mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
c91d8d4501
IME never writes its "Completed user session" line when the user has no assigned Win32 apps - its zero-app branch returns before that statement (ApplicationPoller.cs:713-721, identical in 1.80/1.83/1.97/1.104). So ImeUserSessionCompletedUtc stayed null, every arm of ShouldTransitionToAwaitingHello was unsatisfiable, and the 30-min advisory_completion backstop resolved healthy enrollments as esp_exit_without_completion_evidence. One tenant: 10 of 30 sessions in a week, all false positives - DAD-validated desktop, Hello provisioned, RealmJoin still installing. Every Succeeded session there carries ime_user_session_completed; not one of the failed ones does. IME-USER-SESSION-ZERO-APPS reads the line IME does write there and routes it through the same OnUserSessionCompleted callback. That is IME's own verdict rather than a weakened gate: the zero-app branch locks the ESP in with an empty application list, and the sibling emit site returns ProvisioningComplete right after logging it. Guarded to the AccountSetup phase so it cannot burn the adapter fire-once flag on a pre-sign-in timestamp, and replayed on the phase transition when the observation predates the phase marker. AreUserEspAppsSettled accepts an empty app list only with that explicit observation, never on emptiness alone. Second, independent defect: advisory_completion (30 min) overran the RealmJoin completion gate, which deliberately holds the session and carries its own bounded resolution (60 min from detection, activity-extended, 4 h cap). One session installed 25 RealmJoin packages inside the window, the last 2 min before the failure, while completion_waiting still read "waiting on: realmjoin_resolution". The handler now re-arms while that gate is closed and its own deadline is still armed; convergence comes from the gate itself, which always ends with an Outcome set. ime_user_session_completed gains an evidence field (zero_user_apps_enumerated / user_session_completed) - no new event type, so the Constants -> resource-catalog -> shared-manifests triple stays untouched. The pattern ships via the config API and reaches existing agents, where an unknown action is a single Debug line; the behaviour needs the agent release. Build 0 warnings. DecisionCore 558/558, V2.Core 2530/2530, Backend 4634/4634, MCP event-types-drift 6/6. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
820 lines
47 KiB
JSON
Generated
820 lines
47 KiB
JSON
Generated
{
|
|
"$schema": "../schema/ime-log-pattern.schema.json",
|
|
"rules": [
|
|
{
|
|
"patternId": "HS-COMPLIANCE",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] the (?<part>pre|post)-rem(?:e)?diation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
|
|
"action": "healthScriptDetectionResult",
|
|
"parameters": {
|
|
"scriptType": "remediation"
|
|
},
|
|
"description": "Early-signal fallback for health-script detection / post-detection results. Microsoft IME emits this line immediately after each detection script runs, ~30-90 seconds before the consolidated [HS] new result = JSON line is logged (which only fires after IME's batch-send to the Microsoft service). Short Autopilot enrollments often end inside that gap, so this pattern guarantees at least the compliance verdict is captured. The full data version arrives later via HS-NEW-RESULT and replaces this sparse entry through the UI dedupe (dataCompleteness scoring). Tolerates both Microsoft's historical typo 'remdiation' and a future corrected 'remediation'. NOTE: IME 1.97 (Dec 2025) no longer emits the post- variant of this line; the post case is covered by HS-COMPLIANCE-POST.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-COMPLIANCE-POST",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] the (?<part>post) detection script result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
|
|
"action": "healthScriptDetectionResult",
|
|
"parameters": {
|
|
"scriptType": "remediation"
|
|
},
|
|
"description": "Post-remediation detection result, current wording. IME 1.97 (Dec 2025) replaced the old '[HS] the post-remdiation detection script compliance result for ...' line (still covered by HS-COMPLIANCE for older logs) with '[HS] the post detection script result for <guid> is <True|False>' (ScriptProcessorV2.cs:721). The literal word 'post' in the line is captured as the part group so the handler classifies it as the post-detection phase.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-EXITCODE",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] exit code of the script is (?<exitCode>-?\\d+)",
|
|
"action": "scriptExitCode",
|
|
"parameters": {
|
|
"scriptType": "remediation"
|
|
},
|
|
"description": "Captures the exit code of a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so the user sees the real exit code (not just the inferred 0/1) before HS-NEW-RESULT arrives.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-NEW-RESULT",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] new result = (?<json>\\{[\\s\\S]*\\})\\s*$",
|
|
