mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-25 13:10:13 +00:00
Oliver Kieselbach
637 lines
27 KiB
JSON
Generated
637 lines
27 KiB
JSON
Generated
{
|
|
"$schema": "../schema/ime-log-pattern.schema.json",
|
|
"rules": [
|
|
{
|
|
"patternId": "HS-COMPLIANCE",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] the pre-remdiation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
|
|
"action": "scriptCompleted",
|
|
"parameters": {
|
|
"scriptType": "remediation",
|
|
"part": "detection"
|
|
},
|
|
"description": "Captures the detection compliance result for a remediation script. True = compliant (no remediation needed), False = non-compliant (remediation will run).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-EXITCODE",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] exit code of the script is (?<exitCode>-?\\d+)",
|
|
"action": "scriptExitCode",
|
|
"parameters": {
|
|
"scriptType": "remediation"
|
|
},
|
|
"description": "Captures the exit code of a remediation script.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-RUN-CONTEXT",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] The policy needs be run as (?<context>System|User)",
|
|
"action": "scriptContext",
|
|
"parameters": {
|
|
"scriptType": "remediation"
|
|
},
|
|
"description": "Captures whether a remediation script runs as System or User context.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-SCRIPT-START",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] ProcessScript PolicyId: (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) PolicyType: (?<policyType>\\d+)",
|
|
"action": "scriptStarted",
|
|
"parameters": {
|
|
"scriptType": "remediation"
|
|
},
|
|
"description": "Detects when a Proactive Remediation (Health Script) starts processing. Captures PolicyId and PolicyType (6 = remediation).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-STDERR",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] err output = (?<output>.*)",
|
|
"action": "scriptOutput",
|
|
"parameters": {
|
|
"scriptType": "remediation",
|
|
"outputType": "stderr"
|
|
},
|
|
"description": "Captures standard error output (stderr) from a remediation script execution.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-STDOUT",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] std output = (?<output>.*)",
|
|
"action": "scriptOutput",
|
|
"parameters": {
|
|
"scriptType": "remediation",
|
|
"outputType": "stdout"
|
|
},
|
|
"description": "Captures standard output (stdout) from a remediation script execution.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-AGENT-VERSION",
|
|
"category": "always",
|
|
"pattern": "Agent version is: (?<agentVersion>[\\d.]+)",
|
|
"action": "imeAgentVersion",
|
|
"description": "Captures the Intune Management Extension agent version number.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ALREADY-DETECTED-1",
|
|
"category": "otherPhases",
|
|
"pattern": "\\[Win32App\\] Completed detectionManager SideCar\\w+?DetectionManager, applicationDetectedByCurrentRule: True",
|
|
"action": "ignoreCompletedApp",
|
|
"description": "Detects when an app from a previous ESP phase is detected as already installed, so it should be ignored in the current phase.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ALREADY-DETECTED-2",
|
|
"category": "otherPhases",
|
|
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
|
|
"action": "ignoreCompletedApp",
|
|
"description": "Detects enforcement success in a non-current phase, indicating an app completed in a previous phase should be ignored.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DECRYPT-FAILED",
|
|
"category": "currentPhase",
|
|
"pattern": "Decryption is failed for appId {GUID}",
|
|
"action": "updateStateError",
|
|
"description": "Detects when app content decryption fails, indicating a corrupted or tampered download.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DETECTED-INSTALLED-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DetectionState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"Installed\"\"",
|
|
"action": "updateStateInstalled",
|
|
"description": "Detects when an app's detection state transitions to Installed (new ReportingManager format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DETECTED-INSTALLED-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: {GUID} resulted in action status: Success and detection state: Detected",
|
|
"action": "updateStateInstalled",
|
|
"description": "Detects when an app's detection action handler reports successful detection (app is installed).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DETECTED-OLD",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Detected app {GUID} ",
|
|
"action": "updateStateInstalled",
|
|
"description": "Detects when an app is detected as installed (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DO-TEL",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[DO TEL\\] = (?<doTelJson>\\{.*\\})",
|
|
"action": "updateDoTelemetry",
|
|
"description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DO-TIMEOUT-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b).*?intunewin-bin_{GUID}",
|
|
"action": "updateStatePostponed",
|
|
"description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in filename).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DO-TIMEOUT-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b)",
|
|
"action": "updateStatePostponed",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when a Delivery Optimization download times out (generic, uses current app context).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DOWNLOADING",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[StatusService\\] Downloading app \\(id = {GUID}.*?\\) via (?<tech>\\w+), bytes (?<bytes>\\w+)/(?<ofbytes>\\w+) for user",
