gsadmin/AutopilotMonitor
1
0
Fork 0
mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-25 13:10:13 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
a88db34af5fc8a7690b43f2a2bbfe1aaa05df5cd
AutopilotMonitor/rules/dist/ime-log-patterns.json
T
Oliver Kieselbach 474af7f78c fix(agent): ESP-Apps failure correlation + platform-script stdout/exit contamination 
Two V2 IME fixes, verified against client logs of sessions fc48c71a / 6b4993e5.

Bug 1 — on an ESP terminal failure of the DeviceSetup Apps subcategory the only
device app was stuck mid-install (RealmJoin stuck Downloading 0%) and IME logged
no per-app error, so app_tracking_summary showed 0 failed and the failure was
visible only via the opaque "Apps (Error)" registry string. New
esp_apps_failure_correlation event names the in-flight (IsActive: InProgress/
Downloading/Installing) device app(s) as the likely cause WITHOUT mutating state
(no fabricated app_install_failed) and only on the Apps subcategory.

Bug 2 — AgentExecutor.exe hosts both platform and proactive-remediation scripts
interleaved in the shared AgentExecutor.log; the policyId-less PS-AGENT-EXITCODE /
PS-AGENT-OUTPUT lines from a remediation invocation bled into the last-started
platform script via the sticky pointer (c3e0124c emitted result=Failed but with
exit 0 + the Teams remediation's "[Compliant] No Classic Teams found" stdout).
New PS-AGENT-INVOCATION pattern (resetPlatformScriptContext) clears the platform
line-capture pointer at every "ExecutorLog AgentExecutor gets invoked" boundary,
so a remediation invocation cannot capture into a platform slot; the platform
result stays keyed by policyId via PS-SCRIPT-RESULT.

Agent-only, V2, inert until redeploy; no ConfigVersion bump. New event type added
to the MCP resource catalog (dual-sync). Green: V2.Core 1522, DecisionCore 400,
Backend BuiltInRules 8, MCP vitest 252.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-22 20:37:44 +02:00

720 lines
33 KiB
JSON
Generated
Raw Blame History

{
"$schema": "../schema/ime-log-pattern.schema.json",
"rules": [
{
"patternId": "HS-COMPLIANCE",
"category": "always",
"pattern": "\\[HS\\] the (?<part>pre|post)-remdiation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
"action": "healthScriptDetectionResult",
"parameters": {
"scriptType": "remediation"
},
"description": "Early-signal fallback for health-script detection / post-detection results. Microsoft IME emits this line immediately after each detection script runs, ~30-90 seconds before the consolidated [HS] new result = JSON line is logged (which only fires after IME's batch-send to the Microsoft service). Short Autopilot enrollments often end inside that gap, so this pattern guarantees at least the compliance verdict is captured. The full data version arrives later via HS-NEW-RESULT and replaces this sparse entry through the UI dedupe (dataCompleteness scoring).",
"enabled": true
},
{
"patternId": "HS-EXITCODE",
"category": "always",
"pattern": "\\[HS\\] exit code of the script is (?<exitCode>-?\\d+)",
"action": "scriptExitCode",
"parameters": {
"scriptType": "remediation"
},
"description": "Captures the exit code of a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so the user sees the real exit code (not just the inferred 0/1) before HS-NEW-RESULT arrives.",
"enabled": true
},
{
"patternId": "HS-NEW-RESULT",
"category": "always",
"pattern": "\\[HS\\] new result = (?<json>\\{[\\s\\S]*\\})\\s*$",
"action": "healthScriptResult",
"parameters": {
"scriptType": "remediation"
},
"description": "Atomic final JSON of a health script run, covering all three phases (pre-detection / remediation / post-detection) emitted by IME after the policy completes. Single source of truth for health-script outcomes — replaces the line-by-line HS-COMPLIANCE/HS-EXITCODE/HS-STDOUT/HS-STDERR patterns. The end-anchor and [\\s\\S] character class are defensive against future format changes and multi-line CMTrace buffering.",
"enabled": true
},
{
"patternId": "HS-RUN-CONTEXT",
"category": "always",
"pattern": "\\[HS\\] The policy needs be run as (?<context>System|User)",
"action": "scriptContext",
"parameters": {
"scriptType": "remediation"
},
