gsadmin/AutopilotMonitor
1
0
Fork 0
mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-25 13:10:13 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
0859c05f4a66d994b893e2e6dfa42eef533462ec
AutopilotMonitor/rules/dist/analyze-rules.json
T
Oliver Kieselbach db7ca6ed87 fix(rules): surface detection-failure root cause in analyze pipeline 
Session 080edee9 fired only ANALYZE-ENRL-001 ("Enrollment Failed") with a
generic explanation, even though we already had all the data to point at
the specific failed app (Microsoft Apps for Enterprise) and the specific
HRESULT (0x87D1041C - Intune detection rule mismatch). Three coordinated
rule changes close that enrichment gap:

ANALYZE-APP-001 (Win32 App Detection Script Failure):
  Switch from a regex on the `message` field (which never matched the
  agent's "Install status unconfirmed - ESP timed out" wording) to a
  direct check on `dataField: detectionResult, operator: equals,
  value: NotDetected`. The rule engine already supports nested DataJson
  fields on `event_type` conditions, so this is the right shape and the
  rule now fires whenever the IME reported a detection-rule mismatch.

ANALYZE-APP-013 (App Detection Failure During ESP - 0x87D1041C, new):
  Matches the canonical `failureType: esp_apps_detection_failure` tag
  emitted by the V2 agent's new classifier. Severity=critical, baseConf=90.
  Pulls failed appName + HRESULT into the explanation via the existing
  `{{token}}` interpolator, and ships a three-step remediation plan:
  (1) validate the detection rule against an installed reference device,
  (2) investigate post-install async tasks (the install may complete only
  after ESP's detection probe runs), (3) cross-check the per-app event's
  detectionResult + bytesDownloaded + hresultFromWin32.

ANALYZE-ENRL-001 (Enrollment Failed):
  Add optional conditions that capture {reason, failedSubcategory, errorCode,
  failedApp.appName} into MatchedConditions so the explanation can resolve
  `{{reason}}` / `{{failedSubcategory}}` / `{{errorCode}}` / `{{appName}}`
  via the existing `interpolateRuleTemplate` engine. Remediation text now
  cross-references ANALYZE-APP-* rules for the actionable root cause.

dist regenerated via `node rules/scripts/combine.js` (25 -> 26 rules).
Backend embeds dist/analyze-rules.json as a resource; next deploy picks up
the new content automatically.

Coverage: 2058/2058 backend tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-28 13:41:48 +02:00

1522 lines
59 KiB
JSON
Generated
Raw Blame History

{
"$schema": "../schema/analyze-rule.schema.json",
"rules": [
{
"ruleId": "ANALYZE-APP-001",
"title": "Win32 App Detection Script Failure",
"description": "Detects when a Win32 app detection script fails or returns unexpected results.",
"severity": "warning",
"category": "apps",
"enabled": true,
"baseConfidence": 60,
"conditions": [
{
"signal": "detection_failure",
"source": "event_type",
"eventType": "app_install_failed",
"dataField": "detectionResult",
"operator": "equals",
"value": "NotDetected",
"required": true
}
],
"confidenceFactors": [
{
"signal": "error_detail_match",
"condition": "exists",
"weight": 20
}
],
"explanation": "A Win32 app detection script failed or did not detect the app after installation. This causes the app to appear as 'not installed' despite successful installation.",
"remediation": [
{
"title": "Fix detection rules",
"steps": [
"Review the app's detection rules in Intune",
"Verify file/registry paths are correct",
"Test detection script manually on a device"
]
}
],
"tags": [
"apps",
"detection",
"win32"
]
},
{
"ruleId": "ANALYZE-APP-002",
"title": "App Installation Error",
"description": "Detects app installation failures with specific exit codes or HRESULT error codes and suggests fixes.",
"severity": "high",
"category": "apps",
"enabled": true,
"baseConfidence": 80,
"conditions": [
{
"signal": "install_error",
"source": "event_type",
"eventType": "app_install_failed",
"dataField": "message",
"operator": "regex",
"value": "16[0-9]{2}|0x80070[0-9a-fA-F]+|lpExitCode|unmapped.*exit",
"required": true,
"suppressByEvent": {
"eventType": "app_install_completed",
"joinField": "appId"
}
}
],
"explanation": "An app installation failed with a specific error code. Common MSI exit codes: 1603 (Fatal error during installation), 1618 (Another installation already in progress), 1619 (Package could not be opened), 1625 (Installation prohibited by policy). Common HRESULT codes are also captured.",
"remediation": [
{
"title": "Investigate the error code",
"steps": [
"Check the error code in the rule finding details",
"Look up the specific error code in Microsoft documentation",
"Review the IME logs on the device: C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs\\IntuneManagementExtension.log",
"Verify all prerequisites for the app are met",
"Check if another installation was running concurrently (error 1618)"
]
}
],
"tags": [
"apps",
"msi",
"error-code"
]
},
{
"ruleId": "ANALYZE-APP-003",
"title": "App Dependency Chain Failure",
"description": "Detects when an app fails because a dependency app failed to install.",
"severity": "high",
"category": "apps",
"enabled": true,
"baseConfidence": 70,
"conditions": [
{
"signal": "dependency_failure",
"source": "event_type",
"eventType": "app_install_failed",
"dataField": "message",
"operator": "regex",
"value": "dependency|prerequisite|required app|depends on|Dependency",
"required": true
}
],
"explanation": "An app installation failed because one of its dependency apps failed to install. Fix the dependency first, then retry.",
"remediation": [
{
"title": "Fix dependency chain",
"steps": [
"Identify which dependency app failed",
"Fix the dependency app first",
"Verify dependency chain order in Intune"
]
}
],
"tags": [
"apps",
"dependency"
]
},
{
"ruleId": "ANALYZE-APP-004",
"title": "Insufficient Disk Space",
"description": "Detects when disk space is critically low during enrollment, which can cause app installation failures.",
"severity": "critical",
"category": "apps",
"enabled": true,
"baseConfidence": 75,
"conditions": [
{
"signal": "low_disk",
"source": "event_type",
"eventType": "performance_snapshot",
"dataField": "disk_free_gb",
"operator": "lt",
"value": "5",
"required": true
}
],
"confidenceFactors": [
{
"signal": "app_failed",
"condition": "exists",
"weight": 15
},
{
"signal": "enrollment_failed",