|
|
"action": "updateStateDownloading",
|
|
"description": "Captures app download progress including technology (DO/CDN), bytes downloaded, and total bytes.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ENFORCEMENT-SUCCESS",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"InProgressDownloadCompleted\"\",\"\"NewValue\"\":\"\"Success\"\"",
|
|
"action": "updateStateInstalled",
|
|
"description": "Detects when an app's enforcement state transitions from InProgressDownloadCompleted to Success.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ENFORCEMENT-SUCCESS-OLD",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
|
|
"action": "updateStateInstalled",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when enforcement state is set to Success for the current app (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-DOWNLOAD",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Download state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"InProgress\"\",\"\"NewValue\"\":\"\"ErrorDownloadingContent\"\"",
|
|
"action": "updateStateError",
|
|
"description": "Detects when an app's enforcement state transitions to ErrorDownloadingContent.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-ENFORCEMENT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Error\\b",
|
|
"action": "updateStateError",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when enforcement state is set to Error for the current app (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-NO-CONTENT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Didn't get content info from service",
|
|
"action": "updateStateError",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when IME cannot retrieve content info from the Intune service for the current app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-REPORT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"(?<from>\\w+)\"\",\"\"NewValue\"\":\"\"(?<to>\\w+)\"\"",
|
|
"action": "updateStateError",
|
|
"parameters": {
|
|
"checkTo": "true"
|
|
},
|
|
"description": "Captures enforcement state transitions via ReportingManager. Only triggers error when 'to' value indicates an error state.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-TIMEOUT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Installation is timeout",
|
|
"action": "updateStateError",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when an app installation times out.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-UNMAPPED-EXIT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Admin did NOT set mapping for lpExitCode\\W+\\d+ of app\\W+{GUID}",
|
|
"action": "updateStateError",
|
|
"description": "Detects when an app installer returned an exit code that has no mapping configured in Intune.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ESP-PHASE",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] (?:In|The) EspPhase: (?<espPhase>\\w+)",
|
|
"action": "espPhaseDetected",
|
|
"description": "Detects ESP phase transitions reported by IME Win32App processing (e.g., DeviceSetup, AccountSetup).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ESP-TRACK-STATUS",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}\\.",
|
|
"action": "espTrackStatus",
|
|
"description": "Captures ESP tracked install status transitions (e.g., InProgress to Installed) for a specific app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-IMPERSONATION",
|
|
"category": "always",
|
|
"pattern": "After impersonation: (?<user>.*?)$",
|
|
"action": "imeImpersonation",
|
|
"description": "Detects when IME impersonates a user context for app installation.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-INSTALL-HANDLER",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ExecutionActionHandler\\] Handler invoked with execution type: Install for policy with id: {GUID}",
|
|
"action": "updateStateInstalling",
|
|
"description": "Detects when the IME execution handler starts installing an app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-LAUNCH-INSTALLER",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Launch Win32AppInstaller in \\w+? session",
|
|
"action": "updateStateInstalling",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when the Win32 app installer process is launched in a user or system session.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NO-ACTION",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] No action required for app with id: {GUID}",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when IME determines no action is required for an app (already in desired state).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-APPLICABLE-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ApplicabilityActionHandler\\] Applicability check for policy with id: {GUID} resulted in action status: Success and applicability state: NotApplicable",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's applicability check returns NotApplicable (requirements not met).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-APPLICABLE-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Applicability state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"ApplicabilityState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"ScriptRequirementRuleNotMet\"\"",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's applicability state is set to ScriptRequirementRuleNotMet (PowerShell requirement script returned false).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-APPLICABLE-3",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DesiredState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"None\"\"",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's desired state is set to None (not targeted or not applicable).