"description": "Captures the execution context (System or User) for a health-script. Feeds the early-signal slot consumed by HS-COMPLIANCE so context is visible immediately rather than waiting for HS-NEW-RESULT (which exposes RunAsAccount).",
"enabled": true
},
{
"patternId": "HS-SCRIPT-START",
"category": "always",
"pattern": "\\[HS\\] ProcessScript PolicyId: (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) PolicyType: (?<policyType>\\d+)",
"action": "scriptStarted",
"parameters": {
"scriptType": "remediation"
},
"description": "Detects when a Proactive Remediation (Health Script) starts processing. Captures PolicyId and PolicyType (6 = remediation). Drives the live script_started event for UI progress indication; the consolidated final result for the same PolicyId arrives later via HS-NEW-RESULT.",
"enabled": true
},
{
"patternId": "HS-STDERR",
"category": "always",
"pattern": "\\[HS\\] err output = (?<output>.*)",
"action": "scriptOutput",
"parameters": {
"scriptType": "remediation",
"outputType": "stderr"
},
"description": "Captures standard error from a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so stderr is visible immediately rather than waiting for HS-NEW-RESULT.",
"enabled": true
},
{
"patternId": "HS-STDOUT",
"category": "always",
"pattern": "\\[HS\\] std output = (?<output>.*)",
"action": "scriptOutput",
"parameters": {
"scriptType": "remediation",
"outputType": "stdout"
},
"description": "Captures standard output from a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so the user sees stdout immediately rather than waiting for HS-NEW-RESULT.",
"enabled": true
},
{
"patternId": "IME-AGENT-VERSION",
"category": "always",
"pattern": "Agent version is: (?<agentVersion>[\\d.]+)",
"action": "imeAgentVersion",
"description": "Captures the Intune Management Extension agent version number.",
"enabled": true
},
{
"patternId": "IME-ALREADY-DETECTED-1",
"category": "otherPhases",
"pattern": "\\[Win32App\\] Completed detectionManager SideCar\\w+?DetectionManager, applicationDetectedByCurrentRule: True",
"action": "ignoreCompletedApp",
"description": "Detects when an app from a previous ESP phase is detected as already installed, so it should be ignored in the current phase.",
"enabled": true
},
{
"patternId": "IME-ALREADY-DETECTED-2",
"category": "otherPhases",
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
"action": "ignoreCompletedApp",
"description": "Detects enforcement success in a non-current phase, indicating an app completed in a previous phase should be ignored.",
"enabled": true
},
{
"patternId": "IME-APP-TYPE-MSI",
"category": "always",
"pattern": "\\[Win32App\\].*?\\bMSI App (?<id>{GUID})",
"action": "captureAppTypeMsi",
"description": "Detects an MSI-based Win32 app via the 'MSI App <guid>' phrase in the ESP retry configuration line. Marks AppType as 'MSI' for that app id.",
"enabled": true
},
{
"patternId": "IME-APP-TYPE-WINGET",
"category": "always",
"pattern": "\\[Win32App\\]\\[WinGetApp\\].*?app with id: (?<id>{GUID})",
"action": "captureAppTypeWinGet",
"description": "Detects a WinGet-backed Store app by any [Win32App][WinGetApp] handler log line (Detection/Applicability/Operation). Marks AppType as 'WinGet' for that app id.",
"enabled": true
},
{
"patternId": "IME-APP-VERSION",
"category": "always",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: (?<id>{GUID}).*?\"DetectedIdentityVersion\":\\{[^}]*?\"NewValue\":\"(?<appVersion>[^\"]+)\"",
"action": "captureAppVersion",
"description": "Captures the product version IME detected after an app install (e.g. \"11.2.1787.0\"). Source: [ReportingManager] Detection state update with DetectedIdentityVersion.NewValue. Used by App Dashboard to show version-level failure breakdowns.",
"enabled": true
},
{
"patternId": "IME-ATTEMPT-NUMBER",
"category": "currentPhase",
"pattern": "\\[Win32App\\] ===Step=== Execute retry (?<attempt>\\d+)$",
"action": "captureAttemptNumber",
"parameters": {
"useCurrentApp": "true"
},
"description": "Captures the install attempt number for the current app. IME logs 'Execute retry 0' for the first attempt and increments on each retry. Reported as attempt+1 so retry 0 becomes AttemptNumber=1 (human-friendly: first attempt).",
"enabled": true
},
{
"patternId": "IME-DECRYPT-FAILED",
"category": "currentPhase",