"condition": "exists",
"weight": 10
}
],
"explanation": "Performance monitoring shows disk free space dropped below 5 GB during enrollment. This can cause app installation failures, especially for large Win32 apps.",
"remediation": [
{
"title": "Free disk space",
"steps": [
"Check device disk size meets minimum requirements",
"Clean up temporary files and IME cache (C:\\Windows\\IMECache)",
"Consider using a larger disk image"
]
}
],
"tags": [
"apps",
"disk-space",
"critical"
]
},
{
"ruleId": "ANALYZE-APP-005",
"title": "Content Download Timeout",
"description": "Detects when app content download times out or fails.",
"severity": "high",
"category": "apps",
"enabled": true,
"baseConfidence": 70,
"conditions": [
{
"signal": "download_timeout",
"source": "event_type",
"eventType": "app_install_failed",
"dataField": "errorPatternId",
"operator": "regex",
"value": "IME-DO-TIMEOUT|IME-ERROR-DOWNLOAD|IME-ERROR-NO-CONTENT",
"required": true
}
],
"explanation": "App content download timed out or failed. This is usually caused by network issues, proxy interference, or CDN problems. The IME log shows a Delivery Optimization timeout or download content error.",
"remediation": [
{
"title": "Improve download speed",
"steps": [
"Check network bandwidth",
"Verify proxy doesn't block *.delivery.mp.microsoft.com",
"Consider Delivery Optimization configuration"
]
}
],
"tags": [
"apps",
"download",
"timeout"
]
},
{
"ruleId": "ANALYZE-APP-006",
"title": "Reboot Required Loop",
"description": "Detects when the same app installation is attempted 3 or more times, indicating a reboot-required loop.",
"severity": "high",
"category": "apps",
"enabled": true,
"baseConfidence": 70,
"conditions": [
{
"signal": "reboot_loop",
"source": "event_count",
"eventType": "app_install_started",
"dataField": "appId",
"operator": "count_per_group_gte",
"value": "3",
"required": true
}
],
"explanation": "The same app has been installed 3 or more times during this enrollment. This typically indicates the app requires a reboot between install attempts, but the ESP is not honoring the reboot request, causing an install-detect-retry loop.",
"remediation": [
{
"title": "Fix reboot handling",
"steps": [
"Check if the app's return code mapping includes reboot codes (3010, 1641)",
"Verify ESP reboot behavior settings",
"Consider setting the app to 'Hard reboot' return code in Intune"
]
}
],
"tags": [
"apps",
"reboot",
"loop"
]
},
{
"ruleId": "ANALYZE-APP-007",
"title": "Multiple App Installation Failures",
"description": "Detects when the app tracking summary reports multiple failed app installations.",
"severity": "high",
"category": "apps",
"enabled": true,
"baseConfidence": 75,
"conditions": [
{
"signal": "summary_errors",
"source": "event_type",
"eventType": "app_tracking_summary",
"dataField": "errorCount",
"operator": "gte",
"value": "2",
"required": true
}
],
"confidenceFactors": [
{
"signal": "enrollment_failed",
"condition": "exists",
"weight": 15
}
],
"explanation": "The app tracking summary reports 2 or more failed app installations during enrollment. This suggests a systemic issue rather than an isolated app failure.",
"remediation": [
{
"title": "Review failed apps",
"steps": [
"Check the individual app_install_failed events for specific error patterns",
"Look for a common pattern (all MSI apps, all large apps, all from a specific publisher)",
"Consider whether a shared prerequisite or dependency is failing"
]
}
],
"tags": [
"apps",
"summary",
"multiple-failures"
]
},
{
"ruleId": "ANALYZE-APP-008",
"title": "Slow App Installation",
"description": "Detects app installations that take longer than 10 minutes.",
"severity": "warning",
"category": "apps",
"enabled": true,
"baseConfidence": 70,
"conditions": [
{
"signal": "slow_app_install",
"source": "app_install_duration",
"eventType": "app_install_completed",
"operator": "gt",
"value": "600",
"required": true
}
],
"explanation": "At least one app installation took longer than 10 minutes. This can indicate slow content delivery, installation overhead, or endpoint performance bottlenecks.",
"remediation": [
{
"title": "Analyze slow app behavior",
"steps": [
"Identify the affected app from matched evidence in the rule result",
"Check network throughput and proxy impact during app download",
"Consider moving large/non-critical apps out of ESP blocking scope"
]
}
],
"tags": [
"apps",
"performance",
"slow-install",
"warning"
]
},
{
"ruleId": "ANALYZE-APP-009",
"title": "App Download Stalled",
"description": "Detects when app downloads appear to have stalled, based on failed download progress events.",
"severity": "warning",
"category": "apps",
"enabled": false,
"trigger": "correlation",
"baseConfidence": 55,
"conditions": [
{
"signal": "download_failed",
"source": "event_type",
"eventType": "download_progress",
"dataField": "status",
"operator": "equals",
"value": "failed",
"required": true
},
{
"signal": "app_failed",
"source": "event_type",
"eventType": "app_install_failed",
"operator": "exists",
"value": "",
"required": true
}
],
"confidenceFactors": [
{
"signal": "proxy_active",
"condition": "exists",
"weight": 15
},
{
"signal": "multiple_failures",
"condition": "count >= 2",
"weight": 15
}
],
"confidenceThreshold": 50,
"explanation": "Download progress events show a failed download, and at least one app installation also failed. This pattern suggests content delivery issues preventing apps from being downloaded successfully.",
"remediation": [
{
"title": "Investigate download issues",
"steps": [
"Check network connectivity and bandwidth during the enrollment",
"Verify DNS resolution for *.delivery.mp.microsoft.com",
"Check if a proxy or firewall is blocking content delivery",
"Review Delivery Optimization settings and peer availability"
]
}
],
"tags": [
"apps",
"download",
"stall",
"correlation"
]
},
{
"ruleId": "ANALYZE-APP-010",
"title": "App Reverted to Error After Successful Install",
"description": "Detects when a specific app (matched by appId) was first reported as successfully installed but subsequently reported an IME enforcement error — while enrollment completed successfully. The app may be broken post-enrollment.",
"severity": "warning",
"category": "apps",
"enabled": true,
"trigger": "correlation",
"baseConfidence": 75,
"conditions": [
{
"signal": "app_regression",
"source": "event_correlation",
"eventType": "app_install_completed",
