gsadmin/AutopilotMonitor
1
0
Fork 0
mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 20:53:06 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
d3d9c5f2cfbfd59cd91dfb41d4df2471c617aaf8
AutopilotMonitor/rules/dist/ime-log-patterns.json
T
Oliver Kieselbach 76284cfcb2 fix(agent/v2,rules): two-stage health-script emission to close short-session timing gap 
The post-PR-HS1 single-source design (HS-NEW-RESULT JSON only) had a real timing gap:
IME emits the [HS] new result = JSON line only AFTER its batch send to the Microsoft
service, ~30-90 s after the actual script ran (verified in session c1e714e6: 34-74 s
gap per policy). Short Autopilot enrollments often end inside that window, so health-
script rows were entirely missing from completed sessions even though IME had executed
the scripts.

Two-stage approach (matches original V1 timing for the early signal, while keeping
HS-NEW-RESULT as the canonical truth):

- Re-add HS-COMPLIANCE pattern matching BOTH `pre-remdiation` AND `post-remdiation`
  detection compliance lines → HandleHealthScriptDetectionResult emits a script_completed
  event immediately. Single regex (`(?<part>pre|post)-remdiation`) covers both phases.

- Re-add HS-RUN-CONTEXT / HS-EXITCODE / HS-STDOUT / HS-STDERR patterns feeding a
  single-slot `_pendingHealthScript` accumulator (IME runs health scripts sequentially
  within a session — verified). HS-COMPLIANCE merges the slot data onto the early-signal
  event so exit / stdout / stderr / runContext are populated from the start, not just
  the inferred compliance verdict.

- HS-NEW-RESULT continues to fire later with the full JSON (RemediationStatus,
  TargetType, ErrorCode, plus the actual remediation phase's data). UI reducer's
  dataCompleteness() scoring keeps the more complete entry — early-signal row gets
  enriched in place, no duplicate cards.

Remediation phase itself has no early-signal source in IME logs (only the late JSON
exposes Info.RemediationExitCode and RemediationScriptOutputDetails). A follow-up
based on the agentexecutor invocation line's _RemediationScript.output suffix is
possible once we have a real non-compliant cycle log to validate against.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-12 00:58:21 +02:00

712 lines
32 KiB
JSON
Generated
Raw Blame History

{
"$schema": "../schema/ime-log-pattern.schema.json",
"rules": [
{
"patternId": "HS-COMPLIANCE",
"category": "always",
"pattern": "\\[HS\\] the (?<part>pre|post)-remdiation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
"action": "healthScriptDetectionResult",
"parameters": {
"scriptType": "remediation"
},
"description": "Early-signal fallback for health-script detection / post-detection results. Microsoft IME emits this line immediately after each detection script runs, ~30-90 seconds before the consolidated [HS] new result = JSON line is logged (which only fires after IME's batch-send to the Microsoft service). Short Autopilot enrollments often end inside that gap, so this pattern guarantees at least the compliance verdict is captured. The full data version arrives later via HS-NEW-RESULT and replaces this sparse entry through the UI dedupe (dataCompleteness scoring).",
"enabled": true
},
{
"patternId": "HS-EXITCODE",
"category": "always",
"pattern": "\\[HS\\] exit code of the script is (?<exitCode>-?\\d+)",
"action": "scriptExitCode",
"parameters": {
"scriptType": "remediation"
},
"description": "Captures the exit code of a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so the user sees the real exit code (not just the inferred 0/1) before HS-NEW-RESULT arrives.",
"enabled": true
},
{
"patternId": "HS-NEW-RESULT",
"category": "always",
"pattern": "\\[HS\\] new result = (?<json>\\{[\\s\\S]*\\})\\s*$",
"action": "healthScriptResult",
"parameters": {
"scriptType": "remediation"
},
"description": "Atomic final JSON of a health script run, covering all three phases (pre-detection / remediation / post-detection) emitted by IME after the policy completes. Single source of truth for health-script outcomes — replaces the line-by-line HS-COMPLIANCE/HS-EXITCODE/HS-STDOUT/HS-STDERR patterns. The end-anchor and [\\s\\S] character class are defensive against future format changes and multi-line CMTrace buffering.",
