Files
AutopilotMonitor/rules/ime-log-patterns/HS-SCRIPT-START.json
T
2026-03-05 10:12:57 +01:00

11 lines
505 B
JSON

{
"$schema": "../schema/ime-log-pattern.schema.json",
"patternId": "HS-SCRIPT-START",
"category": "always",
"pattern": "\\[HS\\] ProcessScript PolicyId: (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) PolicyType: (?<policyType>\\d+)",
"action": "scriptStarted",
"parameters": { "scriptType": "remediation" },
"description": "Detects when a Proactive Remediation (Health Script) starts processing. Captures PolicyId and PolicyType (6 = remediation).",
"enabled": true
}