Oliver Kieselbach 61892592e4 feat(rules): community rule submissions — submit custom rules from the portal, review via GA page or MCP, publish by repo commit + reseed (D-236) ...

Tenant admins submit references to their own gather/analyze rules; the server freezes the rule, records pre-flight findings and fire stats, and stores it under a 12-character id (RuleSubmissions, SessionReports layout). Attribution is the submitter's frozen choice (anonymous by default) and becomes the published author. Review (approve with reserved id / decline with comment) through /admin/reports/rule-submissions or the MCP tools list_rule_submissions, get_rule_submission, review_rule_submission, reseed_rules_from_github; published is derived from the global catalog, never stored. Analyze rules now get the same server-side author stamp as gather rules; ANALYZE-ID-001 carries author Community. Privacy page names the credit; bumps internal and .claude/commands gitlinks.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-09-09 22:53:32 +02:00

..

ANALYZE-APP-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-007.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-008.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-010.json

feat: externalize rules to GitHub + API consolidation + preview mode

2026-02-28 13:12:09 +01:00

ANALYZE-APP-012.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-013.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-014.json

error-code catalog v2: generated from primary sources, symbols and families, MCP lookup_error_code (D-211/D-212)

2026-09-06 16:24:35 +02:00

ANALYZE-APP-015.json

rules: hybrid user-affinity + never-settled-app detection, dsregcmd on_event snapshot, evidence interpolation fixes

2026-08-14 13:39:16 +02:00

ANALYZE-APP-016.json

fix(agent): recover ESP completion after a forced mid-ESP reboot

2026-08-19 17:00:59 +02:00

ANALYZE-APP-017.json

feat(rules): detect installer-mutex app failures (0x80070652) and SWG-blocked diagnostics uploads

2026-08-27 19:40:17 +02:00

ANALYZE-APP-018.json

exit-code class per app + reboot rule: IME-EXITCODE-CLASS, ANALYZE-APP-018, exitCode on every terminal app event (D-214)

2026-09-06 18:08:49 +02:00

ANALYZE-CORR-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-001.json

feat(rules): built-in analyze-rule hygiene pass ahead of public docs catalog

2026-07-06 12:32:32 +02:00

ANALYZE-DEV-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-007.json

chore: private submodule docs/ becomes internal/ (knowledge + decisions + work files + private instructions)

2026-09-04 02:19:00 +02:00

ANALYZE-DEV-008.json

feat(backend): P6 split - CMTrace skew tripwire + customer clock_skew rule

2026-08-20 22:30:10 +02:00

ANALYZE-DEV-009.json

feat(agent): live power-state watcher + battery analyze rules DEV-009/010

2026-08-21 15:24:41 +02:00

ANALYZE-DEV-010.json

feat(agent): live power-state watcher + battery analyze rules DEV-009/010

2026-08-21 15:24:41 +02:00

ANALYZE-DEV-012.json

fix(agent,rules): AccountSetup activity means observed progress; same-event filter for event_data conditions (q8n)

2026-09-04 13:11:28 +02:00

ANALYZE-ENRL-001.json

feat(rules): built-in analyze-rule hygiene pass ahead of public docs catalog

2026-07-06 12:32:32 +02:00

ANALYZE-ENRL-002.json

rules+backend+mcp: rule-verify sweep fixes (dead factor, {{token}} evidence, stats cap, list stringify)

2026-08-14 16:50:29 +02:00

ANALYZE-ENRL-003.json

chore: private submodule docs/ becomes internal/ (knowledge + decisions + work files + private instructions)

2026-09-04 02:19:00 +02:00

ANALYZE-ENRL-004.json

chore: private submodule docs/ becomes internal/ (knowledge + decisions + work files + private instructions)

2026-09-04 02:19:00 +02:00

ANALYZE-ENRL-005.json

chore: private submodule docs/ becomes internal/ (knowledge + decisions + work files + private instructions)

2026-09-04 02:19:00 +02:00

ANALYZE-ESP-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-004.json

fix(rules,engine,agent): ESP-004 gates on the esp_apps_timeout verdict; not_exists absence gate; Shell-Core failure inherits settle detail (D-234, D-235)

2026-09-09 17:20:24 +02:00

ANALYZE-ESP-005.json

fix(agent): recover ESP completion after a forced mid-ESP reboot

2026-08-19 17:00:59 +02:00

ANALYZE-ESP-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-001.json

feat(rules): community rule submissions — submit custom rules from the portal, review via GA page or MCP, publish by repo commit + reseed (D-236)

2026-09-09 22:53:32 +02:00

ANALYZE-ID-002.json

fix(security): LocalAdminAnalyzer never exempts a logged-in local SAM account from the shutdown scan (CWE-807) and matches built-ins by well-known RID so localized Guest/Administrator are not flagged

2026-08-30 01:42:51 +02:00

ANALYZE-ID-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-004.json

agent+rules: Hybrid Join user affinity from the IME user token; IME backlog eras anchored by the bootstrap record

2026-09-04 21:12:56 +02:00

ANALYZE-NET-001.json

feat(rules): detect installer-mutex app failures (0x80070652) and SWG-blocked diagnostics uploads

2026-08-27 19:40:17 +02:00

ANALYZE-OFFICE-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-007.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-008.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00