"enabled": true
},
{
"patternId": "HS-RUN-CONTEXT",
"category": "always",
"pattern": "\\[HS\\] The policy needs be run as (?<context>System|User)",
"action": "scriptContext",
"parameters": {
"scriptType": "remediation"
},
"description": "Captures the execution context (System or User) for a health-script. Feeds the early-signal slot consumed by HS-COMPLIANCE so context is visible immediately rather than waiting for HS-NEW-RESULT (which exposes RunAsAccount).",
"enabled": true
},
{
"patternId": "HS-SCRIPT-START",
"category": "always",
"pattern": "\\[HS\\] ProcessScript PolicyId: (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) PolicyType: (?<policyType>\\d+)",
"action": "scriptStarted",
"parameters": {
"scriptType": "remediation"
},
"description": "Detects when a Proactive Remediation (Health Script) starts processing. Captures PolicyId and PolicyType (6 = remediation). Drives the live script_started event for UI progress indication; the consolidated final result for the same PolicyId arrives later via HS-NEW-RESULT.",
"enabled": true
},
{
"patternId": "HS-STDERR",
"category": "always",
"pattern": "\\[HS\\] err output = (?<output>.*)",
"action": "scriptOutput",
"parameters": {
"scriptType": "remediation",
"outputType": "stderr"
},
"description": "Captures standard error from a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so stderr is visible immediately rather than waiting for HS-NEW-RESULT.",
"enabled": true
},
{
"patternId": "HS-STDOUT",
"category": "always",
"pattern": "\\[HS\\] std output = (?<output>.*)",
"action": "scriptOutput",
"parameters": {
"scriptType": "remediation",
"outputType": "stdout"
},
"description": "Captures standard output from a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so the user sees stdout immediately rather than waiting for HS-NEW-RESULT.",
"enabled": true
},
{
"patternId": "IME-AGENT-VERSION",
"category": "always",
"pattern": "Agent version is: (?<agentVersion>[\\d.]+)",
"action": "imeAgentVersion",
"description": "Captures the Intune Management Extension agent version number.",
"enabled": true
},
{
"patternId": "IME-ALREADY-DETECTED-1",
"category": "otherPhases",
"pattern": "\\[Win32App\\] Completed detectionManager SideCar\\w+?DetectionManager, applicationDetectedByCurrentRule: True",
"action": "ignoreCompletedApp",
"description": "Detects when an app from a previous ESP phase is detected as already installed, so it should be ignored in the current phase.",
"enabled": true
},
{
"patternId": "IME-ALREADY-DETECTED-2",
"category": "otherPhases",
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
"action": "ignoreCompletedApp",
"description": "Detects enforcement success in a non-current phase, indicating an app completed in a previous phase should be ignored.",
"enabled": true
},
{
"patternId": "IME-APP-TYPE-MSI",
"category": "always",
"pattern": "\\[Win32App\\].*?\\bMSI App (?<id>{GUID})",
"action": "captureAppTypeMsi",
"description": "Detects an MSI-based Win32 app via the 'MSI App <guid>' phrase in the ESP retry configuration line. Marks AppType as 'MSI' for that app id.",
"enabled": true
},
{
"patternId": "IME-APP-TYPE-WINGET",
"category": "always",
"pattern": "\\[Win32App\\]\\[WinGetApp\\].*?app with id: (?<id>{GUID})",
"action": "captureAppTypeWinGet",
"description": "Detects a WinGet-backed Store app by any [Win32App][WinGetApp] handler log line (Detection/Applicability/Operation). Marks AppType as 'WinGet' for that app id.",
"enabled": true
},
{
"patternId": "IME-APP-VERSION",
"category": "always",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: (?<id>{GUID}).*?\"DetectedIdentityVersion\":\\{[^}]*?\"NewValue\":\"(?<appVersion>[^\"]+)\"",
"action": "captureAppVersion",
"description": "Captures the product version IME detected after an app install (e.g. \"11.2.1787.0\"). Source: [ReportingManager] Detection state update with DetectedIdentityVersion.NewValue. Used by App Dashboard to show version-level failure breakdowns.",
"enabled": true
},
{
"patternId": "IME-ATTEMPT-NUMBER",
"category": "currentPhase",
