mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 04:32:32 +00:00
Oliver Kieselbach
76284cfcb2
The post-PR-HS1 single-source design (HS-NEW-RESULT JSON only) had a real timing gap: IME emits the [HS] new result = JSON line only AFTER its batch send to the Microsoft service, ~30-90 s after the actual script ran (verified in session c1e714e6: 34-74 s gap per policy). Short Autopilot enrollments often end inside that window, so health- script rows were entirely missing from completed sessions even though IME had executed the scripts. Two-stage approach (matches original V1 timing for the early signal, while keeping HS-NEW-RESULT as the canonical truth): - Re-add HS-COMPLIANCE pattern matching BOTH `pre-remdiation` AND `post-remdiation` detection compliance lines → HandleHealthScriptDetectionResult emits a script_completed event immediately. Single regex (`(?<part>pre|post)-remdiation`) covers both phases. - Re-add HS-RUN-CONTEXT / HS-EXITCODE / HS-STDOUT / HS-STDERR patterns feeding a single-slot `_pendingHealthScript` accumulator (IME runs health scripts sequentially within a session — verified). HS-COMPLIANCE merges the slot data onto the early-signal event so exit / stdout / stderr / runContext are populated from the start, not just the inferred compliance verdict. - HS-NEW-RESULT continues to fire later with the full JSON (RemediationStatus, TargetType, ErrorCode, plus the actual remediation phase's data). UI reducer's dataCompleteness() scoring keeps the more complete entry — early-signal row gets enriched in place, no duplicate cards. Remediation phase itself has no early-signal source in IME logs (only the late JSON exposes Info.RemediationExitCode and RemediationScriptOutputDetails). A follow-up based on the agentexecutor invocation line's _RemediationScript.output suffix is possible once we have a real non-compliant cycle log to validate against. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
102 lines
3.5 KiB
JSON
102 lines
3.5 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://raw.githubusercontent.com/OliverKieselbach/Autopilot-Monitor/main/rules/schema/ime-log-pattern.schema.json",
|
|
"title": "Autopilot Monitor IME Log Pattern",
|
|
"description": "Defines a regex pattern for Intune Management Extension (IME) log parsing during Autopilot enrollment.",
|
|
"oneOf": [
|
|
{ "$ref": "#/$defs/imeLogPattern" },
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"$schema": { "type": "string" },
|
|
"rules": {
|
|
"type": "array",
|
|
"items": { "$ref": "#/$defs/imeLogPattern" }
|
|
}
|
|
},
|
|
"required": ["rules"],
|
|
"additionalProperties": false
|
|
}
|
|
],
|
|
"$defs": {
|
|
"imeLogPattern": {
|
|
"type": "object",
|
|
"properties": {
|
|
"$schema": {
|
|
"type": "string",
|
|
"description": "JSON Schema reference for editor IntelliSense."
|
|
},
|
|
"patternId": {
|
|
"type": "string",
|
|
"description": "Unique pattern identifier (e.g., \"IME-ESP-PHASE\")."
|
|
},
|
|
"category": {
|
|
"type": "string",
|
|
"description": "Pattern category controlling when the pattern is active.",
|
|
"enum": ["always", "currentPhase", "otherPhases"]
|
|
},
|
|
"pattern": {
|
|
"type": "string",
|
|
"description": "Regex pattern string to match against IME log message content. Supports named capture groups. Uses {GUID} as placeholder for the standard GUID capture pattern."
|
|
},
|
|
"action": {
|
|
"type": "string",
|
|
"description": "Action to perform when the pattern matches. Must match an action handler in the agent's ImeLogTracker.",
|
|
"enum": [
|
|
"setCurrentApp",
|
|
"updateStateInstalled",
|
|
"updateStateDownloading",
|
|
"updateStateInstalling",
|
|
"updateStateSkipped",
|
|
"updateStateError",
|
|
"updateStatePostponed",
|
|
"espPhaseDetected",
|
|
"imeStarted",
|
|
"policiesDiscovered",
|
|
"ignoreCompletedApp",
|
|
"imeAgentVersion",
|
|
"espTrackStatus",
|
|
"updateName",
|
|
"updateWin32AppState",
|
|
"cancelStuckAndSetCurrent",
|
|
"imeSessionChange",
|
|
"imeImpersonation",
|
|
"enrollmentCompleted",
|
|
"updateDoTelemetry",
|
|
"scriptStarted",
|
|
"scriptContext",
|
|
"scriptExitCode",
|
|
"scriptOutput",
|
|
"scriptCompleted",
|
|
"healthScriptResult",
|
|
"healthScriptDetectionResult",
|
|
"captureExitCode",
|
|
"captureHResult",
|
|
"captureAppVersion",
|
|
"captureAppTypeWinGet",
|
|
"captureAppTypeMsi",
|
|
"captureAttemptNumber",
|
|
"captureDetectionResult"
|
|
]
|
|
},
|
|
"parameters": {
|
|
"type": "object",
|
|
"description": "Optional extra parameters for the action handler (all values are strings).",
|
|
"additionalProperties": { "type": "string" }
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"description": "Human-readable description of what this pattern detects and why."
|
|
},
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether this pattern is enabled. Set to false to add a pattern without activating it immediately.",
|
|
"default": true
|
|
}
|
|
},
|
|
"required": ["patternId", "category", "pattern", "action"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|