"correlateEventType": "app_install_failed",
"joinField": "appId",
"dataField": "errorPatternId",
"operator": "equals",
"value": "IME-ERROR-REPORT",
"required": true
},
{
"signal": "enrollment_succeeded",
"source": "event_type",
"eventType": "enrollment_complete",
"operator": "exists",
"value": "",
"required": true
}
],
"confidenceThreshold": 70,
"explanation": "An app was initially reported as **successfully installed** (`app_install_completed`) but the IME (Intune Management Extension) subsequently reported an **Error** state for the same app via an `IME-ERROR-REPORT` event — while the overall enrollment completed successfully.\n\nThis pattern occurs when the IME re-evaluates enforcement state after the initial install report and detects a failure, e.g. `EnforcementState` transitions from `Success` → `Error`. The affected app and its details are captured in the matched evidence.\n\nCommon causes:\n- A post-install detection check fails (detection rule mismatch)\n- The enforcement error code `-2016345060` (0x87D13B9C) indicates the app state diverged from expected\n- The app may appear installed in the ESP summary but is in an error state on the device\n\n**The enrollment succeeded, but the affected app requires attention.**",
"remediation": [
{
"title": "Investigate the app's post-install enforcement state",
"steps": [
"Note the appId and appName from the rule finding — these identify the exact affected app",
"Check the Intune portal: Devices > [Device] > Apps — confirm the current enforcement state of the app",
"Review IME logs on the device: C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs\\IntuneManagementExtension.log",
"Search the log for the appId and look for 'EnforcementState' transitions (Success → Error) near the enrollment time",
"Error -2016345060 (0x87D13B9C) typically indicates a detection failure after install — verify the app's detection rule in Intune",
"Trigger a manual sync (Company Portal or Settings > Accounts > Access work or school > Sync) to force re-evaluation"
]
},
{
"title": "Fix detection or installation issues",
"steps": [
"If detection fails: correct the detection rule (file path, registry key, or PowerShell script) in the Intune app configuration",
"If the app itself is broken: redeploy or reassign the app to trigger a fresh install",
"Consider adding a post-install validation script to catch this scenario proactively"
]
}
],
"relatedDocs": [
{
"title": "Troubleshoot Win32 app installations",
"url": "https://learn.microsoft.com/en-us/troubleshoot/mem/intune/app-management/troubleshoot-win32-app-install"
},
{
"title": "Intune Management Extension logs",
"url": "https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension"
}
],
"tags": [
"apps",
"win32",
"enforcement",
"post-install",
"correlation"
]
},
{
"ruleId": "ANALYZE-APP-012",
"title": "Enforcement Error Resolved by Successful Detection",
"description": "Detects when an app reported an enforcement error (unmapped exit code) but was subsequently detected as installed. The error is informational — the app installed despite the unmapped exit code.",
"severity": "warning",
"category": "apps",
"enabled": true,
"trigger": "correlation",
"baseConfidence": 80,
"conditions": [
{
"signal": "enforcement_error_resolved",
"source": "event_correlation",
"eventType": "app_install_failed",
"correlateEventType": "app_install_completed",
"joinField": "appId",
"eventAFilterField": "errorPatternId",
"eventAFilterOperator": "regex",
"eventAFilterValue": "IME-ERROR-ENFORCEMENT|IME-ERROR-UNMAPPED-EXIT",
"required": true
}
],
"explanation": "An app installation initially reported an **enforcement error** (unmapped exit code), but the IME detection check subsequently found the app **is installed**.\n\nThis happens when the MSI/EXE installer returns a non-standard exit code (e.g., 1603) that has no mapping configured in the Intune app definition. The IME treats unmapped exit codes as errors in its enforcement state, but when detection runs afterward, it confirms the app is present on the device.\n\n**The app is installed and functional.** The enforcement error is an Intune app model artifact, not a real installation failure.",
"remediation": [
{
"title": "Configure exit code mapping in Intune",
"steps": [
"Open the Intune portal > Apps > [affected app] > Properties > Edit",
"In the Return codes section, add a mapping for the reported exit code",
"Map the exit code to 'Success' or 'Soft reboot' depending on the installer behavior",
"This prevents the enforcement error from appearing in future deployments"
]
}
],
"relatedDocs": [
{
"title": "Win32 app return codes in Intune",
"url": "https://learn.microsoft.com/en-us/mem/intune/apps/apps-win32-app-management#step-4-return-codes"
}
],
"tags": [
"apps",
"enforcement",
"exit-code",
"unmapped",
"resolved"
]
},
{
"ruleId": "ANALYZE-APP-013",
"title": "App Detection Failure During ESP (0x87D1041C)",
"description": "Detects when the Enrollment Status Page failed because Intune could not verify an app was installed (HRESULT 0x87D1041C). The installer ran but the detection rule did not match afterwards.",
"severity": "critical",
"category": "apps",
"enabled": true,
"baseConfidence": 90,
"conditions": [
{
"signal": "esp_apps_detection_failure",
"source": "event_type",
"eventType": "app_install_failed",
"dataField": "failureType",
"operator": "equals",
"value": "esp_apps_detection_failure",
"required": true
},
{
"signal": "failed_app_name",
"source": "event_type",
"eventType": "app_install_failed",
"dataField": "appName",
"operator": "exists",
"value": "",
"required": false
},
{
"signal": "detection_hresult",
"source": "event_type",
"eventType": "app_install_failed",
"dataField": "errorCode",
"operator": "exists",
"value": "",
"required": false
}
],
"explanation": "App **{{appName}}** failed during the Enrollment Status Page with HRESULT **{{errorCode}}** — *Application not detected after installation completed successfully*. The installer reported success but the Intune detection rule (file/registry/script) did not find the app afterwards, so the ESP Apps subcategory failed and the device's enrollment terminated.\n\nThis is a confirmed detection-rule mismatch, NOT an install timeout — the install itself most likely completed (or the installer exited 0). Common root causes:\n\n- The detection rule looks for a registry/file path that the installer doesn't create (wrong path, wrong bitness — e.g. checking HKLM\\SOFTWARE\\... on a 32-bit installer that lands under WOW6432Node).\n- The installer writes the detection artefact AFTER the ESP's detection probe runs (e.g. async post-install task, requires reboot).\n- The detection script returns 0 with no stdout (Intune treats empty stdout as \"not detected\").\n- The installer wrote files to a user profile but the rule looks in System scope (or vice-versa).",