"pattern": "\\[Win32App\\] ===Step=== Execute retry (?<attempt>\\d+)$",
"action": "captureAttemptNumber",
"parameters": {
"useCurrentApp": "true"
},
"description": "Captures the install attempt number for the current app. IME logs 'Execute retry 0' for the first attempt and increments on each retry. Reported as attempt+1 so retry 0 becomes AttemptNumber=1 (human-friendly: first attempt).",
"enabled": true
},
{
"patternId": "IME-DECRYPT-FAILED",
"category": "currentPhase",
"pattern": "Decryption is failed for appId {GUID}",
"action": "updateStateError",
"description": "Detects when app content decryption fails, indicating a corrupted or tampered download.",
"enabled": true
},
{
"patternId": "IME-DETECTED-INSTALLED-1",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DetectionState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"Installed\"\"",
"action": "updateStateInstalled",
"description": "Detects when an app's detection state transitions to Installed (new ReportingManager format).",
"enabled": true
},
{
"patternId": "IME-DETECTED-INSTALLED-2",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: {GUID} resulted in action status: Success and detection state: Detected",
"action": "updateStateInstalled",
"description": "Detects when an app's detection action handler reports successful detection (app is installed).",
"enabled": true
},
{
"patternId": "IME-DETECTED-OLD",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Detected app {GUID} ",
"action": "updateStateInstalled",
"description": "Detects when an app is detected as installed (old log format).",
"enabled": true
},
{
"patternId": "IME-DETECTION-RESULT",
"category": "always",
"pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: (?<id>{GUID}) resulted in action status: Success and detection state: (?<detection>Detected|NotDetected)",
"action": "captureDetectionResult",
"description": "Captures the detection rule result after IME runs detection for an app. 'Detected' means the detection rule matched (app is installed), 'NotDetected' means it did not. Excludes [SimulatedDetectionActionHandler] which fires during applicability pre-checks.",
"enabled": true
},
{
"patternId": "IME-DO-TEL",
"category": "currentPhase",
"pattern": "\\[DO TEL\\] = (?<doTelJson>\\{.*\\})",
"action": "updateDoTelemetry",
"description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration.",
"enabled": true
},
{
"patternId": "IME-DO-TIMEOUT-1",
"category": "currentPhase",
"pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b).*?intunewin-bin_{GUID}",
"action": "updateStatePostponed",
"description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in filename).",
"enabled": true
},
{
"patternId": "IME-DO-TIMEOUT-2",
"category": "currentPhase",
"pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b)",
"action": "updateStatePostponed",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when a Delivery Optimization download times out (generic, uses current app context).",
"enabled": true
},
{
"patternId": "IME-DOWNLOADING",
"category": "currentPhase",
"pattern": "\\[StatusService\\] Downloading app \\(id = {GUID}.*?\\) via (?<tech>\\w+), bytes (?<bytes>\\w+)/(?<ofbytes>\\w+) for user",
"action": "updateStateDownloading",
"description": "Captures app download progress including technology (DO/CDN), bytes downloaded, and total bytes.",
"enabled": true
},
{
"patternId": "IME-ENFORCEMENT-SUCCESS",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"InProgressDownloadCompleted\"\",\"\"NewValue\"\":\"\"Success\"\"",
"action": "updateStateInstalled",
"description": "Detects when an app's enforcement state transitions from InProgressDownloadCompleted to Success.",
"enabled": true
},
{
"patternId": "IME-ENFORCEMENT-SUCCESS-OLD",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
"action": "updateStateInstalled",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when enforcement state is set to Success for the current app (old log format).",
"enabled": true
},
{
"patternId": "IME-ERROR-DOWNLOAD",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Download state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"InProgress\"\",\"\"NewValue\"\":\"\"ErrorDownloadingContent\"\"",