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-APPLICABLE-4",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DesiredState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"NotPresent\"\"",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's desired state is set to NotPresent (targeted for uninstall or not required).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-TARGETED-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, targeted intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app with RequiredInstall intent is classified as NotApplicableOrNotTargeted (new log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-TARGETED-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, effective intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app with effective RequiredInstall intent is classified as NotApplicableOrNotTargeted.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-POLICIES",
|
|
"category": "currentPhase",
|
|
"pattern": "Get policies =\\s*(?<policies>.*)",
|
|
"action": "policiesDiscovered",
|
|
"description": "Captures the JSON policies list discovered by IME, used to build the app inventory.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SESSION-CHANGE",
|
|
"category": "always",
|
|
"pattern": "OnSessionChange:? (?<change>.*?)$",
|
|
"action": "imeSessionChange",
|
|
"description": "Detects Windows session change events (logon, logoff, lock, unlock) reported by IME.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SET-CURRENT-1",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name",
|
|
"action": "setCurrentApp",
|
|
"description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SET-CURRENT-2",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?\\bid\\W+{GUID}",
|
|
"action": "setCurrentApp",
|
|
"description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SET-CURRENT-3",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] ===Step=== Start to Present app {GUID}",
|
|
"action": "setCurrentApp",
|
|
"description": "Detects the start of app presentation step in IME, setting the app as current.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SET-CURRENT-4",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] SetCurrentDirectory:.*?\\\\{GUID}_\\d+",
|
|
"action": "setCurrentApp",
|
|
"description": "Detects when IME sets the working directory for an app's staging folder, setting it as current.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SHUTDOWN",
|
|
"category": "currentPhase",
|
|
"pattern": "EMS Agent received shutdown signal",
|
|
"action": "updateStatePostponed",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when the IME agent receives a shutdown signal, postponing the current app installation.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-APPLICABILITY-NOTMET",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] (?=.*?\\bapplicability\\b)(?=.*?NotMet\\b).*?\\bapp\\W+{GUID}\\b",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-DEPENDENCY-DETECT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] app\\W+{GUID}\\b.*?\\bis a dependency\\b.*?\\bDetect Only mode\\b.*?\\bfinished processing",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-DETECTED",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Detected app {GUID}.*?skip next step",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an already-detected app is skipped for further processing steps (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-FILTERS",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[V3Processor\\] All apps in the subgraph are not applicable due to assignment filters\\. Skipping processing\\.",
|
|
"action": "updateStateSkipped",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when all apps in a subgraph are skipped due to assignment filter exclusions.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-INSTALL-DETECTED",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Detected app {GUID} and intent is to install, skip applicability check",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app targeted for install is already detected/installed, so the install is skipped (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-UNINSTALL-NOTDETECTED",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Not detected app {GUID} and intent is to un-install, skip applicability check",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app targeted for uninstall is not detected, so the uninstall is skipped (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-UNINSTALL-NOTDETECTED-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] NOT detected app {GUID}.*?skip un-installation",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app is not detected and uninstall is skipped (alternate old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-STARTED",
|
|
"category": "always",
|
|
"pattern": "EMS Agent Started",
|
|
"action": "imeStarted",
|
|
"description": "Detects when the Intune Management Extension (IME) agent starts up.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SUBGRAPH",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[V3Processor\\] Processing subgraph with app ids: {GUID}",
|
|
"action": "cancelStuckAndSetCurrent",
|
|
"description": "Detects when V3Processor starts a new subgraph, cancelling any stuck app and setting the new app as current.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-TOKEN-SUCCESS",
|
|
"category": "always",
|
|
"pattern": "Successfully get the token",
|
|
"action": "espPhaseDetected",
|
|
"parameters": {
|
|
"phase": "AccountSetup"