"pattern": "Decryption is failed for appId {GUID}",
"action": "updateStateError",
"description": "Detects when app content decryption fails, indicating a corrupted or tampered download.",
"enabled": true
},
{
"patternId": "IME-DETECTED-INSTALLED-1",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DetectionState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"Installed\"\"",
"action": "updateStateInstalled",
"description": "Detects when an app's detection state transitions to Installed (new ReportingManager format).",
"enabled": true
},
{
"patternId": "IME-DETECTED-INSTALLED-2",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: {GUID} resulted in action status: Success and detection state: Detected",
"action": "updateStateInstalled",
"description": "Detects when an app's detection action handler reports successful detection (app is installed).",
"enabled": true
},
{
"patternId": "IME-DETECTED-OLD",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Detected app {GUID} ",
"action": "updateStateInstalled",
"description": "Detects when an app is detected as installed (old log format).",
"enabled": true
},
{
"patternId": "IME-DETECTION-RESULT",
"category": "always",
"pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: (?<id>{GUID}) resulted in action status: Success and detection state: (?<detection>Detected|NotDetected)",
"action": "captureDetectionResult",
"description": "Captures the detection rule result after IME runs detection for an app. 'Detected' means the detection rule matched (app is installed), 'NotDetected' means it did not. Excludes [SimulatedDetectionActionHandler] which fires during applicability pre-checks.",
"enabled": true
},
{
"patternId": "IME-DO-TEL",
"category": "currentPhase",
"pattern": "\\[DO TEL\\] = (?<doTelJson>\\{.*\\})",
"action": "updateDoTelemetry",
"description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration.",
"enabled": true
},
{
"patternId": "IME-DO-TIMEOUT-1",
"category": "currentPhase",
"pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b).*?intunewin-bin_{GUID}",
"action": "updateStatePostponed",
"description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in filename).",
"enabled": true
},
{
"patternId": "IME-DO-TIMEOUT-2",
"category": "currentPhase",
"pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b)",
"action": "updateStatePostponed",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when a Delivery Optimization download times out (generic, uses current app context).",
"enabled": true
},
{
"patternId": "IME-DOWNLOADING",
"category": "currentPhase",
"pattern": "\\[StatusService\\] Downloading app \\(id = {GUID}.*?\\) via (?<tech>\\w+), bytes (?<bytes>\\w+)/(?<ofbytes>\\w+) for user",
"action": "updateStateDownloading",
"description": "Captures app download progress including technology (DO/CDN), bytes downloaded, and total bytes.",
"enabled": true
},
{
"patternId": "IME-ENFORCEMENT-SUCCESS",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"InProgressDownloadCompleted\"\",\"\"NewValue\"\":\"\"Success\"\"",
"action": "updateStateInstalled",
"description": "Detects when an app's enforcement state transitions from InProgressDownloadCompleted to Success.",
"enabled": true
},
{
"patternId": "IME-ENFORCEMENT-SUCCESS-OLD",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
"action": "updateStateInstalled",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when enforcement state is set to Success for the current app (old log format).",
"enabled": true
},
{
"patternId": "IME-ERROR-DOWNLOAD",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Download state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"InProgress\"\",\"\"NewValue\"\":\"\"ErrorDownloadingContent\"\"",
"action": "updateStateError",
"description": "Detects when an app's enforcement state transitions to ErrorDownloadingContent.",
"enabled": true
},
{
"patternId": "IME-ERROR-ENFORCEMENT",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Error\\b",
"action": "updateStateError",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when enforcement state is set to Error for the current app (old log format).",
"enabled": true
},
{
"patternId": "IME-ERROR-NO-CONTENT",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Didn't get content info from service",