"action": "healthScriptResult",
|
|
"parameters": {
|
|
"scriptType": "remediation"
|
|
},
|
|
"description": "Atomic final JSON of a health script run, covering all three phases (pre-detection / remediation / post-detection) emitted by IME after the policy completes. Single source of truth for health-script outcomes — replaces the line-by-line HS-COMPLIANCE/HS-EXITCODE/HS-STDOUT/HS-STDERR patterns. The end-anchor and [\\s\\S] character class are defensive against future format changes and multi-line CMTrace buffering.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-RUN-CONTEXT",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] The policy needs be run as (?<context>System|User)",
|
|
"action": "scriptContext",
|
|
"parameters": {
|
|
"scriptType": "remediation"
|
|
},
|
|
"description": "Captures the execution context (System or User) for a health-script. Feeds the early-signal slot consumed by HS-COMPLIANCE so context is visible immediately rather than waiting for HS-NEW-RESULT (which exposes RunAsAccount).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-SCRIPT-START",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] ProcessScript PolicyId: (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) PolicyType: (?<policyType>\\d+)",
|
|
"action": "scriptStarted",
|
|
"parameters": {
|
|
"scriptType": "remediation"
|
|
},
|
|
"description": "Detects when a Proactive Remediation (Health Script) starts processing. Captures PolicyId and PolicyType (6 = remediation). Drives the live script_started event for UI progress indication; the consolidated final result for the same PolicyId arrives later via HS-NEW-RESULT.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-STDERR",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] err output = (?<output>.*)",
|
|
"action": "scriptOutput",
|
|
"parameters": {
|
|
"scriptType": "remediation",
|
|
"outputType": "stderr"
|
|
},
|
|
"description": "Captures standard error from a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so stderr is visible immediately rather than waiting for HS-NEW-RESULT.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-STDOUT",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] std output = (?<output>.*)",
|
|
"action": "scriptOutput",
|
|
"parameters": {
|
|
"scriptType": "remediation",
|
|
"outputType": "stdout"
|
|
},
|
|
"description": "Captures standard output from a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so the user sees stdout immediately rather than waiting for HS-NEW-RESULT.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-AGENT-VERSION",
|
|
"category": "always",
|
|
"pattern": "Agent version is: (?<agentVersion>[\\d.]+)",
|
|
"action": "imeAgentVersion",
|
|
"description": "Captures the Intune Management Extension agent version number.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ALREADY-DETECTED-1",
|
|
"category": "otherPhases",
|
|
"pattern": "\\[Win32App\\] Completed detectionManager SideCar\\w+?DetectionManager, applicationDetectedByCurrentRule: True",
|
|
"action": "ignoreCompletedApp",
|
|
"description": "Detects when an app from a previous ESP phase is detected as already installed, so it should be ignored in the current phase.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ALREADY-DETECTED-2",
|
|
"category": "otherPhases",
|
|
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
|
|
"action": "ignoreCompletedApp",
|
|
"description": "Detects enforcement success in a non-current phase, indicating an app completed in a previous phase should be ignored.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-APP-TYPE-MSI",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\].*?\\bMSI App (?<id>{GUID})",
|
|
"action": "captureAppTypeMsi",
|
|
"description": "Detects an MSI-based Win32 app via the 'MSI App <guid>' phrase in the ESP retry configuration line. Marks AppType as 'MSI' for that app id.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-APP-TYPE-WINGET",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\]\\[WinGetApp\\].*?app with id: (?<id>{GUID})",
|
|
"action": "captureAppTypeWinGet",
|
|
"description": "Detects a WinGet-backed Store app by any [Win32App][WinGetApp] handler log line (Detection/Applicability/Operation). Marks AppType as 'WinGet' for that app id.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-APP-VERSION",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: (?<id>{GUID}).*?\"DetectedIdentityVersion\":\\{[^}]*?\"NewValue\":\"(?<appVersion>[^\"]+)\"",
|
|
"action": "captureAppVersion",
|
|
"description": "Captures the product version IME detected after an app install (e.g. \"11.2.1787.0\"). Source: [ReportingManager] Detection state update with DetectedIdentityVersion.NewValue. Used by App Dashboard to show version-level failure breakdowns.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ATTEMPT-NUMBER",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] ===Step=== Execute retry (?<attempt>\\d+)$",
|
|