"remediation": [
{
"title": "Validate the detection rule against an installed device",
"steps": [
"Open Intune portal → Apps → {{appName}} → Properties → Detection rules",
"Note the exact path / registry key / script the rule checks",
"Install the app manually on a reference device (outside Autopilot) and verify the detection artefact actually exists at that path AFTER the installer finishes",
"For registry rules: check both HKLM\\SOFTWARE\\... and HKLM\\SOFTWARE\\WOW6432Node\\... depending on the installer's bitness",
"For file rules: ensure the path is what the installer actually writes (case, trailing version folder, ProgramData vs Program Files)",
"For script detection: test the script in PowerShell as SYSTEM (psexec -s) — it must write at least one line to stdout AND exit 0"
]
},
{
"title": "Investigate post-install delay",
"steps": [
"Check whether the installer schedules an async task (Windows Installer scheduled reboot, service start) that creates the detection artefact only after ESP completes",
"If yes: either move the detection artefact creation into the synchronous installer path, or add a wait step in the installer wrapper script before exit",
"As a workaround, change the detection rule to something the synchronous installer writes immediately (typically the MSI ProductCode under HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\)"
]
},
{
"title": "Cross-check the agent's per-app event",
"steps": [
"Look at the app_install_failed event in this session for DataJson.detectionResult — NotDetected confirms Intune's detection probe ran and returned negative",
"Look at app_install_failed.bytesDownloaded vs bytesTotal — if they match, the package downloaded fully (install error vs. download error)",
"Cross-reference DataJson.exitCode and hresultFromWin32 — these come from the installer itself and may explain why the detection artefact was not written"
]
}
],
"relatedDocs": [
{
"title": "Microsoft Learn: Troubleshoot Windows Autopilot ESP error codes",
"url": "https://learn.microsoft.com/en-us/autopilot/troubleshoot-tsg"
},
{
"title": "Win32 app detection rules in Intune",
"url": "https://learn.microsoft.com/en-us/mem/intune/apps/apps-win32-add#step-4-detection-rules"
}
],
"tags": [
"apps",
"detection",
"esp",
"0x87d1041c",
"intune"
]
},
{
"ruleId": "ANALYZE-CORR-001",
"title": "Slow Network Causing App Installation Failure",
"description": "Correlates slow download speeds with app installation failures while disk space is adequate, confirming network as root cause (not disk).",
"severity": "high",
"category": "apps",
"enabled": false,
"trigger": "correlation",
"baseConfidence": 55,
"conditions": [
{
"signal": "app_failed",
"source": "event_type",
"eventType": "app_install_failed",
"operator": "exists",
"value": "",
"required": true
},
{
"signal": "download_events",
"source": "event_type",
"eventType": "download_progress",
"operator": "exists",
"value": "",
"required": true
},
{
"signal": "disk_ok",
"source": "event_type",
"eventType": "performance_snapshot",
"dataField": "disk_free_gb",
"operator": "gt",
"value": "10"
}
],
"confidenceFactors": [
{
"signal": "disk_ok",
"condition": "exists",
"weight": 15
},
{
"signal": "multiple_failures",
"condition": "count >= 2",
"weight": 15
},
{
"signal": "enrollment_failed",
"condition": "exists",
"weight": 15
}
],
"confidenceThreshold": 50,
"explanation": "App installation failed while the device has sufficient disk space (>10 GB free). Download progress events indicate network-related issues are the likely root cause.\n\nThis rules out disk space as a factor and points to network bandwidth, proxy throttling, or CDN connectivity issues.",
"remediation": [
{
"title": "Investigate network throughput",
"steps": [
"Check bandwidth to *.delivery.mp.microsoft.com (CDN)",
"Verify proxy is not throttling large downloads",
"Consider enabling Delivery Optimization for peer-to-peer caching"
]
},
{
"title": "Reduce download load",
"steps": [
"Stagger app deployments to reduce concurrent downloads",
"Pre-cache large apps using Delivery Optimization or ConfigMgr",
"Increase ESP timeout if downloads are slow but completing"
]
}
],
"tags": [
"correlation",
"apps",
"network",
"download",
"root-cause"
]
},
{
"ruleId": "ANALYZE-CORR-002",
"title": "Disk Space Exhaustion Caused Installation Failure",
"description": "Correlates declining disk free space with app installation failure, confirming insufficient storage as root cause.",
"severity": "critical",
"category": "apps",
"enabled": true,
"trigger": "correlation",
"baseConfidence": 65,
"conditions": [
{
"signal": "low_disk",
"source": "event_type",
"eventType": "performance_snapshot",
"dataField": "disk_free_gb",
"operator": "lt",
"value": "5",
"required": true
},
{
"signal": "app_failed",
"source": "event_type",
"eventType": "app_install_failed",
"operator": "exists",
"value": "",
"required": true
}
],
"confidenceFactors": [
{
"signal": "multiple_failures",
"condition": "count >= 2",
"weight": 15
},
{
"signal": "enrollment_failed",
"condition": "exists",
"weight": 10
}
],
"confidenceThreshold": 50,
"explanation": "**Root cause confirmed:** Performance monitoring shows disk free space dropped below 5 GB during enrollment, and apps failed to install. The device likely ran out of storage during app installation.\n\nThis is common when deploying many large Win32 apps to devices with small drives (64 GB or 128 GB).",
"remediation": [
{
"title": "Reduce disk consumption during enrollment",
"steps": [
"Review total size of all apps deployed during ESP",
"Move non-critical apps to post-ESP deployment",
"Use MSIX or Store apps instead of Win32 where possible (smaller footprint)",
"Clean up IME cache: C:\\Windows\\IMECache"
]
},
{
"title": "Use devices with larger drives",
"steps": [
"Minimum 128 GB recommended for standard deployments",
"256 GB recommended when deploying large app suites (Office, Visual Studio, etc.)"