|
|
},
|
|
"description": "Detects successful token acquisition, indicating the AccountSetup ESP phase has started.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-UPDATE-NAME-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?name\\W+(?<name>.*?)\\W+id\\W+{GUID}",
|
|
"action": "updateName",
|
|
"description": "Captures the app name from ExecManager processing log (old format: name before id).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-UPDATE-NAME-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name (?<name>.*?)$",
|
|
"action": "updateName",
|
|
"description": "Captures the app name from ProcessAppWithDependencies log entry.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-UPDATE-NAME-3",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Processing app \\(id={GUID}, name = (?<name>.*?)\\)",
|
|
"action": "updateName",
|
|
"description": "Captures the app name from the Processing app log entry.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-USER-SESSION-COMPLETED",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] \\.+ Completed user session \\d+, userId: (?<userId>[a-f0-9\\-]+), userSID: (?<userSid>S-[\\d\\-]+) \\.+",
|
|
"action": "enrollmentCompleted",
|
|
"description": "Detects when IME completes a user session, indicating enrollment has finished for that user.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-WIN32-STATE-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Got InstanceID: Win32App_{GUID}_\\d+, installationStateString: (?<state>\\d)",
|
|
"action": "updateWin32AppState",
|
|
"description": "Captures the Win32 app installation state string from instance ID tracking (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-WIN32-STATE-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] (?:Got|Set) (?:ESP )?win32App state (?<state>\\w+) for {GUID}",
|
|
"action": "updateWin32AppState",
|
|
"description": "Captures the Win32 app ESP state (e.g., Installed, InProgress) for a specific app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-WINGET-INSTALLING-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID} and user = .*?- Operation Phase = Installing",
|
|
"action": "updateStateInstalling",
|
|
"description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 1).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-WINGET-INSTALLING-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID}.*?- Operation Phase = Installing",
|
|
"action": "updateStateInstalling",
|
|
"description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 2).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-AGENT-ERROR",
|
|
"category": "always",
|
|
"pattern": "error from script =(?<output>.*)",
|
|
"action": "scriptOutput",
|
|
"parameters": {
|
|
"scriptType": "platform",
|
|
"outputType": "stderr"
|
|
},
|
|
"description": "Captures error output from AgentExecutor.log when a platform script produces stderr content.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-AGENT-EXITCODE",
|
|
"category": "always",
|
|
"pattern": "Powershell exit code is (?<exitCode>-?\\d+)",
|
|
"action": "scriptExitCode",
|
|
"parameters": {
|
|
"scriptType": "platform"
|
|
},
|
|
"description": "Captures the PowerShell exit code from AgentExecutor.log.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-AGENT-OUTPUT",
|
|
"category": "always",
|
|
"pattern": "write output done\\. output = (?<output>.*), error = (?<error>.*)",
|
|
"action": "scriptOutput",
|
|
"parameters": {
|
|
"scriptType": "platform"
|
|
},
|
|
"description": "Captures both stdout and stderr from AgentExecutor.log when a platform script completes. The output group contains stdout, the error group contains stderr.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-AGENT-SCRIPT-START",
|
|
"category": "always",
|
|
"pattern": "Adding argument powershell with value C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1",
|
|
"action": "scriptStarted",
|
|
"parameters": {
|
|
"scriptType": "platform",
|
|
"source": "agentexecutor"
|
|
},
|
|
"description": "Detects platform script identification in AgentExecutor.log. Captures PolicyId from the script file path for stdout/stderr correlation.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-SCRIPT-CONTEXT",
|
|
"category": "always",
|
|
"pattern": "Launch powershell executor in (?<context>machine|user) session",
|
|
"action": "scriptContext",
|
|
"description": "Captures whether a PowerShell script runs in machine (System) or user session context.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-SCRIPT-EXITCODE",
|
|
"category": "always",
|
|
"pattern": "Powershell execution is done, exitCode = (?<exitCode>-?\\d+)",
|
|
"action": "scriptExitCode",
|
|
"description": "Captures the PowerShell exit code when script execution completes in the IME log.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-SCRIPT-GENERATED",
|
|
"category": "always",
|
|
"pattern": "Script file C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1 is generated",
|
|
"action": "scriptStarted",
|
|
"parameters": {
|
|
"scriptType": "platform"
|
|
},
|
|
"description": "Detects when a platform PowerShell script file is generated by IME. Captures the PolicyId from the script file path.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-SCRIPT-RESULT",
|
|
"category": "always",
|
|
"pattern": "\\[PowerShell\\] User Id = [a-z0-9\\-]+, Policy id = (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}), policy result = (?<result>\\w+)",
|
|
"action": "scriptCompleted",
|
|
"parameters": {
|
|
"scriptType": "platform"
|
|
},
|
|
"description": "Captures the final result (Success/Failed) of a platform PowerShell script execution with its PolicyId.",
|
|
"enabled": true
|
|
}
|
|
]
|
|
}
|