"action": "captureAttemptNumber",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Captures the install attempt number for the current app. IME logs 'Execute retry 0' for the first attempt and increments on each retry. Reported as attempt+1 so retry 0 becomes AttemptNumber=1 (human-friendly: first attempt).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-CACHE-MISS",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] Content cache miss for app \\(id = {GUID}, name = (?<name>.*?)\\), start downloading",
|
|
"action": "updateName",
|
|
"description": "Captures 'Content cache miss for app (id = <guid>, name = <name>), start downloading...' (ContentManager.cs) as a secondary app-name source. Fires right before a real download begins, so it resolves names for exactly the apps that will produce download/install activity — a redundancy for IME-POLICIES-based naming after IME retired the old name-bearing processing lines.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DECRYPT-FAILED",
|
|
"category": "currentPhase",
|
|
"pattern": "Decryption is failed for appId {GUID}",
|
|
"action": "updateStateError",
|
|
"description": "Detects when app content decryption fails, indicating a corrupted or tampered download.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DETECTED-INSTALLED-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DetectionState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}Installed\"{1,2}",
|
|
"action": "updateStateInstalled",
|
|
"description": "Detects when an app's detection state transitions to Installed (new ReportingManager format). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DETECTED-INSTALLED-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: {GUID} resulted in action status: Success and detection state: Detected",
|
|
"action": "updateStateInstalled",
|
|
"description": "Detects when an app's detection action handler reports successful detection (app is installed).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DETECTED-OLD",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Detected app {GUID} ",
|
|
"action": "updateStateInstalled",
|
|
"description": "Detects when an app is detected as installed (old log format). DISABLED 2026-08-17: the standalone 'Detected app <guid> ' line no longer exists in IME 1.97.107; this regex instead matched the 'Detected app ... and intent is to install, skip applicability check' line, colliding with IME-SKIP-INSTALL-DETECTED and firing updateStateInstalled and updateStateSkipped on the same physical line (see tasks/ime-v1-code-audit-2026-08-17.md).",
|
|
"enabled": false
|
|
},
|
|
{
|
|
"patternId": "IME-DETECTION-RESULT",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: (?<id>{GUID}) resulted in action status: Success and detection state: (?<detection>DetectedDifferentVersion|NotDetected|Detected)",
|
|
"action": "captureDetectionResult",
|
|
"description": "Captures the detection rule result after IME runs detection for an app. 'Detected' means the detection rule matched (app is installed), 'NotDetected' means it did not, 'DetectedDifferentVersion' means a different version was found (supersedence / WinGet version mismatch). DetectedDifferentVersion must come first in the alternation so the unanchored regex does not mis-capture its 'Detected' prefix. Excludes [SimulatedDetectionActionHandler] which fires during applicability pre-checks.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DO-TEL",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[DO TEL\\] = (?<doTelJson>\\{.*\\})",
|
|
"action": "updateDoTelemetry",
|
|
"description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DO-TIMEOUT-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b).*?intunewin-bin_{GUID}",
|
|
"action": "updateStatePostponed",
|
|
"description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in filename).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DO-TIMEOUT-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b)",
|
|
"action": "updateStatePostponed",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when a Delivery Optimization download times out (generic, uses current app context).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DOWNLOADING",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[StatusService\\] Downloading app \\(id = {GUID}.*?\\) via (?<tech>\\w+), bytes (?<bytes>\\w+)/(?<ofbytes>\\w+) for user",
|
|
"action": "updateStateDownloading",
|
|
"description": "Captures app download progress including technology (DO/CDN), bytes downloaded, and total bytes.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ENFORCEMENT-SUCCESS",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:(?:\"{1,2}\\w+\"{1,2}|null),\"{1,2}NewValue\"{1,2}:\"{1,2}Success\"{1,2}",
|
|
"action": "updateStateInstalled",
|
|
"description": "Detects when an app's enforcement state transitions to Success in an Execution state report delta. OldValue is deliberately unpinned: besides InProgressDownloadCompleted it can be Error (retry succeeding in a later check-in), InProgressPendingReboot (post-reboot completion) or null (first write) — the previously pinned InProgressDownloadCompleted missed those legitimate success paths (IME 1.97 audit 2026-08-17). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ENFORCEMENT-SUCCESS-OLD",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