"action": "updateStateError",
"description": "Detects when an app's enforcement state transitions to ErrorDownloadingContent.",
"enabled": true
},
{
"patternId": "IME-ERROR-ENFORCEMENT",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Error\\b",
"action": "updateStateError",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when enforcement state is set to Error for the current app (old log format).",
"enabled": true
},
{
"patternId": "IME-ERROR-NO-CONTENT",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Didn't get content info from service",
"action": "updateStateError",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when IME cannot retrieve content info from the Intune service for the current app.",
"enabled": true
},
{
"patternId": "IME-ERROR-REPORT",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"(?<from>\\w+)\"\",\"\"NewValue\"\":\"\"(?<to>\\w+)\"\"",
"action": "updateStateError",
"parameters": {
"checkTo": "true"
},
"description": "Captures enforcement state transitions via ReportingManager. Only triggers error when 'to' value indicates an error state.",
"enabled": true
},
{
"patternId": "IME-ERROR-TIMEOUT",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Installation is timeout",
"action": "updateStateError",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when an app installation times out.",
"enabled": true
},
{
"patternId": "IME-ERROR-UNMAPPED-EXIT",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Admin did NOT set mapping for lpExitCode\\W+(?<exitCode>\\d+) of app\\W+{GUID}",
"action": "updateStateError",
"description": "Detects when an app installer returned an exit code that has no mapping configured in Intune.",
"enabled": true
},
{
"patternId": "IME-ESP-PHASE",
"category": "always",
"pattern": "\\[Win32App\\] (?:In|The) EspPhase: (?<espPhase>\\w+)",
"action": "espPhaseDetected",
"description": "Detects ESP phase transitions reported by IME Win32App processing (e.g., DeviceSetup, AccountSetup).",
"enabled": true
},
{
"patternId": "IME-ESP-TRACK-STATUS",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}\\.",
"action": "espTrackStatus",
"description": "Captures ESP tracked install status transitions (e.g., InProgress to Installed) for a specific app.",
"enabled": true
},
{
"patternId": "IME-EXITCODE",
"category": "currentPhase",
"pattern": "\\[Win32App\\] lpExitCode (?<exitCode>-?\\d+)$",
"action": "captureExitCode",
"parameters": {
"useCurrentApp": "true"
},
"description": "Captures the installer exit code (lpExitCode) for the current app.",
"enabled": true
},
{
"patternId": "IME-HRESULT",
"category": "currentPhase",
"pattern": "\\[Win32App\\] hResultFromWin32 (?<hresult>-?\\d+)$",
"action": "captureHResult",
"parameters": {
"useCurrentApp": "true"
},
"description": "Captures the Win32 HRESULT for the current app.",
"enabled": true
},
{
"patternId": "IME-IMPERSONATION",
"category": "always",
"pattern": "After impersonation: (?<user>.*?)$",
"action": "imeImpersonation",
"description": "Detects when IME impersonates a user context for app installation.",
"enabled": true
},
{
"patternId": "IME-INSTALL-HANDLER",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ExecutionActionHandler\\] Handler invoked with execution type: Install for policy with id: {GUID}",
"action": "updateStateInstalling",
"description": "Detects when the IME execution handler starts installing an app.",
"enabled": true
},
{
"patternId": "IME-LAUNCH-INSTALLER",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Launch Win32AppInstaller in \\w+? session",
"action": "updateStateInstalling",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when the Win32 app installer process is launched in a user or system session.",
"enabled": true
},
{
"patternId": "IME-NO-ACTION",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] No action required for app with id: {GUID}",
"action": "updateStateSkipped",
"description": "Detects when IME determines no action is required for an app (already in desired state).",
"enabled": true
},
{
