|
"presentation": {
|
|
"role": "context",
|
|
"summary": "The battery fell below {{battery_threshold_15.value}}% during setup",
|
|
"subject": {
|
|
"kind": "device",
|
|
"key": "power",
|
|
"name": "Power"
|
|
},
|
|
"facts": [
|
|
{
|
|
"label": "Battery below (%)",
|
|
"value": "{{battery_threshold_15.value}}",
|
|
"format": "number"
|
|
},
|
|
{
|
|
"label": "Reported",
|
|
"value": "{{battery_threshold_15.timestamp}}",
|
|
"format": "timestamp"
|
|
}
|
|
]
|
|
},
|
|
"tags": [
|
|
"device",
|
|
"power",
|
|
"battery",
|
|
"environment"
|
|
]
|
|
}
|