|
|
"action": "updateStateInstalled",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when enforcement state is set to Success for the current app (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-DOWNLOAD",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Download state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:\"{1,2}InProgress\"{1,2},\"{1,2}NewValue\"{1,2}:\"{1,2}ErrorDownloadingContent\"{1,2}",
|
|
"action": "updateStateError",
|
|
"description": "Detects when an app's enforcement state transitions to ErrorDownloadingContent. Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-ENFORCEMENT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Error\\b",
|
|
"action": "updateStateError",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when enforcement state is set to Error for the current app (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-NO-CONTENT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Didn't get content info from service",
|
|
"action": "updateStateError",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when IME cannot retrieve content info from the Intune service for the current app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-REPORT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:(?:\"{1,2}(?<from>\\w+)\"{1,2}|null),\"{1,2}NewValue\"{1,2}:\"{1,2}(?<to>\\w+)\"{1,2}",
|
|
"action": "updateStateError",
|
|
"parameters": {
|
|
"checkTo": "true"
|
|
},
|
|
"description": "Captures enforcement state transitions via ReportingManager. Only triggers error when 'to' value indicates an error state. OldValue may be the unquoted JSON literal null on the first-ever write of a reporting state — transitions straight from the initial state (e.g. first write directly to an error state) would otherwise be invisible (IME 1.97 audit 2026-08-17). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-TIMEOUT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Installation is timeout",
|
|
"action": "updateStateError",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when an app installation times out.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-UNMAPPED-EXIT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Admin did NOT set mapping for lpExitCode\\W+(?<exitCode>\\d+) of app\\W+{GUID}",
|
|
"action": "updateStateError",
|
|
"description": "Detects when an app installer returned an exit code that has no mapping configured in Intune.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ESP-APP-REGISTERED",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\]\\[EspManager\\] In EspPhase: \\w+\\. App {GUID} has been registered.*?App name: (?<name>.*?)$",
|
|
"action": "updateName",
|
|
"description": "Captures the ESP tracked-app registration line ('App <guid> has been registered[ for user <id>]. App name: <name>', EspManager.cs) as an app-name source. Primary replacement for the retired IME-UPDATE-NAME-1/2/3 whose emitters were removed with IME's old V1/V2 processing pipeline; also documents exactly which apps IME registered for ESP tracking. Category 'always' so names resolve even before the first ApplicationPoller EspPhase line is seen.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ESP-PHASE",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] (?:In|The) EspPhase: (?<espPhase>\\w+)",
|
|
"action": "espPhaseDetected",
|
|
"description": "Detects ESP phase transitions reported by IME Win32App processing (e.g., DeviceSetup, AccountSetup).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ESP-TRACK-STATUS",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}",
|
|
"action": "espTrackStatus",
|
|
"description": "Captures ESP tracked install status transitions (e.g., InProgress to Installed) for a specific app. No trailing anchor: IME 1.97 (Dec 2025) appends ' with name: <appName>.' after the GUID (EspManager.cs), which broke the previous '\\.' suffix. 'from' can be the literal string 'null' on first tracking.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-EXITCODE",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] lpExitCode (?<exitCode>-?\\d+)$",
|
|
"action": "captureExitCode",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Captures the installer exit code (lpExitCode) for the current app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-EXITCODE-MAPPED-FAILED",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] lpExitCode is defined as Failed$",
|
|
"action": "updateStateError",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Marks the current app as failed when its exit code maps to Failed via the admin-defined return-code table ('[Win32App] lpExitCode is defined as <Failed|Success|SoftReboot|HardReboot|Retry>', Win32AppInstaller.cs). This is the NORMAL mapped-exit-code outcome; the previously matched 'Setting enforcementState as ... Error' line only fires on the rare no-mapping fallback path. The numeric exit code is captured separately by IME-EXITCODE, which precedes this line.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-GRS-CLEARED",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ExecutionActionHandler\\] Encountered early subgraph termination\\. Clearing GRS for app with id: {GUID} so it can be retried during the next check-in\\.",
