Files
AutopilotMonitor/rules/schema/ime-log-pattern.schema.json
T
Oliver Kieselbach 66452621c6 exit-code class per app + reboot rule: IME-EXITCODE-CLASS, ANALYZE-APP-018, exitCode on every terminal app event (D-214)
- IME-EXITCODE-CLASS captures the return-code class of the installer exit code ("lpExitCode is defined as <Success|SoftReboot|HardReboot|Retry|Failed>", verified against the IME string literal) as exitCodeClass on AppPackageState; new action captureExitCodeClass, persisted across the agent restart a reboot causes, last value wins across a Retry loop. IME-EXITCODE-MAPPED-FAILED keeps the error path; both match the same line.
- Adapter: exitCodeClass whenever known, exitCode on every terminal state (Installed/Postponed/Skipped/Error) instead of Error only.
- ANALYZE-APP-018 (warning, apps): app_install_completed.exitCodeClass in SoftReboot,HardReboot; +25 HardReboot, +15 observed system_reboot_detected; never fails the session.
- Web: completed-app exit badge amber (failed stays red), "mapped as SoftReboot/HardReboot/Retry" on timeline and Install Progress.
- Tests: pack end to end (phase, current app, class lines, negatives, restart round trip), adapter payloads, linearity samples, backend rule engine + known actions.
- internal gitlink: plan, D-214, backlog.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-06 18:08:49 +02:00

106 lines
3.6 KiB
JSON

{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://raw.githubusercontent.com/OliverKieselbach/Autopilot-Monitor/main/rules/schema/ime-log-pattern.schema.json",
"title": "Autopilot Monitor IME Log Pattern",
"description": "Defines a regex pattern for Intune Management Extension (IME) log parsing during Autopilot enrollment.",
"oneOf": [
{ "$ref": "#/$defs/imeLogPattern" },
{
"type": "object",
"properties": {
"$schema": { "type": "string" },
"rules": {
"type": "array",
"items": { "$ref": "#/$defs/imeLogPattern" }
}
},
"required": ["rules"],
"additionalProperties": false
}
],
"$defs": {
"imeLogPattern": {
"type": "object",
"properties": {
"$schema": {
"type": "string",
"description": "JSON Schema reference for editor IntelliSense."
},
"patternId": {
"type": "string",
"description": "Unique pattern identifier (e.g., \"IME-ESP-PHASE\")."
},
"category": {
"type": "string",
"description": "Pattern category controlling when the pattern is active.",
"enum": ["always", "currentPhase", "otherPhases"]
},
"pattern": {
"type": "string",
"description": "Regex pattern string to match against IME log message content. Supports named capture groups. Uses {GUID} as placeholder for the standard GUID capture pattern."
},
"action": {
"type": "string",
"description": "Action to perform when the pattern matches. Must match an action handler in the agent's ImeLogTracker.",
"enum": [
"setCurrentApp",
"updateStateInstalled",
"updateStateDownloading",
"updateStateInstalling",
"updateStateSkipped",
"updateStateError",
"updateStatePostponed",
"espPhaseDetected",
"imeStarted",
"policiesDiscovered",
"ignoreCompletedApp",
"imeAgentVersion",
"espTrackStatus",
"updateName",
"updateWin32AppState",
"cancelStuckAndSetCurrent",
"imeSessionChange",
"imeImpersonation",
"imeTokenFailure",
"enrollmentCompleted",
"userSessionZeroApps",
"updateDoTelemetry",
"scriptStarted",
"scriptContext",
"scriptExitCode",
"scriptOutput",
"scriptCompleted",
"resetPlatformScriptContext",
"healthScriptResult",
"healthScriptDetectionResult",
"captureExitCode",
"captureHResult",
"captureAppVersion",
"captureAppTypeWinGet",
"captureAppTypeMsi",
"captureAttemptNumber",
"captureDetectionResult",
"captureExitCodeClass"
]
},
"parameters": {
"type": "object",
"description": "Optional extra parameters for the action handler (all values are strings).",
"additionalProperties": { "type": "string" }
},
"description": {
"type": "string",
"description": "Human-readable description of what this pattern detects and why."
},
"enabled": {
"type": "boolean",
"description": "Whether this pattern is enabled. Set to false to add a pattern without activating it immediately.",
"default": true
}
},
"required": ["patternId", "category", "pattern", "action"],
"additionalProperties": false
}
}
}