"patternId": "IME-NOT-APPLICABLE-1",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ApplicabilityActionHandler\\] Applicability check for policy with id: {GUID} resulted in action status: Success and applicability state: NotApplicable",
"action": "updateStateSkipped",
"description": "Detects when an app's applicability check returns NotApplicable (requirements not met).",
"enabled": true
},
{
"patternId": "IME-NOT-APPLICABLE-2",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Applicability state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"ApplicabilityState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"ScriptRequirementRuleNotMet\"\"",
"action": "updateStateSkipped",
"description": "Detects when an app's applicability state is set to ScriptRequirementRuleNotMet (PowerShell requirement script returned false).",
"enabled": true
},
{
"patternId": "IME-NOT-APPLICABLE-3",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DesiredState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"None\"\"",
"action": "updateStateSkipped",
"description": "Detects when an app's desired state is set to None (not targeted or not applicable).",
"enabled": true
},
{
"patternId": "IME-NOT-APPLICABLE-4",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DesiredState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"NotPresent\"\"",
"action": "updateStateSkipped",
"description": "Detects when an app's desired state is set to NotPresent (targeted for uninstall or not required).",
"enabled": true
},
{
"patternId": "IME-NOT-TARGETED-1",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, targeted intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
"action": "updateStateSkipped",
"description": "Detects when an app with RequiredInstall intent is classified as NotApplicableOrNotTargeted (new log format).",
"enabled": true
},
{
"patternId": "IME-NOT-TARGETED-2",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, effective intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
"action": "updateStateSkipped",
"description": "Detects when an app with effective RequiredInstall intent is classified as NotApplicableOrNotTargeted.",
"enabled": true
},
{
"patternId": "IME-POLICIES",
"category": "currentPhase",
"pattern": "Get policies =\\s*(?<policies>.*)",
"action": "policiesDiscovered",
"description": "Captures the JSON policies list discovered by IME, used to build the app inventory.",
"enabled": true
},
{
"patternId": "IME-SESSION-CHANGE",
"category": "always",
"pattern": "OnSessionChange:? (?<change>.*?)$",
"action": "imeSessionChange",
"description": "Detects Windows session change events (logon, logoff, lock, unlock) reported by IME.",
"enabled": true
},
{
"patternId": "IME-SET-CURRENT-1",
"category": "always",
"pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name",
"action": "setCurrentApp",
"description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app.",
"enabled": true
},
{
"patternId": "IME-SET-CURRENT-2",
"category": "always",
"pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?\\bid\\W+{GUID}",
"action": "setCurrentApp",
"description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current.",
"enabled": true
},
{
"patternId": "IME-SET-CURRENT-3",
"category": "always",
"pattern": "\\[Win32App\\] ===Step=== Start to Present app {GUID}",
"action": "setCurrentApp",
"description": "Detects the start of app presentation step in IME, setting the app as current.",
"enabled": true
},
{
"patternId": "IME-SET-CURRENT-4",
"category": "always",
"pattern": "\\[Win32App\\] SetCurrentDirectory:.*?\\\\{GUID}_\\d+",
"action": "setCurrentApp",
"description": "Detects when IME sets the working directory for an app's staging folder, setting it as current.",
"enabled": true
},
{
"patternId": "IME-SHUTDOWN",
"category": "currentPhase",
"pattern": "EMS Agent received shutdown signal",
"action": "updateStatePostponed",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when the IME agent receives a shutdown signal, postponing the current app installation.",
"enabled": true
},
{
"patternId": "IME-SKIP-APPLICABILITY-NOTMET",
"category": "currentPhase",
"pattern": "\\[Win32App\\] (?=.*?\\bapplicability\\b)(?=.*?NotMet\\b).*?\\bapp\\W+{GUID}\\b",