|
|
"action": "updateStatePostponed",
|
|
"description": "IME aborted the app's subgraph before enforcement finished and cleared its GRS entry so the app retries on the next check-in (ExecutionActionHandler, AppWorkload.log). Maps to Postponed: the install did not complete this pass but is scheduled to run again - previously this looked like an unexplained gap. Wording verified in IME 1.97 and 1.104.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-GRS-SKIP",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID} to (?:install|uninstall) is in GRS\\. The app will not be enforced\\.",
|
|
"action": "updateStatePostponed",
|
|
"description": "GRS (Global Retry Schedule) skip: the app failed recently and IME will not re-enforce it this check-in ('App with id: <guid> to install is in GRS. The app will not be enforced.', EnforcementActionProcessor / MixedEnforcementActionProcessor). THE canonical reason an app silently does nothing for up to 24h - previously invisible. Lives in AppActionProcessor.log, which the agent tails since the 2026-08-18 release; wording verified in IME 1.97 and 1.104.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-HRESULT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] hResultFromWin32 (?<hresult>-?\\d+)$",
|
|
"action": "captureHResult",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Captures the Win32 HRESULT for the current app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-IMPERSONATION",
|
|
"category": "always",
|
|
"pattern": "After impersonation: (?<user>.*?)$",
|
|
"action": "imeImpersonation",
|
|
"description": "Detects when IME impersonates a user context for app installation.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-INSTALL-HANDLER",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ExecutionActionHandler\\] Handler invoked with execution type: Install for policy with id: {GUID}",
|
|
"action": "updateStateInstalling",
|
|
"description": "Detects when the IME execution handler starts installing an app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-LAUNCH-INSTALLER",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Launch Win32AppInstaller in \\w+? session",
|
|
"action": "updateStateInstalling",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when the Win32 app installer process is launched in a user or system session.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NO-ACTION",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] No action required for app with id: {GUID}",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when IME determines no action is required for an app (already in desired state).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-APPLICABLE-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ApplicabilityActionHandler\\] Applicability check for policy with id: {GUID} resulted in action status: Success and applicability state: NotApplicable",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's applicability check returns NotApplicable (requirements not met).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-APPLICABLE-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Applicability state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}ApplicabilityState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}ScriptRequirementRuleNotMet\"{1,2}",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's applicability state is set to ScriptRequirementRuleNotMet (PowerShell requirement script returned false). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-APPLICABLE-3",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DesiredState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}None\"{1,2}",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's desired state is set to None (not targeted or not applicable). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-APPLICABLE-4",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DesiredState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}NotPresent\"{1,2}",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's desired state is set to NotPresent (targeted for uninstall or not required). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-TARGETED-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, targeted intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app with RequiredInstall intent is classified as NotApplicableOrNotTargeted (new log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-TARGETED-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, effective intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app with effective RequiredInstall intent is classified as NotApplicableOrNotTargeted.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-POLICIES",
