Oliver Kieselbach
a70785fb42
- Retire ANALYZE-ESP-003 (duplicate of ESP-001) and ANALYZE-CORR-002 (duplicate of APP-004) via the established sunset path; ESP-001 gains a >60min factor, APP-004 absorbs the co-occurrence story with working confidence factors - CORR-003: download evidence (errorPatternId) is now a required condition — no more firing on proxy + any unrelated app failure - DEV-002 v2: 'sustained' semantics — new event_count value filter (filterField/filterOperator/filterValue in schema, Shared model, engine, web types) requires >=3 snapshots above 90% memory instead of one transient spike - DEV-003 v2: build-cutoff-only condition (<=22621) now also covers Windows 10; LTSC caveat + maintenance note (raise to 22631 after 2026-11-10) - SEC-001 v2: rewritten for the post-June-2026 reality — certificates HAVE expired, active remediation required (OEM firmware hint added) - SEC-005/006 v2.1: allow-list extended with OEM factory-preload families (Intel PPM, AMD Power, Lenovo ThinkPad power/battery, Surface/carrier), telemetry-curated from 1780 fired sessions; imaging leftovers (USMT.PPKG, InstallOrder.ini) and generic names deliberately still alert - APP-001: suppressByEvent on app_install_completed; APP-002: exact MSI exit codes instead of bare 16xx; APP-006 reframed as 'App Install Retry Loop'; ID-001: title/logic mismatch fixed + GATHER-ID-002 dependency documented - Fix all 13 dead confidence factors (signal-name mismatches / unsupported syntax) by rewiring or removal; version bumps everywhere so seeding propagates the updates - New RuleEngineEventCountFilterTests + SEC-005 OEM allow-list coverage Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Autopilot Monitor
Advanced monitoring and troubleshooting solution for Windows Autopilot deployments. Gain full visibility into every enrollment session with a detailed event timeline, fleet health dashboards, and session reporting. Define custom analysis rules to automatically detect issues and gather rules to collect targeted evidence. Retrieve diagnostics packages on demand, configure agent settings like auto-reboot behavior and automatic timezone adjustment — all managed centrally from the web dashboard.
Private Preview
Autopilot Monitor is currently running as a Private Preview. Visit autopilotmonitor.com to request access and learn more.
Overview
Autopilot Monitor provides real-time tracking, intelligent diagnostics, and automated troubleshooting for Windows Autopilot enrollment processes. It consists of:
- Bootstrap Script — PowerShell script deployed via Intune that starts monitoring early in the enrollment process
- Monitoring Agent — Lightweight .NET application that collects telemetry and evidence during enrollment
- Backend API — Azure Functions-based ingestion and processing pipeline
- Web Dashboard — Next.js application for real-time monitoring and fleet analytics
Architecture
For detailed information about the system architecture, components, and data flow, see Architecture Documentation.
Documentation
Full documentation is available at autopilotmonitor.com/docs
License
This project uses a split licensing model:
- MIT License — Agent (
src/Agent/) and Shared library (src/Shared/) — unrestricted use on end-user devices - AGPL-3.0 — Backend (
src/Backend/), Web Dashboard (src/Web/), and MCP Server (src/McpServer/) — server-side components remain open source
See LICENSE for full details.