mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-25 13:10:13 +00:00
Oliver Kieselbach
11 lines
574 B
JSON
11 lines
574 B
JSON
{
|
|
"$schema": "../schema/ime-log-pattern.schema.json",
|
|
"patternId": "PS-AGENT-SCRIPT-START",
|
|
"category": "always",
|
|
"pattern": "Adding argument powershell with value C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1",
|
|
"action": "scriptStarted",
|
|
"parameters": { "scriptType": "platform", "source": "agentexecutor" },
|
|
"description": "Detects platform script identification in AgentExecutor.log. Captures PolicyId from the script file path for stdout/stderr correlation.",
|
|
"enabled": true
|
|
}
|