|
|
"category": "currentPhase",
|
|
"pattern": "Get policies =\\s*(?<policies>.*)",
|
|
"action": "policiesDiscovered",
|
|
"description": "Captures the JSON policies list discovered by IME, used to build the app inventory.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-RESTART-STOP-PROCESSING",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[V3Processor\\] A restart is required to continue processing apps\\. Stop processing\\.",
|
|
"action": "updateStatePostponed",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects IME aborting app processing because an app requires a restart ('A restart is required to continue processing apps. Stop processing.', SideCarV3AppProcessor.cs). Postpones the current app: remaining apps do nothing until after the reboot, which previously looked like an unexplained stall mid-ESP.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SESSION-CHANGE",
|
|
"category": "always",
|
|
"pattern": "OnSessionChange:? (?<change>.*?)$",
|
|
"action": "imeSessionChange",
|
|
"description": "Detects Windows session change events (logon, logoff, lock, unlock) reported by IME.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SET-CURRENT-1",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name",
|
|
"action": "setCurrentApp",
|
|
"description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
|
|
"enabled": false
|
|
},
|
|
{
|
|
"patternId": "IME-SET-CURRENT-2",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?\\bid\\W+{GUID}",
|
|
"action": "setCurrentApp",
|
|
"description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
|
|
"enabled": false
|
|
},
|
|
{
|
|
"patternId": "IME-SET-CURRENT-3",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] ===Step=== Start to Present app {GUID}",
|
|
"action": "setCurrentApp",
|
|
"description": "Detects the start of app presentation step in IME, setting the app as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
|
|
"enabled": false
|
|
},
|
|
{
|
|
"patternId": "IME-SET-CURRENT-4",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] SetCurrentDirectory:.*?\\\\{GUID}_\\d+",
|
|
"action": "setCurrentApp",
|
|
"description": "Detects when IME sets the working directory for an app's staging folder, setting it as current.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SHUTDOWN",
|
|
"category": "currentPhase",
|
|
"pattern": "EMS Agent received shutdown signal",
|
|
"action": "updateStatePostponed",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when the IME agent receives a shutdown signal, postponing the current app installation.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-APPLICABILITY-NOTMET",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] (?=.*?\\bapplicability\\b)(?=.*?NotMet\\b).*?\\bapp\\W+{GUID}\\b",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
|
|
"enabled": false
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-DEPENDENCY-DETECT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] app\\W+{GUID}\\b.*?\\bis a dependency\\b.*?\\bDetect Only mode\\b.*?\\bfinished processing",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
|
|
"enabled": false
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-DETECTED",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Detected app {GUID}.*?skip next step",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an already-detected app is skipped for further processing steps (old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
|
|
"enabled": false
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-FILTERS",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[V3Processor\\] All apps in the subgraph are not applicable due to assignment filters\\. Skipping processing\\.",
|
|
"action": "updateStateSkipped",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when all apps in a subgraph are skipped due to assignment filter exclusions.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-INSTALL-DETECTED",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Detected app {GUID} and intent is to install, skip applicability check",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app targeted for install is already detected/installed, so the install is skipped (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-UNINSTALL-NOTDETECTED",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Not detected app {GUID} and intent is to un-install, skip applicability check",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app targeted for uninstall is not detected, so the uninstall is skipped (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-UNINSTALL-NOTDETECTED-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] NOT detected app {GUID}.*?skip un-installation",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app is not detected and uninstall is skipped (alternate old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
|
|
"enabled": false
|
|
},
|
|
{
|
|
"patternId": "IME-STARTED",
|
|
"category": "always",
