mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 04:32:32 +00:00
e5cb3c4f5e
All 54 shipped analyze rules get role, summary, subject and key facts as
{{signal.key}} templates, each with a minor version bump so the self-seed
picks them up. Values were checked against stored findings, the rows that
receive the block at read time.
- ENRL-001 repeats the outcome only: the 0x87D1041C paragraph and the
placeholder note are gone, labels read "ESP step that failed" / "ESP
error code", remediation is "Find the cause". This changes its alert text.
- ENRL-002 says the sweep "closed" the session (it can end Incomplete).
- ID-002 and ID-004 gain evidence-only conditions (unexpected account
names; IME token failure count and codes); firing and confidence are
unchanged.
- Resolution: facts sharing a label are alternatives, an exact repeat of
label and value is left out (new shared fixture case, web module and
its generated MCP copy).
- Ratchet: every built-in presentation passes the save validator, uses
qualified tokens only, and each token names a condition of the rule and
a key its source records (RuleTemplateInterpolator.TokenRegex internal).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
111 lines
6.2 KiB
JSON
111 lines
6.2 KiB
JSON
{
|
|
"cases": [
|
|
{
|
|
"name": "summary, subject and facts resolve from qualified tokens",
|
|
"presentation": {
|
|
"role": "cause",
|
|
"summary": "{{install_retry_loop.appName}} was started {{install_retry_loop.count}} times",
|
|
"subject": { "kind": "app", "key": "{{install_retry_loop.groupKey}}", "name": "{{install_retry_loop.appName}}" },
|
|
"facts": [
|
|
{ "label": "Install starts", "value": "{{install_retry_loop.count}}", "format": "number" },
|
|
{ "label": "Threshold", "value": "{{install_retry_loop.threshold}}" }
|
|
]
|
|
},
|
|
"matchedConditions": {
|
|
"install_retry_loop": { "eventId": "evt-3", "groupKey": "00000000-0000-4000-8000-000000000002", "appName": "Contoso VPN", "count": 4, "threshold": 3 }
|
|
},
|
|
"explanation": "The same app was started 3 or more times.",
|
|
"expected": {
|
|
"role": "cause",
|
|
"summary": "Contoso VPN was started 4 times",
|
|
"subject": { "kind": "app", "key": "00000000-0000-4000-8000-000000000002", "name": "Contoso VPN" },
|
|
"facts": [
|
|
{ "label": "Install starts", "value": "4", "format": "number" },
|
|
{ "label": "Threshold", "value": "3", "format": "text" }
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"name": "a fact whose token was not recorded is left out, the order of the rest is kept",
|
|
"presentation": {
|
|
"role": "outcome",
|
|
"facts": [
|
|
{ "label": "Reason", "value": "{{reason}}", "format": "code" },
|
|
{ "label": "ESP step", "value": "{{esp_failure_subcategory.value}}" },
|
|
{ "label": "HRESULT", "value": "{{esp_failure_errorcode.value}}", "format": "errorCode" }
|
|
]
|
|
},
|
|
"matchedConditions": {
|
|
"enrollment_failed_reason": { "eventType": "enrollment_failed", "field": "reason", "value": "esp_terminal_failure" },
|
|
"esp_failure_errorcode": { "eventType": "esp_failure_settle_started", "field": "errorCode", "value": "0x80d03805" }
|
|
},
|
|
"explanation": "The Autopilot enrollment has explicitly failed.",
|
|
"expected": {
|
|
"role": "outcome",
|
|
"summary": "The Autopilot enrollment has explicitly failed.",
|
|
"subject": null,
|
|
"facts": [
|
|
{ "label": "Reason", "value": "esp_terminal_failure", "format": "code" },
|
|
{ "label": "HRESULT", "value": "0x80d03805", "format": "errorCode" }
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"name": "an empty value counts as not recorded",
|
|
"presentation": { "role": "cause", "facts": [ { "label": "Reason", "value": "{{reason}}" }, { "label": "Note", "value": " {{note.value}} " } ] },