"action": "updateStateSkipped",
"description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads).",
"enabled": true
},
{
"patternId": "IME-SKIP-DEPENDENCY-DETECT",
"category": "currentPhase",
"pattern": "\\[Win32App\\] app\\W+{GUID}\\b.*?\\bis a dependency\\b.*?\\bDetect Only mode\\b.*?\\bfinished processing",
"action": "updateStateSkipped",
"description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed).",
"enabled": true
},
{
"patternId": "IME-SKIP-DETECTED",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Detected app {GUID}.*?skip next step",
"action": "updateStateSkipped",
"description": "Detects when an already-detected app is skipped for further processing steps (old log format).",
"enabled": true
},
{
"patternId": "IME-SKIP-FILTERS",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[V3Processor\\] All apps in the subgraph are not applicable due to assignment filters\\. Skipping processing\\.",
"action": "updateStateSkipped",
"parameters": {
"useCurrentApp": "true"
},
"description": "Detects when all apps in a subgraph are skipped due to assignment filter exclusions.",
"enabled": true
},
{
"patternId": "IME-SKIP-INSTALL-DETECTED",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Detected app {GUID} and intent is to install, skip applicability check",
"action": "updateStateSkipped",
"description": "Detects when an app targeted for install is already detected/installed, so the install is skipped (old log format).",
"enabled": true
},
{
"patternId": "IME-SKIP-UNINSTALL-NOTDETECTED",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Not detected app {GUID} and intent is to un-install, skip applicability check",
"action": "updateStateSkipped",
"description": "Detects when an app targeted for uninstall is not detected, so the uninstall is skipped (old log format).",
"enabled": true
},
{
"patternId": "IME-SKIP-UNINSTALL-NOTDETECTED-2",
"category": "currentPhase",
"pattern": "\\[Win32App\\] NOT detected app {GUID}.*?skip un-installation",
"action": "updateStateSkipped",
"description": "Detects when an app is not detected and uninstall is skipped (alternate old log format).",
"enabled": true
},
{
"patternId": "IME-STARTED",
"category": "always",
"pattern": "EMS Agent Started",
"action": "imeStarted",
"description": "Detects when the Intune Management Extension (IME) agent starts up.",
"enabled": true
},
{
"patternId": "IME-SUBGRAPH",
"category": "currentPhase",
"pattern": "\\[Win32App\\]\\[V3Processor\\] Processing subgraph with app ids: {GUID}",
"action": "cancelStuckAndSetCurrent",
"description": "Detects when V3Processor starts a new subgraph, cancelling any stuck app and setting the new app as current.",
"enabled": true
},
{
"patternId": "IME-TOKEN-SUCCESS",
"category": "always",
"pattern": "Successfully get the token",
"action": "espPhaseDetected",
"parameters": {
"phase": "AccountSetup"
},
"description": "Detects successful token acquisition, indicating the AccountSetup ESP phase has started.",
"enabled": true
},
{
"patternId": "IME-UPDATE-NAME-1",
"category": "currentPhase",
"pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?name\\W+(?<name>.*?)\\W+id\\W+{GUID}",
"action": "updateName",
"description": "Captures the app name from ExecManager processing log (old format: name before id).",
"enabled": true
},
{
"patternId": "IME-UPDATE-NAME-2",
"category": "currentPhase",
"pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name (?<name>.*?)$",
"action": "updateName",
"description": "Captures the app name from ProcessAppWithDependencies log entry.",
"enabled": true
},
{
"patternId": "IME-UPDATE-NAME-3",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Processing app \\(id={GUID}, name = (?<name>.*?)\\)",
"action": "updateName",
"description": "Captures the app name from the Processing app log entry.",
"enabled": true
},
{
"patternId": "IME-USER-SESSION-COMPLETED",
"category": "always",
"pattern": "\\[Win32App\\] \\.+ Completed user session \\d+, userId: (?<userId>[a-f0-9\\-]+), userSID: (?<userSid>S-[\\d\\-]+) \\.+",
"action": "enrollmentCompleted",
"description": "Detects when IME completes a user session, indicating enrollment has finished for that user.",