"action": "updateStateError",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when IME cannot retrieve content info from the Intune service for the current app.",
"enabled": true
},
{
"patternId": "IME-ERROR-REPORT",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"(?<from>\\w+)\"\",\"\"NewValue\"\":\"\"(?<to>\\w+)\"\"",
"action": "updateStateError",
"parameters": {
"checkTo": "true"
},
"description": "Captures enforcement state transitions via ReportingManager. Only triggers error when 'to' value indicates an error state.",
"enabled": true
},
{
"patternId": "IME-ERROR-TIMEOUT",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Installation is timeout",
"action": "updateStateError",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when an app installation times out.",
"enabled": true
},
{
"patternId": "IME-ERROR-UNMAPPED-EXIT",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Admin did NOT set mapping for lpExitCode\\W+(?<exitCode>\\d+) of app\\W+{GUID}",
"action": "updateStateError",
"description": "Detects when an app installer returned an exit code that has no mapping configured in Intune.",
"enabled": true
},
{
"patternId": "IME-ESP-PHASE",
"category": "always",
"pattern": "\\[Win32App\\] (?:In|The) EspPhase: (?<espPhase>\\w+)",
"action": "espPhaseDetected",
"description": "Detects ESP phase transitions reported by IME Win32App processing (e.g., DeviceSetup, AccountSetup).",
"enabled": true
},
{
"patternId": "IME-ESP-TRACK-STATUS",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}\\.",
"action": "espTrackStatus",
"description": "Captures ESP tracked install status transitions (e.g., InProgress to Installed) for a specific app.",
"enabled": true
},
{
"patternId": "IME-EXITCODE",
"category": "currentPhase",
"pattern": "\\[Win32App\\] lpExitCode (?<exitCode>-?\\d+)$",
"action": "captureExitCode",
"parameters": {
"useCurrentApp": "true"
},
"description": "Captures the installer exit code (lpExitCode) for the current app.",
"enabled": true
},
{
"patternId": "IME-HRESULT",
"category": "currentPhase",
"pattern": "\\[Win32App\\] hResultFromWin32 (?<hresult>-?\\d+)$",
"action": "captureHResult",
"parameters": {
"useCurrentApp": "true"
},
"description": "Captures the Win32 HRESULT for the current app.",
"enabled": true
},
{
"patternId": "IME-IMPERSONATION",
"category": "always",
"pattern": "After impersonation: (?<user>.*?)$",
"action": "imeImpersonation",
"description": "Detects when IME impersonates a user context for app installation.",
"enabled": true
},
{
"patternId": "IME-INSTALL-HANDLER",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ExecutionActionHandler\\] Handler invoked with execution type: Install for policy with id: {GUID}",
"action": "updateStateInstalling",
"description": "Detects when the IME execution handler starts installing an app.",
"enabled": true
},
{
"patternId": "IME-LAUNCH-INSTALLER",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Launch Win32AppInstaller in \\w+? session",
"action": "updateStateInstalling",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when the Win32 app installer process is launched in a user or system session.",
"enabled": true
},
{
"patternId": "IME-NO-ACTION",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] No action required for app with id: {GUID}",
"action": "updateStateSkipped",
"description": "Detects when IME determines no action is required for an app (already in desired state).",
"enabled": true
},
{
"patternId": "IME-NOT-APPLICABLE-1",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ApplicabilityActionHandler\\] Applicability check for policy with id: {GUID} resulted in action status: Success and applicability state: NotApplicable",
"action": "updateStateSkipped",
"description": "Detects when an app's applicability check returns NotApplicable (requirements not met).",
"enabled": true
},
{
"patternId": "IME-NOT-APPLICABLE-2",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Applicability state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"ApplicabilityState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"ScriptRequirementRuleNotMet\"\"",
"action": "updateStateSkipped",
