mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-25 13:10:13 +00:00
Oliver Kieselbach
e19852cd9a
The backend already reads errorCode from event data for FailureCode and failure reason formatting, but the agent never populated it. This change extracts error codes (exit codes, HRESULT) from named regex capture groups in IME log error patterns and sends them as structured errorCode fields. Also fixes a pre-existing bug where ErrorPatternId/ErrorDetail were not persisted across agent restarts. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
637 lines
27 KiB
JSON
Generated
637 lines
27 KiB
JSON
Generated
{
|
|
"$schema": "../schema/ime-log-pattern.schema.json",
|
|
"rules": [
|
|
{
|
|
"patternId": "HS-COMPLIANCE",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] the pre-remdiation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
|
|
"action": "scriptCompleted",
|
|
"parameters": {
|
|
"scriptType": "remediation",
|
|
"part": "detection"
|
|
},
|
|
"description": "Captures the detection compliance result for a remediation script. True = compliant (no remediation needed), False = non-compliant (remediation will run).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-EXITCODE",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] exit code of the script is (?<exitCode>-?\\d+)",
|
|
"action": "scriptExitCode",
|
|
"parameters": {
|
|
"scriptType": "remediation"
|
|
},
|
|
"description": "Captures the exit code of a remediation script.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-RUN-CONTEXT",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] The policy needs be run as (?<context>System|User)",
|
|
"action": "scriptContext",
|
|
"parameters": {
|
|
"scriptType": "remediation"
|
|
},
|
|
"description": "Captures whether a remediation script runs as System or User context.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-SCRIPT-START",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] ProcessScript PolicyId: (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) PolicyType: (?<policyType>\\d+)",
|
|
"action": "scriptStarted",
|
|
"parameters": {
|
|
"scriptType": "remediation"
|
|
},
|
|
"description": "Detects when a Proactive Remediation (Health Script) starts processing. Captures PolicyId and PolicyType (6 = remediation).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-STDERR",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] err output = (?<output>.*)",
|
|
"action": "scriptOutput",
|
|
"parameters": {
|
|
"scriptType": "remediation",
|
|
"outputType": "stderr"
|
|
},
|
|
"description": "Captures standard error output (stderr) from a remediation script execution.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "HS-STDOUT",
|
|
"category": "always",
|
|
"pattern": "\\[HS\\] std output = (?<output>.*)",
|
|
"action": "scriptOutput",
|
|
"parameters": {
|
|
"scriptType": "remediation",
|
|
"outputType": "stdout"
|
|
},
|
|
"description": "Captures standard output (stdout) from a remediation script execution.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-AGENT-VERSION",
|
|
"category": "always",
|
|
"pattern": "Agent version is: (?<agentVersion>[\\d.]+)",
|
|
"action": "imeAgentVersion",
|
|
"description": "Captures the Intune Management Extension agent version number.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ALREADY-DETECTED-1",
|
|
"category": "otherPhases",
|
|
"pattern": "\\[Win32App\\] Completed detectionManager SideCar\\w+?DetectionManager, applicationDetectedByCurrentRule: True",
|
|
"action": "ignoreCompletedApp",
|
|
"description": "Detects when an app from a previous ESP phase is detected as already installed, so it should be ignored in the current phase.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ALREADY-DETECTED-2",
|
|
"category": "otherPhases",
|
|
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
|
|
"action": "ignoreCompletedApp",
|
|
"description": "Detects enforcement success in a non-current phase, indicating an app completed in a previous phase should be ignored.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DECRYPT-FAILED",
|
|
"category": "currentPhase",
|
|
"pattern": "Decryption is failed for appId {GUID}",
|
|
"action": "updateStateError",
|
|
"description": "Detects when app content decryption fails, indicating a corrupted or tampered download.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DETECTED-INSTALLED-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DetectionState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"Installed\"\"",
|
|
"action": "updateStateInstalled",
|
|
"description": "Detects when an app's detection state transitions to Installed (new ReportingManager format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DETECTED-INSTALLED-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: {GUID} resulted in action status: Success and detection state: Detected",
|
|
"action": "updateStateInstalled",
|
|
"description": "Detects when an app's detection action handler reports successful detection (app is installed).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DETECTED-OLD",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Detected app {GUID} ",
|
|
"action": "updateStateInstalled",
|
|
"description": "Detects when an app is detected as installed (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DO-TEL",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[DO TEL\\] = (?<doTelJson>\\{.*\\})",
|
|
"action": "updateDoTelemetry",
|
|
"description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DO-TIMEOUT-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b).*?intunewin-bin_{GUID}",
|
|
"action": "updateStatePostponed",
|
|
"description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in filename).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DO-TIMEOUT-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b)",
|
|