]
}
],
"tags": [
"correlation",
"apps",
"disk-space",
"performance",
"root-cause"
]
},
{
"ruleId": "ANALYZE-CORR-003",
"title": "Proxy Configuration Causing Download Failure",
"description": "Correlates an active proxy configuration with app download failures, suggesting the proxy is blocking or throttling Intune content delivery.",
"severity": "high",
"category": "apps",
"enabled": true,
"trigger": "correlation",
"baseConfidence": 60,
"conditions": [
{
"signal": "proxy_active",
"source": "event_type",
"eventType": "proxy_configuration",
"dataField": "proxyType",
"operator": "regex",
"value": "Proxy|PAC",
"required": true
},
{
"signal": "app_failed",
"source": "event_type",
"eventType": "app_install_failed",
"operator": "exists",
"value": "",
"required": true
}
],
"confidenceFactors": [
{
"signal": "download_timeout",
"condition": "exists",
"weight": 20
},
{
"signal": "multiple_failures",
"condition": "count >= 2",
"weight": 15
},
{
"signal": "enrollment_failed",
"condition": "exists",
"weight": 10
}
],
"confidenceThreshold": 50,
"explanation": "A proxy (explicit or PAC-based) is configured on this device and app installations failed. Proxies can block or throttle downloads from *.delivery.mp.microsoft.com and other Intune CDN endpoints.\n\nThis is a common root cause when apps fail consistently on proxy-connected corporate networks.",
"remediation": [
{
"title": "Verify proxy bypass for Intune endpoints",
"steps": [
"Add *.delivery.mp.microsoft.com to proxy bypass list",
"Add *.do.dsp.mp.microsoft.com (Delivery Optimization) to bypass list",
"Add login.microsoftonline.com and *.manage.microsoft.com to bypass list",
"Verify the PAC file is reachable at enrollment time (before user login)"
]
},
{
"title": "Check proxy authentication",
"steps": [
"Ensure the proxy does not require user authentication during OOBE/device phase",
"Consider using machine certificate-based proxy authentication",
"Test with proxy temporarily bypassed to confirm it is the root cause"
]
}
],
"tags": [
"correlation",
"apps",
"proxy",
"network",
"download",
"root-cause"
]
},
{
"ruleId": "ANALYZE-DEV-001",
"title": "Windows Hello Provisioning Timeout",
"description": "Detects when Windows Hello for Business provisioning did not start within the expected timeframe after ESP completion.",
"severity": "warning",
"category": "device",
"enabled": true,
"baseConfidence": 60,
"conditions": [
{
"signal": "hello_timeout",
"source": "event_type",
"eventType": "hello_wait_timeout",
"operator": "exists",
"value": "",
"required": true
}
],
"confidenceFactors": [
{
"signal": "hello_policy_detected",
"condition": "exists",
"weight": 30
}
],
"explanation": "Windows Hello for Business provisioning did not start within the expected time after ESP exit. This may indicate that the Hello policy is not configured, the device doesn't meet prerequisites, or there's a connectivity issue with the Key Registration Service.",
"remediation": [
{
"title": "Verify Windows Hello configuration",
"steps": [
"Check if Windows Hello for Business is configured in the tenant",
"Verify the policy targets the device/user correctly",
"Ensure the device has a TPM 2.0 (required for WHfB)",
"Check connectivity to the Key Registration Service (enterpriseregistration.windows.net)"
]
}
],
"tags": [
"device",
"hello",
"timeout"
]
},
{
"ruleId": "ANALYZE-DEV-002",
"title": "High Memory Usage During Enrollment",
"description": "Detects when memory usage exceeds 90% during enrollment, which can cause app installation failures or system instability.",
"severity": "warning",
"category": "device",
"enabled": true,
"baseConfidence": 55,
"conditions": [
{
"signal": "high_memory",
"source": "event_type",
"eventType": "performance_snapshot",
"dataField": "memory_used_percent",
"operator": "gt",
"value": "90",
"required": true
}
],
"confidenceFactors": [
{
"signal": "app_failed",
"condition": "exists",
"weight": 20
},
{
"signal": "enrollment_failed",
"condition": "exists",
"weight": 15
}
],
"explanation": "Memory usage exceeded 90% during enrollment. High memory pressure can cause app installation failures, system slowdowns, and ESP timeouts.",
"remediation": [
{
"title": "Reduce memory pressure",
"steps": [
"Review which apps are being installed concurrently during ESP",
"Consider staggering resource-heavy installations",
"Check minimum RAM requirements for the device (8 GB recommended)",
"Investigate if background services are consuming excessive memory"
]
}
],
"tags": [
"device",
"memory",
"performance"
]
},
{
"ruleId": "ANALYZE-DEV-003",
"title": "Unsupported Windows 11 Version",
"description": "Detects devices running Windows 11 version 22H2 or older, which is no longer supported by Microsoft.",
"severity": "warning",
"category": "device",
"enabled": true,
"baseConfidence": 90,
"conditions": [
{
"signal": "windows_11",
"source": "event_type",
"eventType": "os_info",
"dataField": "osVersion",
"operator": "contains",
"value": "Windows 11",
"required": true
},
{
"signal": "old_build",
"source": "event_data",
"eventType": "os_info",
"dataField": "currentBuild",
"operator": "lte",
"value": "22621",
"required": true
}
],
"confidenceFactors": [],
"confidenceThreshold": 40,
"explanation": "This device is running Windows 11 version 22H2 (Build 22621) or older, which has reached end of support. Microsoft no longer provides security updates or bug fixes for this version. Devices running unsupported OS versions are exposed to known vulnerabilities and may fail compliance checks.",
"remediation": [
{
"title": "Update to a supported Windows 11 version",
"steps": [
"Verify the device meets hardware requirements for Windows 11 23H2 or 24H2",
"Update the Windows Autopilot deployment profile to use a supported OS image (23H2 or later)",
"If using a custom OS image, rebuild it with a supported Windows 11 version",
"For existing devices, deploy a Windows 11 feature update via Intune or Windows Update for Business"
]
}
],
"relatedDocs": [
{
"title": "Windows 11 release information",
"url": "https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information"
},
{
"title": "Windows 11 22H2 end of support",
"url": "https://learn.microsoft.com/en-us/lifecycle/products/windows-11-home-and-pro"