"description": "Detects when an app's applicability state is set to ScriptRequirementRuleNotMet (PowerShell requirement script returned false).",
"enabled": true
},
{
"patternId": "IME-NOT-APPLICABLE-3",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DesiredState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"None\"\"",
"action": "updateStateSkipped",
"description": "Detects when an app's desired state is set to None (not targeted or not applicable).",
"enabled": true
},
{
"patternId": "IME-NOT-APPLICABLE-4",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DesiredState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"NotPresent\"\"",
"action": "updateStateSkipped",
"description": "Detects when an app's desired state is set to NotPresent (targeted for uninstall or not required).",
"enabled": true
},
{
"patternId": "IME-NOT-TARGETED-1",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, targeted intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
"action": "updateStateSkipped",
"description": "Detects when an app with RequiredInstall intent is classified as NotApplicableOrNotTargeted (new log format).",
"enabled": true
},
{
"patternId": "IME-NOT-TARGETED-2",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, effective intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
"action": "updateStateSkipped",
"description": "Detects when an app with effective RequiredInstall intent is classified as NotApplicableOrNotTargeted.",
"enabled": true
},
{
"patternId": "IME-POLICIES",
"category": "currentPhase",
"pattern": "Get policies =\\s*(?<policies>.*)",
"action": "policiesDiscovered",
"description": "Captures the JSON policies list discovered by IME, used to build the app inventory.",
"enabled": true
},
{
"patternId": "IME-SESSION-CHANGE",
"category": "always",
"pattern": "OnSessionChange:? (?<change>.*?)$",
"action": "imeSessionChange",
"description": "Detects Windows session change events (logon, logoff, lock, unlock) reported by IME.",
"enabled": true
},
{
"patternId": "IME-SET-CURRENT-1",
"category": "always",
"pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name",
"action": "setCurrentApp",
"description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app.",
"enabled": true
},
{
"patternId": "IME-SET-CURRENT-2",
"category": "always",
"pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?\\bid\\W+{GUID}",
"action": "setCurrentApp",
"description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current.",
"enabled": true
},
{
"patternId": "IME-SET-CURRENT-3",
"category": "always",
"pattern": "\\[Win32App\\] ===Step=== Start to Present app {GUID}",
"action": "setCurrentApp",
"description": "Detects the start of app presentation step in IME, setting the app as current.",
"enabled": true
},
{
"patternId": "IME-SET-CURRENT-4",
"category": "always",
"pattern": "\\[Win32App\\] SetCurrentDirectory:.*?\\\\{GUID}_\\d+",
"action": "setCurrentApp",
"description": "Detects when IME sets the working directory for an app's staging folder, setting it as current.",
"enabled": true
},
{
"patternId": "IME-SHUTDOWN",
"category": "currentPhase",
"pattern": "EMS Agent received shutdown signal",
"action": "updateStatePostponed",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when the IME agent receives a shutdown signal, postponing the current app installation.",
"enabled": true
},
{
"patternId": "IME-SKIP-APPLICABILITY-NOTMET",
"category": "currentPhase",
"pattern": "\\[Win32App\\] (?=.*?\\bapplicability\\b)(?=.*?NotMet\\b).*?\\bapp\\W+{GUID}\\b",
"action": "updateStateSkipped",
"description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads).",
"enabled": true
},
{
"patternId": "IME-SKIP-DEPENDENCY-DETECT",
"category": "currentPhase",
"pattern": "\\[Win32App\\] app\\W+{GUID}\\b.*?\\bis a dependency\\b.*?\\bDetect Only mode\\b.*?\\bfinished processing",
"action": "updateStateSkipped",
"description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed).",
"enabled": true
},
{
"patternId": "IME-SKIP-DETECTED",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Detected app {GUID}.*?skip next step",
"action": "updateStateSkipped",
"description": "Detects when an already-detected app is skipped for further processing steps (old log format).",
"enabled": true
},
{