|
|
"pattern": "EMS Agent Started",
|
|
"action": "imeStarted",
|
|
"description": "Detects when the Intune Management Extension (IME) agent starts up.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-STOP-SIGNAL",
|
|
"category": "currentPhase",
|
|
"pattern": "EMS Agent received stop signal",
|
|
"action": "updateStatePostponed",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects an IME service stop ('EMS Agent received stop signal', EmsAgentService.OnStop) — fired on manual restarts and agent-updater restarts, unlike the OS-shutdown-only 'shutdown signal' line matched by IME-SHUTDOWN. Postpones the current app installation, mirroring IME-SHUTDOWN semantics.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SUBGRAPH",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[V3Processor\\] Processing subgraph with app ids: {GUID}",
|
|
"action": "cancelStuckAndSetCurrent",
|
|
"description": "Detects when V3Processor starts a new subgraph, cancelling any stuck app and setting the new app as current.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-TOKEN-FAILURE",
|
|
"category": "always",
|
|
"pattern": "Failed to get AAD token\\..*?errorCode = (?<errorCode>.*?)$",
|
|
"action": "imeTokenFailure",
|
|
"description": "IME token acquisition failure ('Failed to get AAD token. len = N using client id ... and resource id ..., errorCode = N', IntuneTokenManager, IntuneManagementExtension.log). This line appears ROUTINELY during the device phase (no user token exists yet), so the agent holds the failure pending: any IME-TOKEN-SUCCESS match clears it, and the ime_token_failure Warning fires only when no success follows for the whole 30-min grace window (then deduped to one Warning per distinct errorCode). A genuine auth outage (WAM broken, conditional access, network) runs long enough to hit the window. Verified against IME 1.97 and 1.104 decompiled sources.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-TOKEN-SUCCESS",
|
|
"category": "always",
|
|
"pattern": "Successfully get the token",
|
|
"action": "espPhaseDetected",
|
|
"parameters": {
|
|
"phase": "AccountSetup"
|
|
},
|
|
"description": "Detects successful token acquisition, indicating the AccountSetup ESP phase has started.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-UPDATE-NAME-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?name\\W+(?<name>.*?)\\W+id\\W+{GUID}",
|
|
"action": "updateName",
|
|
"description": "Captures the app name from ExecManager processing log (old format: name before id). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
|
|
"enabled": false
|
|
},
|
|
{
|
|
"patternId": "IME-UPDATE-NAME-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name (?<name>.*?)$",
|
|
"action": "updateName",
|
|
"description": "Captures the app name from ProcessAppWithDependencies log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
|
|
"enabled": false
|
|
},
|
|
{
|
|
"patternId": "IME-UPDATE-NAME-3",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Processing app \\(id={GUID}, name = (?<name>.*?)\\)",
|
|
"action": "updateName",
|
|
"description": "Captures the app name from the Processing app log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
|
|
"enabled": false
|
|
},
|
|
{
|
|
"patternId": "IME-USER-SESSION-COMPLETED",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] \\.+ Completed user session \\d+, userId: (?<userId>[a-f0-9\\-]+), userSID: (?<userSid>S-[\\d\\-]+) \\.+",
|
|
"action": "enrollmentCompleted",
|
|
"description": "Detects when IME completes a user session, indicating enrollment has finished for that user.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-USER-SESSION-ZERO-APPS",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] Get 0 apps for user session (?<sessionId>\\d+), user id = (?<userId>[a-f0-9\\-]+)",
|
|
"action": "userSessionZeroApps",
|
|
"description": "Detects when IME enumerated a user session and found zero targeted Win32 apps. IME then skips its 'Completed user session' line entirely (the zero-app branch in ApplicationPoller continues before that log statement), so this line is the only evidence that user-phase enforcement finished on a device with no user-targeted apps. Treated as equivalent to a completed user session.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-WIN32-STATE-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Got InstanceID: Win32App_{GUID}_\\d+, installationStateString: (?<state>\\d)",
|
|
"action": "updateWin32AppState",
|
|
"description": "Captures the Win32 app installation state string from instance ID tracking (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-WIN32-STATE-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] (?:Got|Set) (?:ESP )?win32App state (?<state>\\w+) for {GUID}",
|
|
"action": "updateWin32AppState",
|
|
"description": "Captures the Win32 app ESP state (e.g., Installed, InProgress) for a specific app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-WINGET-ERROR",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID}.*?- Operation Phase = Error",
|