|
|
"matchedConditions": { "sig": { "field": "reason", "value": null }, "note": { "field": "other", "value": "" } },
|
|
"explanation": "",
|
|
"expected": { "role": "cause", "summary": null, "subject": null, "facts": [] }
|
|
},
|
|
{
|
|
"name": "summary falls back to the explanation's first sentence without markdown",
|
|
"presentation": { "role": "cause", "summary": "{{missing.count}} starts" },
|
|
"matchedConditions": { "failed_app": { "field": "appName", "value": "Contoso VPN" } },
|
|
"explanation": "App **{{appName}}** failed with `0x1`. The installer reported success.\n\nMore text.",
|
|
"expected": { "role": "cause", "summary": "App Contoso VPN failed with 0x1.", "subject": null, "facts": [] }
|
|
},
|
|
{
|
|
"name": "summary fallback skips a first sentence whose token was not recorded",
|
|
"presentation": { "role": "advisory" },
|
|
"matchedConditions": {},
|
|
"explanation": "- **Failure reason:** {{reason}}\n- next item",
|
|
"expected": { "role": "advisory", "summary": null, "subject": null, "facts": [] }
|
|
},
|
|
{
|
|
"name": "a subject whose key was not recorded is no subject; a missing name shows the key",
|
|
"presentation": { "role": "cause", "summary": "x", "subject": { "kind": "app", "key": "{{failed.appId}}" } },
|
|
"matchedConditions": { "failed": { "appId": "00000000-0000-4000-8000-000000000004" } },
|
|
"explanation": "",
|
|
"expected": { "role": "cause", "summary": "x", "subject": { "kind": "app", "key": "00000000-0000-4000-8000-000000000004", "name": "00000000-0000-4000-8000-000000000004" }, "facts": [] }
|
|
},
|
|
{
|
|
"name": "an unresolved subject key drops the subject",
|
|
"presentation": { "role": "cause", "summary": "x", "subject": { "kind": "app", "key": "{{failed.appId}}", "name": "{{failed.appName}}" } },
|
|
"matchedConditions": { "failed": { "appName": "Contoso VPN" } },
|
|
"explanation": "",
|
|
"expected": { "role": "cause", "summary": "x", "subject": null, "facts": [] }
|
|
},
|
|
{
|
|
"name": "an unknown fact format reads as text, a fact without a label is skipped",
|
|
"presentation": { "role": "context", "summary": "x", "facts": [ { "label": "Minutes", "value": "{{s.offsetMinutes}}", "format": "weird" }, { "label": "", "value": "{{s.direction}}" } ] },
|
|
"matchedConditions": { "s": { "offsetMinutes": 30.5, "direction": "behind" } },
|
|
"explanation": "",
|
|
"expected": { "role": "context", "summary": "x", "subject": null, "facts": [ { "label": "Minutes", "value": "30.5", "format": "text" } ] }
|
|
},
|
|
{
|
|
"name": "facts sharing a label are alternatives: a repeated label and value is left out, a different value stays",
|
|
"presentation": { "role": "cause", "summary": "x", "facts": [ { "label": "ESP error", "value": "{{on_failure.value}}", "format": "errorCode" }, { "label": "ESP error", "value": "{{on_advisory.value}}", "format": "errorCode" }, { "label": "Exit code", "value": "{{first.value}}" }, { "label": "Exit code", "value": "{{second.value}}" } ] },
|
|
"matchedConditions": { "on_failure": { "field": "errorCode", "value": "0x80180014" }, "on_advisory": { "field": "errorCode", "value": "0x80180014" }, "first": { "value": 1603 }, "second": { "value": 1618 } },
|
|
"explanation": "",
|
|
"expected": { "role": "cause", "summary": "x", "subject": null, "facts": [ { "label": "ESP error", "value": "0x80180014", "format": "errorCode" }, { "label": "Exit code", "value": "1603", "format": "text" }, { "label": "Exit code", "value": "1618", "format": "text" } ] }
|
|
},
|
|
{
|
|
"name": "no presentation resolves to nothing",
|
|
"presentation": null,
|
|
"matchedConditions": { "sig": { "field": "reason", "value": "x" } },
|
|
"explanation": "Text.",
|
|
"expected": null
|
|
}
|
|
]
|
|
}
|