}
],
"tags": [
"device",
"os-version",
"end-of-support",
"windows-11"
]
},
{
"ruleId": "ANALYZE-ENRL-001",
"title": "Enrollment Failed",
"description": "Detects when the Autopilot enrollment has explicitly failed.",
"severity": "critical",
"category": "enrollment",
"enabled": true,
"baseConfidence": 95,
"conditions": [
{
"signal": "enrollment_failed",
"source": "event_type",
"eventType": "enrollment_failed",
"operator": "exists",
"value": "",
"required": true
},
{
"signal": "enrollment_failed_reason",
"source": "event_type",
"eventType": "enrollment_failed",
"dataField": "reason",
"operator": "exists",
"value": "",
"required": false
},
{
"signal": "esp_failure_subcategory",
"source": "event_type",
"eventType": "esp_failure_settle_started",
"dataField": "failedSubcategory",
"operator": "exists",
"value": "",
"required": false
},
{
"signal": "esp_failure_errorcode",
"source": "event_type",
"eventType": "esp_failure_settle_started",
"dataField": "errorCode",
"operator": "exists",
"value": "",
"required": false
},
{
"signal": "failed_app",
"source": "event_type",
"eventType": "app_install_failed",
"dataField": "appName",
"operator": "exists",
"value": "",
"required": false
}
],
"confidenceFactors": [
{
"signal": "app_failed",
"condition": "exists",
"weight": 5
}
],
"explanation": "The Autopilot enrollment has explicitly failed. The most specific failure information is carried by the events captured during this session — review the `enrollment_failed` event payload and the more targeted rule results (ANALYZE-APP-* / ANALYZE-ESP-*) that fired alongside this one for the actionable root cause.\n\nKey facts extracted from the timeline:\n\n- **Failure reason:** `{{reason}}`\n- **ESP failed subcategory:** `{{failedSubcategory}}`\n- **ESP HRESULT:** `{{errorCode}}`\n- **First failed app:** `{{appName}}`\n\n(Fields shown as `{{…}}` were not present in this session — e.g. a non-ESP failure path has no failed-subcategory, and a successful pre-ESP stage has no failed app.)",
"remediation": [
{
"title": "Investigate enrollment failure",
"steps": [
"Read the `reason` field on the enrollment_failed event for the immediate trigger (e.g. esp_terminal_failure, hello_timeout, max_lifetime)",
"If a HRESULT is present, look it up against the ESP error catalog (Microsoft Learn: Autopilot ESP error codes) — the ANALYZE-APP-* rules in this session correlate specific HRESULTs to actionable root causes (e.g. 0x87D1041C → detection rule mismatch)",
"Review other analyze rule results for correlated issues (disk space, network, app failures)",
"Check the device event timeline for the sequence of events leading to failure",
"Verify the Autopilot profile and ESP configuration in Intune"
]
}
],
"tags": [
"enrollment",
"failed",
"critical"
]
},
{
"ruleId": "ANALYZE-ESP-001",
"title": "ESP Blocking App Timeout",
"description": "Detects when the DeviceSetup phase of the ESP took longer than 30 minutes, indicating a stuck or very slow blocking app.",
"severity": "high",
"category": "esp",
"enabled": true,
"baseConfidence": 50,
"conditions": [
{
"signal": "esp_stalled",
"source": "phase_duration",
"eventType": "esp_phase_changed",
"dataField": "espPhase",
"operator": "equals",
"value": "DeviceSetup",
"required": true
}
],
"confidenceFactors": [
{
"signal": "long_esp",
"condition": "phase_duration > 1800",
"weight": 40
}
],
"confidenceThreshold": 70,
"explanation": "The ESP DeviceSetup phase took more than 30 minutes. This indicates a blocking app is stuck installing, downloading very slowly, or has entered a retry loop.",
"remediation": [
{
"title": "Investigate blocking app",
"steps": [
"Identify which app is blocking (check ESP events)",
"Verify app content is downloadable",
"Consider reducing the number of blocking apps"
]
}
],
"tags": [
"esp",
"blocking",
"timeout"
]
},
{
"ruleId": "ANALYZE-ESP-002",
"title": "ESP Subcategory Failed (Certificates)",
"description": "Detects when the Certificates subcategory of the Enrollment Status Page reported a failure, even if the enrollment later appears to have succeeded. Users can click 'Continue anyway' on an ESP error, which masks the underlying certificate provisioning failure — this rule surfaces the transition so it stays visible.",
"severity": "high",
"category": "esp",
"version": "1.0.0",
"author": "Autopilot Monitor",
"enabled": true,
"trigger": "single",
"baseConfidence": 80,
"conditions": [
{
"signal": "certificates_subcategory_failed",
"source": "event_data",
"eventType": "esp_provisioning_status",
"dataField": "failedSubcategories",
"operator": "contains",
"value": "Certificates",
"required": true
}
],
"confidenceFactors": [],
"confidenceThreshold": 70,
"explanation": "The ESP Certificates subcategory transitioned to **failed** during enrollment. This is frequently masked when the user clicks 'Continue anyway' on the ESP error screen — the overall enrollment then appears successful while a required certificate (e.g. Wi-Fi, VPN, SCEP/PKCS) was never deployed.\n\nThe subcategory name is read from the registry (`CertificatesSubcategory`) and is language-invariant, so this rule fires regardless of OS display language.",
"remediation": [
{
"title": "Validate certificate delivery on the device",
"steps": [
"Run `certutil -store My` and `certutil -store -user My` on the device to inspect installed certificates",
"Check `Event Viewer → Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider → Admin` for SCEP/PKCS errors",
"Review the Intune portal for the device's certificate profile assignments and deployment status"
]
},
{
"title": "Fix common certificate provisioning issues",
"steps": [
"Verify the NDES/SCEP connector is online and healthy",
"Confirm the certificate template permissions grant 'Enroll' to the Intune service account / NDES computer account",
"Check that the device has network line-of-sight to the SCEP endpoint at the time of ESP",
"Re-sync the device (Settings → Accounts → Access work or school → Info → Sync) and re-check the Certificates subcategory"
]
}
],
"relatedDocs": [
{
"title": "Microsoft Learn: Troubleshoot certificate profiles in Intune",
"url": "https://learn.microsoft.com/en-us/mem/intune/protect/troubleshoot-certificate-profiles"
},
{