|
"action": "updateStateError",
|
|
"description": "Marks a WinGet (new Store) app as failed when its operation progress reports phase Error (WinGetOperationInstallPhase: Downloading/Installing/Queued/Finished/Error). Before this pattern only the Installing phase was matched, so WinGet failures never surfaced as app errors (IME 1.97 audit 2026-08-17).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-WINGET-INSTALLING-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID} and user = .*?- Operation Phase = Installing",
|
|
"action": "updateStateInstalling",
|
|
"description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 1).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-WINGET-INSTALLING-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID}.*?- Operation Phase = Installing",
|
|
"action": "updateStateInstalling",
|
|
"description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 2).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-AGENT-ERROR",
|
|
"category": "always",
|
|
"pattern": "error from script =(?<output>[\\s\\S]*)",
|
|
"action": "scriptOutput",
|
|
"parameters": {
|
|
"scriptType": "platform",
|
|
"outputType": "stderr"
|
|
},
|
|
"description": "Captures error output from AgentExecutor.log when a platform script produces stderr content.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-AGENT-EXITCODE",
|
|
"category": "always",
|
|
"pattern": "Powershell exit code is (?<exitCode>-?\\d+)",
|
|
"action": "scriptExitCode",
|
|
"parameters": {
|
|
"scriptType": "platform"
|
|
},
|
|
"description": "Captures the PowerShell exit code from AgentExecutor.log.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-AGENT-INVOCATION",
|
|
"category": "always",
|
|
"pattern": "ExecutorLog AgentExecutor gets invoked",
|
|
"action": "resetPlatformScriptContext",
|
|
"description": "Marks the start of a new AgentExecutor.exe invocation. AgentExecutor hosts BOTH platform scripts (Policies\\Scripts\\<id>.ps1) and proactive-remediation scripts (IMECache\\HealthScripts\\<id>\\detect.ps1) and writes their lines interleaved into the shared AgentExecutor.log. The policyId-less 'Powershell exit code is N' / 'write output done' lines are otherwise routed to the last-started platform script via a sticky pointer, so a remediation invocation (whose start line does not match PS-AGENT-SCRIPT-START) leaks its exit/output into that platform script's result. This pattern resets the platform-script line-capture context at each invocation boundary so only the matching platform invocation captures its own exit/output.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-AGENT-OUTPUT",
|
|
"category": "always",
|
|
"pattern": "write output done\\. output = (?<output>[\\s\\S]*?), error = (?<error>[\\s\\S]*)",
|
|
"action": "scriptOutput",
|
|
"parameters": {
|
|
"scriptType": "platform"
|
|
},
|
|
"description": "Captures both stdout and stderr from AgentExecutor.log when a platform script completes. The output group contains stdout, the error group contains stderr.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-AGENT-SCRIPT-START",
|
|
"category": "always",
|
|
"pattern": "Adding argument powershell with value C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1",
|
|
"action": "scriptStarted",
|
|
"parameters": {
|
|
"scriptType": "platform",
|
|
"source": "agentexecutor"
|
|
},
|
|
"description": "Detects platform script identification in AgentExecutor.log. Captures PolicyId from the script file path for stdout/stderr correlation.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-SCRIPT-CONTEXT",
|
|
"category": "always",
|
|
"pattern": "Launch powershell executor in (?<context>machine|user) session",
|
|
"action": "scriptContext",
|
|
"description": "Captures whether a PowerShell script runs in machine (System) or user session context.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-SCRIPT-EXITCODE",
|
|
"category": "always",
|
|
"pattern": "Powershell execution is done, exitCode = (?<exitCode>-?\\d+)",
|
|
"action": "scriptExitCode",
|
|
"description": "Captures the PowerShell exit code when script execution completes in the IME log.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-SCRIPT-GENERATED",
|
|
"category": "always",
|
|
"pattern": "Script file C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1 is generated",
|
|
"action": "scriptStarted",
|
|
"parameters": {
|
|
"scriptType": "platform"
|
|
},
|
|
"description": "Detects when a platform PowerShell script file is generated by IME. Captures the PolicyId from the script file path.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-SCRIPT-RESULT",
|
|
"category": "always",
|
|
"pattern": "\\[PowerShell\\] User Id = [a-z0-9\\-]+, Policy id = (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}), policy result = (?<result>\\w+)",
|
|
"action": "scriptCompleted",
|
|
"parameters": {
|
|
"scriptType": "platform"
|
|
},
|
|
"description": "Captures the final result (Success/Failed) of a platform PowerShell script execution with its PolicyId.",
|
|
"enabled": true
|
|
}
|
|
]
|
|
}
|