"patternId": "IME-SKIP-FILTERS",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[V3Processor\\] All apps in the subgraph are not applicable due to assignment filters\\. Skipping processing\\.",
"action": "updateStateSkipped",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when all apps in a subgraph are skipped due to assignment filter exclusions.",
"enabled": true
},
{
"patternId": "IME-SKIP-INSTALL-DETECTED",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Detected app {GUID} and intent is to install, skip applicability check",
"action": "updateStateSkipped",
"description": "Detects when an app targeted for install is already detected/installed, so the install is skipped (old log format).",
"enabled": true
},
{
"patternId": "IME-SKIP-UNINSTALL-NOTDETECTED",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Not detected app {GUID} and intent is to un-install, skip applicability check",
"action": "updateStateSkipped",
"description": "Detects when an app targeted for uninstall is not detected, so the uninstall is skipped (old log format).",
"enabled": true
},
{
"patternId": "IME-SKIP-UNINSTALL-NOTDETECTED-2",
"category": "currentPhase",
"pattern": "\\[Win32App\\] NOT detected app {GUID}.*?skip un-installation",
"action": "updateStateSkipped",
"description": "Detects when an app is not detected and uninstall is skipped (alternate old log format).",
"enabled": true
},
{
"patternId": "IME-STARTED",
"category": "always",
"pattern": "EMS Agent Started",
"action": "imeStarted",
"description": "Detects when the Intune Management Extension (IME) agent starts up.",
"enabled": true
},
{
"patternId": "IME-SUBGRAPH",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[V3Processor\\] Processing subgraph with app ids: {GUID}",
"action": "cancelStuckAndSetCurrent",
"description": "Detects when V3Processor starts a new subgraph, cancelling any stuck app and setting the new app as current.",
"enabled": true
},
{
"patternId": "IME-TOKEN-SUCCESS",
"category": "always",
"pattern": "Successfully get the token",
"action": "espPhaseDetected",
"parameters": {
"phase": "AccountSetup"
},
"description": "Detects successful token acquisition, indicating the AccountSetup ESP phase has started.",
"enabled": true
},
{
"patternId": "IME-UPDATE-NAME-1",
"category": "currentPhase",
"pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?name\\W+(?<name>.*?)\\W+id\\W+{GUID}",
"action": "updateName",
"description": "Captures the app name from ExecManager processing log (old format: name before id).",
"enabled": true
},
{
"patternId": "IME-UPDATE-NAME-2",
"category": "currentPhase",
"pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name (?<name>.*?)$",
"action": "updateName",
"description": "Captures the app name from ProcessAppWithDependencies log entry.",
"enabled": true
},
{
"patternId": "IME-UPDATE-NAME-3",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Processing app \\(id={GUID}, name = (?<name>.*?)\\)",
"action": "updateName",
"description": "Captures the app name from the Processing app log entry.",
"enabled": true
},
{
"patternId": "IME-USER-SESSION-COMPLETED",
"category": "always",
"pattern": "\\[Win32App\\] \\.+ Completed user session \\d+, userId: (?<userId>[a-f0-9\\-]+), userSID: (?<userSid>S-[\\d\\-]+) \\.+",
"action": "enrollmentCompleted",
"description": "Detects when IME completes a user session, indicating enrollment has finished for that user.",
"enabled": true
},
{
"patternId": "IME-WIN32-STATE-1",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Got InstanceID: Win32App_{GUID}_\\d+, installationStateString: (?<state>\\d)",
"action": "updateWin32AppState",
"description": "Captures the Win32 app installation state string from instance ID tracking (old log format).",
"enabled": true
},
{
"patternId": "IME-WIN32-STATE-2",
"category": "currentPhase",
"pattern": "\\[Win32App\\] (?:Got|Set) (?:ESP )?win32App state (?<state>\\w+) for {GUID}",
"action": "updateWin32AppState",
"description": "Captures the Win32 app ESP state (e.g., Installed, InProgress) for a specific app.",
"enabled": true
},
{
"patternId": "IME-WINGET-INSTALLING-1",
"category": "currentPhase",
"pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID} and user = .*?- Operation Phase = Installing",
