Oliver Kieselbach 6c6014940e rules: hybrid user-affinity + never-settled-app detection, dsregcmd on_event snapshot, evidence interpolation fixes ...

ANALYZE-ID-004 (hybrid sign-in never establishes Entra user affinity),
ANALYZE-APP-015 (required app pending forever, ESP completion deferred),
ANALYZE-ENRL-002 v1.1 (desktop-reached + apps-done evidence), GATHER-DEVICE-006
(dsregcmd /status triggered by hybrid_login_pending). Engine: list evidence
values now comma-joined for UI/{{token}} interpolation; timeoutHours added to
the evidence whitelist so ANALYZE-ENRL-002's explanation interpolates.

Motivated by esa-logistics sessions 3ac8cb0e/95f71149 (user-phase stuck,
GlobalProtect never settling, placeholder identity persisting across reboots).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-14 13:39:16 +02:00

..

GATHER-APPS-001.json

added centralized guardrails for easier maintenance, added some more gather rules

2026-03-17 17:17:08 +01:00

GATHER-DEVICE-001.json

version bump

2026-02-28 14:11:35 +01:00

GATHER-DEVICE-002.json

feat: externalize rules to GitHub + API consolidation + preview mode

2026-02-28 13:12:09 +01:00

GATHER-DEVICE-003.json

added centralized guardrails for easier maintenance, added some more gather rules

2026-03-17 17:17:08 +01:00

GATHER-DEVICE-004.json

feat(wu-oobe): detect & surface Windows Update during OOBE + self-maintaining rule sunset

2026-07-08 18:22:41 +02:00

GATHER-DEVICE-005.json

feat(wu-oobe): detect & surface Windows Update during OOBE + self-maintaining rule sunset

2026-07-08 18:22:41 +02:00

GATHER-DEVICE-006.json

rules: hybrid user-affinity + never-settled-app detection, dsregcmd on_event snapshot, evidence interpolation fixes

2026-08-14 13:39:16 +02:00

GATHER-ENROLL-001.json

added centralized guardrails for easier maintenance, added some more gather rules

2026-03-17 17:17:08 +01:00

GATHER-ENROLL-002.json

fixed new gather rules and added severity override

2026-03-17 18:19:21 +01:00

GATHER-ID-001.json

added centralized guardrails for easier maintenance, added some more gather rules

2026-03-17 17:17:08 +01:00

GATHER-ID-002.json

fix community gather cert rule

2026-03-17 22:43:17 +01:00