mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 04:32:32 +00:00
Oliver Kieselbach
e5cb3c4f5e
All 54 shipped analyze rules get role, summary, subject and key facts as
{{signal.key}} templates, each with a minor version bump so the self-seed
picks them up. Values were checked against stored findings, the rows that
receive the block at read time.
- ENRL-001 repeats the outcome only: the 0x87D1041C paragraph and the
placeholder note are gone, labels read "ESP step that failed" / "ESP
error code", remediation is "Find the cause". This changes its alert text.
- ENRL-002 says the sweep "closed" the session (it can end Incomplete).
- ID-002 and ID-004 gain evidence-only conditions (unexpected account
names; IME token failure count and codes); firing and confidence are
unchanged.
- Resolution: facts sharing a label are alternatives, an exact repeat of
label and value is left out (new shared fixture case, web module and
its generated MCP copy).
- Ratchet: every built-in presentation passes the save validator, uses
qualified tokens only, and each token names a condition of the rule and
a key its source records (RuleTemplateInterpolator.TokenRegex internal).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
91 lines
4.5 KiB
JSON
91 lines
4.5 KiB
JSON
{
|
|
"$schema": "../schema/analyze-rule.schema.json",
|
|
"ruleId": "ANALYZE-NET-001",
|
|
"title": "Diagnostics Upload Blocked by Web Security Gateway",
|
|
"description": "Detects diagnostics package uploads that were answered by a security appliance's HTML block page instead of the Autopilot Monitor backend. A forward proxy / secure web gateway (SWG) with SSL inspection is intercepting the upload endpoint, so exactly the sessions where diagnostics matter most (OnFailure uploads) are the ones losing them.",
|
|
"severity": "warning",
|
|
"category": "network",
|
|
"version": "1.1.0",
|
|
"author": "Autopilot Monitor",
|
|
"enabled": true,
|
|
"baseConfidence": 75,
|
|
"conditions": [
|
|
{
|
|
"signal": "foreign_html_response",
|
|
"source": "event_data",
|
|
"eventType": "diagnostics_upload_failed",
|
|
"dataField": "errorCode",
|
|
"operator": "contains",
|
|
"value": "HTML platform error page",
|
|
"required": true
|
|
},
|
|
{
|
|
"signal": "security_gateway_marker",
|
|
"source": "event_data",
|
|
"eventType": "diagnostics_upload_failed",
|
|
"dataField": "errorCode",
|
|
"operator": "regex",
|
|
"value": "mcafee|skyhigh|zscaler|netskope|blue ?coat|proxysg|forcepoint|websense|palo ?alto|fortigate|fortiguard|sophos|watchguard|barracuda|iboss|umbrella|lightspeed|smoothwall|contentkeeper|web ?gateway|web ?filter|content ?filter|secure ?gateway",
|
|
"required": true
|
|
},
|
|
{
|
|
"signal": "http_403_block",
|
|
"source": "event_data",
|
|
"eventType": "diagnostics_upload_failed",
|
|
"dataField": "errorCode",
|
|
"operator": "contains",
|
|
"value": "403",
|
|
"required": false
|
|
}
|
|
],
|
|
"confidenceFactors": [
|
|
{
|
|
"signal": "http_403_block",
|
|
"condition": "exists",
|
|
"weight": 15
|
|
}
|
|
],
|
|
"confidenceThreshold": 70,
|
|
"explanation": "The agent collected a diagnostics package but the upload was answered with an **HTML block page from a web security gateway** instead of a response from the Autopilot Monitor backend — the event message names the product that served the page. A forward proxy / SWG with SSL inspection is intercepting HTTPS traffic from the enrollment network and blocking the upload endpoint.\n\nThe consequence is quietly painful: diagnostics upload is typically configured **OnFailure**, so the sessions that fail — the ones where the IME logs and diagnostics ZIP would explain the root cause — are exactly the sessions whose evidence never arrives. Enrollment telemetry itself may still flow (the agent often starts before the gateway's client enforcement does, or other endpoints are treated differently), which makes the gap easy to miss until a failure needs investigating.\n\nNote this rule only fires when the blocking page carries a recognizable security-product marker. A plain HTML error page without one usually means a stale or stopped endpoint instead — that is a different problem.",
|
|
"remediation": [
|
|
{
|
|
"title": "Exempt the upload endpoint in the web gateway",
|
|
"steps": [
|
|
"Identify the product from the block-page title quoted in this event's message (e.g. a Skyhigh/McAfee Web Gateway notification page)",
|
|
"In that gateway, add the Autopilot Monitor API host shown in the event message to the SSL-inspection bypass AND the URL allowlist for the enrollment network segment",
|
|
"Enrollment traffic often originates from a dedicated provisioning VLAN or from devices without the proxy client yet — make sure the exemption applies to that segment, not only to managed clients",
|
|
"If the gateway enforces per-user policy, remember ESP-phase traffic runs as SYSTEM/device before any user signs in — the exemption must cover unauthenticated device traffic"
|
|
]
|
|
},
|
|
{
|
|
"title": "Verify the fix",
|
|
"steps": [
|
|
"Re-run an enrollment (or wait for the next failed one) and confirm a diagnostics package appears on the session in the portal",
|
|
"Optionally set diagnostics upload to Always temporarily to validate the path without needing a failure"
|
|
]
|
|
}
|
|
],
|
|
"relatedDocs": [
|
|
{
|
|
"title": "Microsoft Learn: Windows Autopilot networking requirements",
|
|
"url": "https://learn.microsoft.com/en-us/autopilot/networking-requirements"
|
|
}
|
|
],
|
|
"presentation": {
|
|
"role": "advisory",
|
|
"summary": "A web security gateway blocked the diagnostics upload",
|
|
"subject": {
|
|
"kind": "network",
|
|
"key": "security-gateway",
|
|
"name": "Web security gateway"
|
|
}
|
|
},
|
|
"tags": [
|
|
"network",
|
|
"proxy",
|
|
"ssl-inspection",
|
|
"swg",
|
|
"diagnostics"
|
|
]
|
|
}
|