"title": "Microsoft Learn: Enrollment Status Page tracking",
"url": "https://learn.microsoft.com/en-us/autopilot/enrollment-status"
}
],
"markSessionAsFailedDefault": false,
"tags": [
"esp",
"certificates",
"subcategory",
"silent-failure"
]
},
{
"ruleId": "ANALYZE-ESP-003",
"title": "Enrollment Duration Exceeded 60 Minutes",
"description": "Detects when the total Autopilot enrollment takes longer than 60 minutes.",
"severity": "high",
"category": "esp",
"enabled": true,
"baseConfidence": 50,
"conditions": [
{
"signal": "long_enrollment",
"source": "phase_duration",
"eventType": "esp_phase_changed",
"dataField": "espPhase",
"operator": "equals",
"value": "DeviceSetup",
"required": true
}
],
"confidenceFactors": [
{
"signal": "long_esp",
"condition": "phase_duration > 3600",
"weight": 40
}
],
"confidenceThreshold": 70,
"explanation": "The Autopilot enrollment exceeded 60 minutes. This is unusually long and may indicate stuck apps, slow network, or policy conflicts. The default ESP timeout is 60 minutes, after which the enrollment may be marked as failed.",
"remediation": [
{
"title": "Investigate long enrollment",
"steps": [
"Check the app installation timeline - identify which app took the longest",
"Review download speeds in the performance data",
"Consider reducing the number of ESP-blocking apps",
"Check if the ESP timeout policy is configured (default: 60 min)"
]
}
],
"tags": [
"esp",
"timeout",
"duration"
]
},
{
"ruleId": "ANALYZE-ID-001",
"title": "No Machine Certificates Found",
"description": "Detects when no certificates are present in the local machine personal store (LocalMachine\\My). Missing certificates may indicate that MDM enrollment certificate provisioning or SCEP certificate deployment failed.",
"severity": "warning",
"category": "identity",
"isCommunity": true,
"enabled": false,
"version": "1.1.0",
"baseConfidence": 75,
"conditions": [
{
"signal": "cert_store_gathered",
"source": "event_type",
"eventType": "gather_machine_cert_store",
"operator": "exists",
"value": "",
"required": true
},
{
"signal": "cert_subject_missing",
"source": "event_data",
"eventType": "gather_machine_cert_store",
"dataField": "output",
"operator": "not_contains",
"value": "CN=YOUR-CERTIFICATE-SUBJECT",
"required": true
}
],
"confidenceFactors": [
{
"signal": "no_output_at_all",
"condition": "gather_machine_cert_store.output not_exists",
"weight": 20
},
{
"signal": "command_error",
"condition": "gather_machine_cert_store.error_output exists",
"weight": 10
}
],
"confidenceThreshold": 70,
"explanation": "The expected certificate with the configured subject was not found in the local machine certificate store (LocalMachine\\My). Customize the 'value' field in the 'cert_subject_missing' condition to match your expected certificate subject (e.g. 'CN=Contoso Root CA'). The check is case-insensitive (substring match). If the certificate should have been provisioned via SCEP or MDM enrollment, this may indicate a deployment failure.",
"remediation": [
{
"title": "Verify the expected certificate",
"steps": [
"Customize the analyze rule: change 'CN=YOUR-CERTIFICATE-SUBJECT' to your expected certificate subject (case-insensitive substring match)",
"Example subjects: 'CN=Contoso SCEP Cert', 'CN=Contoso Root CA', 'CN=MDM Device Certificate'",
"Check certlm.msc (Certificates - Local Computer > Personal > Certificates) manually to see what's present"
]
},
{
"title": "Troubleshoot missing certificate",
"steps": [
"Check if the device is properly enrolled in Intune (dsregcmd /status)",
"Verify SCEP/PKCS certificate profiles are assigned and targeted correctly",
"Check the NDES/SCEP connector status and reachability",
"Review IntuneManagementExtension logs for certificate enrollment errors",
"Ensure prerequisite certificates (Trusted Root CA) are deployed before the end-entity profile"
]
}
],
"tags": [
"identity",
"certificates",
"machine-store",
"subject-check"
],
"templateVariables": [
{
"name": "cert_subject",
"label": "Certificate Subject",
"description": "The expected certificate subject in your environment (e.g., 'CN=Contoso Root CA'). Case-insensitive substring match against the local machine certificate store.",
"conditionIndex": 1,
"field": "value",
"placeholder": "CN=YOUR-CERTIFICATE-SUBJECT"
}
]
},
{
"ruleId": "ANALYZE-ID-002",
"title": "Unexpected Local Admin Accounts Detected",
"description": "Detects when the LocalAdminAnalyzer flags unexpected local user accounts or profile directories on the device. This is a known Autopilot bypass technique where admin accounts are created before or during enrollment to gain persistent local admin access.",
"severity": "high",
"category": "identity",
"version": "1.0.0",
"author": "Autopilot Monitor",
"enabled": true,
"trigger": "single",
"baseConfidence": 60,
"conditions": [
{
"signal": "unexpected_admins_found",
"source": "event_type",
"eventType": "local_admin_analysis",
"dataField": "finding",
"operator": "equals",
"value": "unexpected_local_admins_detected",
"required": true
},
{
"signal": "high_confidence",
"source": "event_data",
"eventType": "local_admin_analysis",
"dataField": "confidence_score",
"operator": "gte",
"value": "60",
"required": false
},
{
"signal": "error_severity",
"source": "event_data",
"eventType": "local_admin_analysis",
"dataField": "severity",
"operator": "equals",
"value": "error",
"required": false
}
],
"confidenceFactors": [
{
"signal": "high_confidence",
"condition": "exists",
"weight": 15
},
{
"signal": "error_severity",
"condition": "exists",
"weight": 15
}
],
"confidenceThreshold": 50,
"explanation": "The agent detected unexpected local user accounts or profile directories on this device that are not in the built-in or tenant-configured allowed list.\n\nThis is a security-relevant finding. Creating local admin accounts before or during Autopilot enrollment is a known bypass technique (e.g. via BypassNRO or Shift+F10 during OOBE) that grants persistent local administrator access.\n\nClick the event link below to jump to the local_admin_analysis event and check: unexpected_accounts (local user accounts not on the allowed list), unexpected_profiles (C:\\Users profile directories not on the allowed list), bypass_nro (whether the BypassNRO registry flag was set), and confidence_score (the agent's confidence in the finding, 0-100).\n\nIf these accounts are expected for your environment (e.g. a service account or helpdesk account), add them to the allowed list in Tenant Settings.",