"action": "updateStatePostponed",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when a Delivery Optimization download times out (generic, uses current app context).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-DOWNLOADING",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[StatusService\\] Downloading app \\(id = {GUID}.*?\\) via (?<tech>\\w+), bytes (?<bytes>\\w+)/(?<ofbytes>\\w+) for user",
|
|
"action": "updateStateDownloading",
|
|
"description": "Captures app download progress including technology (DO/CDN), bytes downloaded, and total bytes.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ENFORCEMENT-SUCCESS",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"InProgressDownloadCompleted\"\",\"\"NewValue\"\":\"\"Success\"\"",
|
|
"action": "updateStateInstalled",
|
|
"description": "Detects when an app's enforcement state transitions from InProgressDownloadCompleted to Success.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ENFORCEMENT-SUCCESS-OLD",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
|
|
"action": "updateStateInstalled",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when enforcement state is set to Success for the current app (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-DOWNLOAD",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Download state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"InProgress\"\",\"\"NewValue\"\":\"\"ErrorDownloadingContent\"\"",
|
|
"action": "updateStateError",
|
|
"description": "Detects when an app's enforcement state transitions to ErrorDownloadingContent.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-ENFORCEMENT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Setting enforcementState as\\W+Error\\b",
|
|
"action": "updateStateError",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when enforcement state is set to Error for the current app (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-NO-CONTENT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Didn't get content info from service",
|
|
"action": "updateStateError",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when IME cannot retrieve content info from the Intune service for the current app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-REPORT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"(?<from>\\w+)\"\",\"\"NewValue\"\":\"\"(?<to>\\w+)\"\"",
|
|
"action": "updateStateError",
|
|
"parameters": {
|
|
"checkTo": "true"
|
|
},
|
|
"description": "Captures enforcement state transitions via ReportingManager. Only triggers error when 'to' value indicates an error state.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-TIMEOUT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Installation is timeout",
|
|
"action": "updateStateError",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when an app installation times out.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ERROR-UNMAPPED-EXIT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Admin did NOT set mapping for lpExitCode\\W+(?<exitCode>\\d+) of app\\W+{GUID}",
|
|
"action": "updateStateError",
|
|
"description": "Detects when an app installer returned an exit code that has no mapping configured in Intune.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ESP-PHASE",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] (?:In|The) EspPhase: (?<espPhase>\\w+)",
|
|
"action": "espPhaseDetected",
|
|
"description": "Detects ESP phase transitions reported by IME Win32App processing (e.g., DeviceSetup, AccountSetup).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-ESP-TRACK-STATUS",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}\\.",
|
|
"action": "espTrackStatus",
|
|
"description": "Captures ESP tracked install status transitions (e.g., InProgress to Installed) for a specific app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-IMPERSONATION",
|
|
"category": "always",
|
|
"pattern": "After impersonation: (?<user>.*?)$",
|
|
"action": "imeImpersonation",
|
|
"description": "Detects when IME impersonates a user context for app installation.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-INSTALL-HANDLER",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ExecutionActionHandler\\] Handler invoked with execution type: Install for policy with id: {GUID}",
|
|
"action": "updateStateInstalling",
|
|
"description": "Detects when the IME execution handler starts installing an app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-LAUNCH-INSTALLER",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Launch Win32AppInstaller in \\w+? session",
|
|
"action": "updateStateInstalling",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when the Win32 app installer process is launched in a user or system session.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NO-ACTION",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] No action required for app with id: {GUID}",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when IME determines no action is required for an app (already in desired state).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-APPLICABLE-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ApplicabilityActionHandler\\] Applicability check for policy with id: {GUID} resulted in action status: Success and applicability state: NotApplicable",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's applicability check returns NotApplicable (requirements not met).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-APPLICABLE-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Applicability state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"ApplicabilityState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"ScriptRequirementRuleNotMet\"\"",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's applicability state is set to ScriptRequirementRuleNotMet (PowerShell requirement script returned false).