mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-25 21:19:38 +00:00
Oliver Kieselbach
19 lines
1.1 KiB
JSON
19 lines
1.1 KiB
JSON
{
|
|
"$schema": "../schema/gather-rule.schema.json",
|
|
"ruleId": "GATHER-ID-002",
|
|
"title": "Machine certificate store (PowerShell)",
|
|
"description": "Enumerates certificates in the local machine personal store (Cert:\\LocalMachine\\My) using PowerShell. Returns structured JSON with subject, thumbprint, issuer, and validity dates for each certificate. Useful for verifying MDM enrollment certificates, SCEP certificates, and any other machine certificates provisioned during Autopilot enrollment.",
|
|
"category": "identity",
|
|
"version": "1.0.0",
|
|
"author": "Community",
|
|
"isCommunity": true,
|
|
"enabled": true,
|
|
"collectorType": "command_allowlisted",
|
|
"target": "$c = Get-ChildItem Cert:\\LocalMachine\\My; if ($c) { $c | Select-Object Subject, Thumbprint, Issuer, NotBefore, NotAfter, HasPrivateKey | ConvertTo-Json } else { '{\"CertificateCount\": 0}' }",
|
|
"trigger": "phase_change",
|
|
"triggerPhase": "FinalizingSetup",
|
|
"outputEventType": "gather_machine_cert_store",
|
|
"outputSeverity": "Info",
|
|
"tags": ["identity", "certificates", "machine-store", "powershell"]
|
|
}
|