Oliver Kieselbach 65651dd599 ANALYZE-ID-004 v1.2.0: pre-logon VPN + Hello-as-symptom self-service guidance ...

From the 3b7ba31f (succeeded) vs gardner/esa (parked) hybrid session comparison:
explanation now covers the cached-credentials/pre-logon-VPN variant and why the
Hello wizard never appearing is downstream of the missing PRT; new remediation
block for VPN machine tunnels, cloud Kerberos trust, explicit Hello disable,
update deferral and pre-provisioning. Links the new docs article.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-17 13:36:10 +02:00

..

ANALYZE-APP-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-007.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-008.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-010.json

feat: externalize rules to GitHub + API consolidation + preview mode

2026-02-28 13:12:09 +01:00

ANALYZE-APP-012.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-013.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-014.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-015.json

rules: hybrid user-affinity + never-settled-app detection, dsregcmd on_event snapshot, evidence interpolation fixes

2026-08-14 13:39:16 +02:00

ANALYZE-CORR-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-001.json

feat(rules): built-in analyze-rule hygiene pass ahead of public docs catalog

2026-07-06 12:32:32 +02:00

ANALYZE-DEV-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-007.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ENRL-001.json

feat(rules): built-in analyze-rule hygiene pass ahead of public docs catalog

2026-07-06 12:32:32 +02:00

ANALYZE-ENRL-002.json

rules+backend+mcp: rule-verify sweep fixes (dead factor, {{token}} evidence, stats cap, list stringify)

2026-08-14 16:50:29 +02:00

ANALYZE-ENRL-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ENRL-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ENRL-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-004.json

feat(rules): built-in analyze-rule hygiene pass ahead of public docs catalog

2026-07-06 12:32:32 +02:00

ANALYZE-ESP-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-004.json

ANALYZE-ID-004 v1.2.0: pre-logon VPN + Hello-as-symptom self-service guidance

2026-08-17 13:36:10 +02:00

ANALYZE-OFFICE-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-007.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-008.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00