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-APPLICABLE-3",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DesiredState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"None\"\"",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's desired state is set to None (not targeted or not applicable).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-APPLICABLE-4",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"DesiredState\"\":\\{\"\"OldValue\"\":null,\"\"NewValue\"\":\"\"NotPresent\"\"",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's desired state is set to NotPresent (targeted for uninstall or not required).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-TARGETED-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, targeted intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app with RequiredInstall intent is classified as NotApplicableOrNotTargeted (new log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-NOT-TARGETED-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, effective intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app with effective RequiredInstall intent is classified as NotApplicableOrNotTargeted.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-POLICIES",
|
|
"category": "currentPhase",
|
|
"pattern": "Get policies =\\s*(?<policies>.*)",
|
|
"action": "policiesDiscovered",
|
|
"description": "Captures the JSON policies list discovered by IME, used to build the app inventory.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SESSION-CHANGE",
|
|
"category": "always",
|
|
"pattern": "OnSessionChange:? (?<change>.*?)$",
|
|
"action": "imeSessionChange",
|
|
"description": "Detects Windows session change events (logon, logoff, lock, unlock) reported by IME.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SET-CURRENT-1",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name",
|
|
"action": "setCurrentApp",
|
|
"description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SET-CURRENT-2",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?\\bid\\W+{GUID}",
|
|
"action": "setCurrentApp",
|
|
"description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SET-CURRENT-3",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] ===Step=== Start to Present app {GUID}",
|
|
"action": "setCurrentApp",
|
|
"description": "Detects the start of app presentation step in IME, setting the app as current.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SET-CURRENT-4",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] SetCurrentDirectory:.*?\\\\{GUID}_\\d+",
|
|
"action": "setCurrentApp",
|
|
"description": "Detects when IME sets the working directory for an app's staging folder, setting it as current.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SHUTDOWN",
|
|
"category": "currentPhase",
|
|
"pattern": "EMS Agent received shutdown signal",
|
|
"action": "updateStatePostponed",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when the IME agent receives a shutdown signal, postponing the current app installation.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-APPLICABILITY-NOTMET",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] (?=.*?\\bapplicability\\b)(?=.*?NotMet\\b).*?\\bapp\\W+{GUID}\\b",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-DEPENDENCY-DETECT",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] app\\W+{GUID}\\b.*?\\bis a dependency\\b.*?\\bDetect Only mode\\b.*?\\bfinished processing",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-DETECTED",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Detected app {GUID}.*?skip next step",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an already-detected app is skipped for further processing steps (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-FILTERS",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[V3Processor\\] All apps in the subgraph are not applicable due to assignment filters\\. Skipping processing\\.",
|
|
"action": "updateStateSkipped",
|
|
"parameters": {
|
|
"useCurrentApp": "true"
|
|
},
|
|
"description": "Detects when all apps in a subgraph are skipped due to assignment filter exclusions.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-INSTALL-DETECTED",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Detected app {GUID} and intent is to install, skip applicability check",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app targeted for install is already detected/installed, so the install is skipped (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-UNINSTALL-NOTDETECTED",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Not detected app {GUID} and intent is to un-install, skip applicability check",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app targeted for uninstall is not detected, so the uninstall is skipped (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SKIP-UNINSTALL-NOTDETECTED-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] NOT detected app {GUID}.*?skip un-installation",
|
|
"action": "updateStateSkipped",
|
|
"description": "Detects when an app is not detected and uninstall is skipped (alternate old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-STARTED",
|
|
"category": "always",
|
|
"pattern": "EMS Agent Started",
|
|
"action": "imeStarted",
|
|
"description": "Detects when the Intune Management Extension (IME) agent starts up.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-SUBGRAPH",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\]\\[V3Processor\\] Processing subgraph with app ids: {GUID}",
|
|
"action": "cancelStuckAndSetCurrent",
|
|
"description": "Detects when V3Processor starts a new subgraph, cancelling any stuck app and setting the new app as current.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-TOKEN-SUCCESS",
|
|
"category": "always",
|
|
"pattern": "Successfully get the token",
|
|