"enabled": true
},
{
"patternId": "IME-WIN32-STATE-1",
"category": "currentPhase",
"pattern": "\\[Win32App\\] Got InstanceID: Win32App_{GUID}_\\d+, installationStateString: (?<state>\\d)",
"action": "updateWin32AppState",
"description": "Captures the Win32 app installation state string from instance ID tracking (old log format).",
"enabled": true
},
{
"patternId": "IME-WIN32-STATE-2",
"category": "currentPhase",
"pattern": "\\[Win32App\\] (?:Got|Set) (?:ESP )?win32App state (?<state>\\w+) for {GUID}",
"action": "updateWin32AppState",
"description": "Captures the Win32 app ESP state (e.g., Installed, InProgress) for a specific app.",
"enabled": true
},
{
"patternId": "IME-WINGET-INSTALLING-1",
"category": "currentPhase",
"pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID} and user = .*?- Operation Phase = Installing",
"action": "updateStateInstalling",
"description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 1).",
"enabled": true
},
{
"patternId": "IME-WINGET-INSTALLING-2",
"category": "currentPhase",
"pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID}.*?- Operation Phase = Installing",
"action": "updateStateInstalling",
"description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 2).",
"enabled": true
},
{
"patternId": "PS-AGENT-ERROR",
"category": "always",
"pattern": "error from script =(?<output>[\\s\\S]*)",
"action": "scriptOutput",
"parameters": {
"scriptType": "platform",
"outputType": "stderr"
},
"description": "Captures error output from AgentExecutor.log when a platform script produces stderr content.",
"enabled": true
},
{
"patternId": "PS-AGENT-EXITCODE",
"category": "always",
"pattern": "Powershell exit code is (?<exitCode>-?\\d+)",
"action": "scriptExitCode",
"parameters": {
"scriptType": "platform"
},
"description": "Captures the PowerShell exit code from AgentExecutor.log.",
"enabled": true
},
{
"patternId": "PS-AGENT-OUTPUT",
"category": "always",
"pattern": "write output done\\. output = (?<output>[\\s\\S]*?), error = (?<error>[\\s\\S]*)",
"action": "scriptOutput",
"parameters": {
"scriptType": "platform"
},
"description": "Captures both stdout and stderr from AgentExecutor.log when a platform script completes. The output group contains stdout, the error group contains stderr.",
"enabled": true
},
{
"patternId": "PS-AGENT-SCRIPT-START",
"category": "always",
"pattern": "Adding argument powershell with value C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1",
"action": "scriptStarted",
"parameters": {
"scriptType": "platform",
"source": "agentexecutor"
},
"description": "Detects platform script identification in AgentExecutor.log. Captures PolicyId from the script file path for stdout/stderr correlation.",
"enabled": true
},
{
"patternId": "PS-SCRIPT-CONTEXT",
"category": "always",
"pattern": "Launch powershell executor in (?<context>machine|user) session",
"action": "scriptContext",
"description": "Captures whether a PowerShell script runs in machine (System) or user session context.",
"enabled": true
},
{
"patternId": "PS-SCRIPT-EXITCODE",
"category": "always",
"pattern": "Powershell execution is done, exitCode = (?<exitCode>-?\\d+)",
"action": "scriptExitCode",
"description": "Captures the PowerShell exit code when script execution completes in the IME log.",
"enabled": true
},
{
"patternId": "PS-SCRIPT-GENERATED",
"category": "always",
"pattern": "Script file C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1 is generated",
"action": "scriptStarted",
"parameters": {
"scriptType": "platform"
},
"description": "Detects when a platform PowerShell script file is generated by IME. Captures the PolicyId from the script file path.",
"enabled": true
},
{
"patternId": "PS-SCRIPT-RESULT",
"category": "always",
"pattern": "\\[PowerShell\\] User Id = [a-z0-9\\-]+, Policy id = (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}), policy result = (?<result>\\w+)",
"action": "scriptCompleted",
"parameters": {
"scriptType": "platform"
},
"description": "Captures the final result (Success/Failed) of a platform PowerShell script execution with its PolicyId.",
"enabled": true
}
]
}
Reference in New Issue View Git Blame Copy Permalink