"remediation": [
{
"title": "Review the unexpected accounts",
"steps": [
"Open the session timeline and locate the local_admin_analysis event",
"Check the 'unexpected_accounts' and 'unexpected_profiles' lists in the event data",
"Verify whether these accounts are legitimate for your environment"
]
},
{
"title": "Add expected accounts to the allowed list (false positive)",
"steps": [
"Go to Settings → Agent Analyzers section",
"Under 'Allowed Admin Accounts', add the account names that are expected in your environment",
"Save the settings — future enrollments will no longer flag these accounts"
]
},
{
"title": "Investigate a potential security issue",
"steps": [
"Check if the BypassNRO registry flag was set (indicates OOBE was bypassed)",
"Review the enrollment timeline for Shift+F10 or other OOBE escape indicators",
"Check whether the unexpected account has admin group membership",
"Consider re-imaging the device if unauthorized admin access is confirmed"
]
}
],
"relatedDocs": [],
"tags": [
"identity",
"security",
"local-admin",
"bypass-detection"
]
},
{
"ruleId": "ANALYZE-ID-003",
"title": "Critical Vulnerability Detected",
"description": "Fires when the vulnerability correlation finds critical-severity CVEs or CISA KEV entries in installed software. This indicates the device has software with known, actively exploited vulnerabilities.",
"severity": "critical",
"category": "security",
"version": "1.0.0",
"author": "Autopilot Monitor",
"enabled": true,
"trigger": "single",
"baseConfidence": 90,
"conditions": [
{
"signal": "critical_vulnerabilities",
"source": "event_type",
"eventType": "vulnerability_report",
"dataField": "scan_summary.critical_cves",
"operator": "gte",
"value": "1",
"required": true
},
{
"signal": "kev_matches",
"source": "event_type",
"eventType": "vulnerability_report",
"dataField": "scan_summary.kev_matches",
"operator": "gte",
"value": "1",
"required": false
}
],
"confidenceFactors": [
{
"signal": "kev_confirmed",
"condition": "exists",
"weight": 10
}
],
"confidenceThreshold": 80,
"explanation": "The device has installed software with critical vulnerabilities. Software with CVEs rated CRITICAL (CVSS >= 9.0) or listed in the CISA Known Exploited Vulnerabilities catalog was detected. These vulnerabilities are actively targeted by attackers and should be remediated immediately.",
"remediation": [
{
"title": "Review vulnerability findings",
"steps": [
"Open the Vulnerability Report section in the session detail",
"Identify all software with critical or KEV-flagged vulnerabilities",
"Check if newer versions are available that address these CVEs",
"Update the affected software in your Intune app deployment"
]
},
{
"title": "Update deployment packages",
"steps": [
"Check Intune for outdated app package versions",
"Update the deployment package to the latest patched version",
"Re-deploy to affected devices"
]
}
],
"relatedDocs": [
{
"title": "CISA KEV Catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"title": "NVD - National Vulnerability Database",
"url": "https://nvd.nist.gov/"
}
],
"tags": [
"vulnerability",
"cve",
"kev",
"critical",
"security"
]
},
{
"ruleId": "ANALYZE-SEC-001",
"title": "Secure Boot UEFI CA 2023 certificate not deployed",
"description": "Detects devices where the Windows UEFI CA 2023 certificate has not been deployed to the Secure Boot DB. These devices will lose Secure Boot security update support when the 2011 certificates expire in June 2026.",
"severity": "warning",
"category": "security",
"version": "1.1.0",
"enabled": true,
"baseConfidence": 70,
"preconditions": [
{
"source": "event_data",
"eventType": "hardware_spec",
"dataField": "isVirtualMachine",
"operator": "equals",
"value": "false",
"description": "Skip on virtual machines — Secure Boot DB is host-controlled (Hyper-V/VMware/etc), the inside-the-VM UEFICA2023Status registry value is not the right indicator and not actionable for the VM admin."
}
],
"conditions": [
{
"signal": "ca2023_not_updated",
"source": "event_data",
"eventType": "secureboot_status",
"dataField": "uefiCA2023Status",
"operator": "not_equals",
"value": "Updated",
"required": true
},
{
"signal": "secureboot_enabled",
"source": "event_data",
"eventType": "secureboot_status",
"dataField": "uefiSecureBootEnabled",
"operator": "equals",
"value": "true",
"required": true
}
],
"confidenceFactors": [
{
"signal": "ca2023_notfound",
"condition": "equals:notfound",
"weight": 20
},
{
"signal": "ca2023_error",
"condition": "exists",
"weight": 10
}
],
"explanation": "This device has Secure Boot enabled but the **Windows UEFI CA 2023** certificate has not been deployed to the Secure Boot DB yet.\n\nThe original Windows UEFI CA 2011 certificates expire on **June 27, 2026**. After expiration, devices without the 2023 certificate will no longer receive Secure Boot security updates and may fail to boot with updated boot managers.\n\nCurrent UEFI CA 2023 status: `{{uefiCA2023Status}}`",
"remediation": [
{
"title": "Deploy UEFI CA 2023 certificate",
"steps": [
"Deploy KB5036210 via Windows Update or WSUS",
"Use Intune policy to enable Secure Boot DB update (Windows UEFI CA 2023)",
"Alternatively, use the WinCS CLI tool from Microsoft for manual deployment",
"Verify deployment: check registry HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecureBoot\\Servicing\\UEFICA2023Status = 'Updated'",
"After DB update: ensure the boot manager is updated to a 2023-signed version via monthly cumulative update"
]
}
],
"relatedDocs": [
{
"title": "Microsoft: Secure Boot certificates expire June 2026",
"url": "https://techcommunity.microsoft.com/blog/windows-itpro-blog/act-now-secure-boot-certificates-expire-in-june-2026/4426856"
},
{
"title": "KB5036210: Deploying Windows UEFI CA 2023",
"url": "https://support.microsoft.com/en-us/topic/kb5036210"
}
],
"tags": [
"security",
"secureboot",
"certificate",
"ca2023",
"compliance"
]
}
]
}
Reference in New Issue View Git Blame Copy Permalink