"action": "updateStateInstalling",
"description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 1).",
"enabled": true
},
{
"patternId": "IME-WINGET-INSTALLING-2",
"category": "currentPhase",
"pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID}.*?- Operation Phase = Installing",
"action": "updateStateInstalling",
"description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 2).",
"enabled": true
},
{
"patternId": "PS-AGENT-ERROR",
"category": "always",
"pattern": "error from script =(?<output>[\\s\\S]*)",
"action": "scriptOutput",
"parameters": {
"scriptType": "platform",
"outputType": "stderr"
},
"description": "Captures error output from AgentExecutor.log when a platform script produces stderr content.",
"enabled": true
},
{
"patternId": "PS-AGENT-EXITCODE",
"category": "always",
"pattern": "Powershell exit code is (?<exitCode>-?\\d+)",
"action": "scriptExitCode",
"parameters": {
"scriptType": "platform"
},
"description": "Captures the PowerShell exit code from AgentExecutor.log.",
"enabled": true
},
{
"patternId": "PS-AGENT-INVOCATION",
"category": "always",
"pattern": "ExecutorLog AgentExecutor gets invoked",
"action": "resetPlatformScriptContext",
"description": "Marks the start of a new AgentExecutor.exe invocation. AgentExecutor hosts BOTH platform scripts (Policies\\Scripts\\<id>.ps1) and proactive-remediation scripts (IMECache\\HealthScripts\\<id>\\detect.ps1) and writes their lines interleaved into the shared AgentExecutor.log. The policyId-less 'Powershell exit code is N' / 'write output done' lines are otherwise routed to the last-started platform script via a sticky pointer, so a remediation invocation (whose start line does not match PS-AGENT-SCRIPT-START) leaks its exit/output into that platform script's result. This pattern resets the platform-script line-capture context at each invocation boundary so only the matching platform invocation captures its own exit/output.",
"enabled": true
},
{
"patternId": "PS-AGENT-OUTPUT",
"category": "always",
"pattern": "write output done\\. output = (?<output>[\\s\\S]*?), error = (?<error>[\\s\\S]*)",
"action": "scriptOutput",
"parameters": {
"scriptType": "platform"
},
"description": "Captures both stdout and stderr from AgentExecutor.log when a platform script completes. The output group contains stdout, the error group contains stderr.",
"enabled": true
},
{
"patternId": "PS-AGENT-SCRIPT-START",
"category": "always",
"pattern": "Adding argument powershell with value C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1",
"action": "scriptStarted",
"parameters": {
"scriptType": "platform",
"source": "agentexecutor"
},
"description": "Detects platform script identification in AgentExecutor.log. Captures PolicyId from the script file path for stdout/stderr correlation.",
"enabled": true
},
{
"patternId": "PS-SCRIPT-CONTEXT",
"category": "always",
"pattern": "Launch powershell executor in (?<context>machine|user) session",
"action": "scriptContext",
"description": "Captures whether a PowerShell script runs in machine (System) or user session context.",
"enabled": true
},
{
"patternId": "PS-SCRIPT-EXITCODE",
"category": "always",
"pattern": "Powershell execution is done, exitCode = (?<exitCode>-?\\d+)",
"action": "scriptExitCode",
"description": "Captures the PowerShell exit code when script execution completes in the IME log.",
"enabled": true
},
{
"patternId": "PS-SCRIPT-GENERATED",
"category": "always",
"pattern": "Script file C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1 is generated",
"action": "scriptStarted",
"parameters": {
"scriptType": "platform"
},
"description": "Detects when a platform PowerShell script file is generated by IME. Captures the PolicyId from the script file path.",
"enabled": true
},
{
"patternId": "PS-SCRIPT-RESULT",
"category": "always",
"pattern": "\\[PowerShell\\] User Id = [a-z0-9\\-]+, Policy id = (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}), policy result = (?<result>\\w+)",
"action": "scriptCompleted",
"parameters": {
"scriptType": "platform"
},
"description": "Captures the final result (Success/Failed) of a platform PowerShell script execution with its PolicyId.",
"enabled": true
}
]
}
Reference in New Issue View Git Blame Copy Permalink