"action": "espPhaseDetected",
|
|
"parameters": {
|
|
"phase": "AccountSetup"
|
|
},
|
|
"description": "Detects successful token acquisition, indicating the AccountSetup ESP phase has started.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-UPDATE-NAME-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?name\\W+(?<name>.*?)\\W+id\\W+{GUID}",
|
|
"action": "updateName",
|
|
"description": "Captures the app name from ExecManager processing log (old format: name before id).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-UPDATE-NAME-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name (?<name>.*?)$",
|
|
"action": "updateName",
|
|
"description": "Captures the app name from ProcessAppWithDependencies log entry.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-UPDATE-NAME-3",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Processing app \\(id={GUID}, name = (?<name>.*?)\\)",
|
|
"action": "updateName",
|
|
"description": "Captures the app name from the Processing app log entry.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-USER-SESSION-COMPLETED",
|
|
"category": "always",
|
|
"pattern": "\\[Win32App\\] \\.+ Completed user session \\d+, userId: (?<userId>[a-f0-9\\-]+), userSID: (?<userSid>S-[\\d\\-]+) \\.+",
|
|
"action": "enrollmentCompleted",
|
|
"description": "Detects when IME completes a user session, indicating enrollment has finished for that user.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-WIN32-STATE-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] Got InstanceID: Win32App_{GUID}_\\d+, installationStateString: (?<state>\\d)",
|
|
"action": "updateWin32AppState",
|
|
"description": "Captures the Win32 app installation state string from instance ID tracking (old log format).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-WIN32-STATE-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[Win32App\\] (?:Got|Set) (?:ESP )?win32App state (?<state>\\w+) for {GUID}",
|
|
"action": "updateWin32AppState",
|
|
"description": "Captures the Win32 app ESP state (e.g., Installed, InProgress) for a specific app.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-WINGET-INSTALLING-1",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID} and user = .*?- Operation Phase = Installing",
|
|
"action": "updateStateInstalling",
|
|
"description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 1).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "IME-WINGET-INSTALLING-2",
|
|
"category": "currentPhase",
|
|
"pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID}.*?- Operation Phase = Installing",
|
|
"action": "updateStateInstalling",
|
|
"description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 2).",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-AGENT-ERROR",
|
|
"category": "always",
|
|
"pattern": "error from script =(?<output>[\\s\\S]*)",
|
|
"action": "scriptOutput",
|
|
"parameters": {
|
|
"scriptType": "platform",
|
|
"outputType": "stderr"
|
|
},
|
|
"description": "Captures error output from AgentExecutor.log when a platform script produces stderr content.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-AGENT-EXITCODE",
|
|
"category": "always",
|
|
"pattern": "Powershell exit code is (?<exitCode>-?\\d+)",
|
|
"action": "scriptExitCode",
|
|
"parameters": {
|
|
"scriptType": "platform"
|
|
},
|
|
"description": "Captures the PowerShell exit code from AgentExecutor.log.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-AGENT-OUTPUT",
|
|
"category": "always",
|
|
"pattern": "write output done\\. output = (?<output>[\\s\\S]*?), error = (?<error>[\\s\\S]*)",
|
|
"action": "scriptOutput",
|
|
"parameters": {
|
|
"scriptType": "platform"
|
|
},
|
|
"description": "Captures both stdout and stderr from AgentExecutor.log when a platform script completes. The output group contains stdout, the error group contains stderr.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-AGENT-SCRIPT-START",
|
|
"category": "always",
|
|
"pattern": "Adding argument powershell with value C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1",
|
|
"action": "scriptStarted",
|
|
"parameters": {
|
|
"scriptType": "platform",
|
|
"source": "agentexecutor"
|
|
},
|
|
"description": "Detects platform script identification in AgentExecutor.log. Captures PolicyId from the script file path for stdout/stderr correlation.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-SCRIPT-CONTEXT",
|
|
"category": "always",
|
|
"pattern": "Launch powershell executor in (?<context>machine|user) session",
|
|
"action": "scriptContext",
|
|
"description": "Captures whether a PowerShell script runs in machine (System) or user session context.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-SCRIPT-EXITCODE",
|
|
"category": "always",
|
|
"pattern": "Powershell execution is done, exitCode = (?<exitCode>-?\\d+)",
|
|
"action": "scriptExitCode",
|
|
"description": "Captures the PowerShell exit code when script execution completes in the IME log.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-SCRIPT-GENERATED",
|
|
"category": "always",
|
|
"pattern": "Script file C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1 is generated",
|
|
"action": "scriptStarted",
|
|
"parameters": {
|
|
"scriptType": "platform"
|
|
},
|
|
"description": "Detects when a platform PowerShell script file is generated by IME. Captures the PolicyId from the script file path.",
|
|
"enabled": true
|
|
},
|
|
{
|
|
"patternId": "PS-SCRIPT-RESULT",
|
|
"category": "always",
|
|
"pattern": "\\[PowerShell\\] User Id = [a-z0-9\\-]+, Policy id = (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}), policy result = (?<result>\\w+)",
|
|
"action": "scriptCompleted",
|
|
"parameters": {
|
|
"scriptType": "platform"
|
|
},
|
|
"description": "Captures the final result (Success/Failed) of a platform PowerShell script execution with its PolicyId.",
|
|
"enabled": true
|
|
}
|
|
]
|
|
}
|