examples/EverydayChecks.json
|
{ "$schema": "../Data/Baseline.schema.json", "Name": "Contoso.EverydayChecks", "Version": "1.0.0", "Description": "Editable examples for file, text log, Windows event, and network connection checks. Replace every Contoso sample before use.", "Controls": [ { "Id": "APP-CONFIG-PRESENT", "Title": "The app configuration file is present", "Description": "Checks that the file the Contoso app needs is available.", "WhyItMatters": "The app may not start correctly without its approved configuration file.", "HowChecked": "EndpointForge looks for this exact local file path. It reads file information but does not open the file contents or change the file.", "WhatWouldChange": "Nothing. This is a report-only check.", "ManualAction": "Ask the application owner to restore or reinstall the approved configuration file.", "SafetyNotes": "Replace this sample path before use. Local drive paths are allowed; network shares, wildcards, links, and relative paths are blocked.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "FileExists", "Severity": "High", "Path": "%ProgramData%\\Contoso\\App\\settings.json", "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "APP-STARTED-IN-LOG", "Title": "The app reported a successful start in its log", "Description": "Looks for the app's normal startup words near the end of one text log.", "WhyItMatters": "A recent startup message is one sign that the app reached its normal running state.", "HowChecked": "EndpointForge searches for exact ordinary text in the newest 2,000 lines, ignoring letter case. It does not use a wildcard or regular expression.", "WhatWouldChange": "Nothing. EndpointForge does not edit, clear, copy, or rotate the log.", "ManualAction": "Confirm that the app is installed and running, then review its full log with the application owner.", "SafetyNotes": "Replace the sample path and text before use. A matching line can be old or incomplete evidence and does not prove the entire app is healthy. Matching lines are never included in EndpointForge results.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "FileContainsText", "Severity": "Medium", "Path": "%ProgramData%\\Contoso\\App\\app.log", "Text": "Application started successfully", "TailLines": 2000, "CaseSensitive": false, "Encoding": "Utf8", "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "APP-SUCCESS-EVENT", "Title": "The app recorded a recent success event", "Description": "Looks for the Contoso app's documented success event during the last 24 hours.", "WhyItMatters": "A recent success event provides evidence that the app completed an important action.", "HowChecked": "EndpointForge counts event 1000 from Contoso App in the Application log during the last 1,440 minutes. It does not include event messages or event data in the result.", "WhatWouldChange": "Nothing. EndpointForge never writes to or clears Windows event logs.", "ManualAction": "Review the app console and its event history if no recent success event is found.", "SafetyNotes": "Replace the fictional source and event ID with values documented by your product. An event ID has meaning only together with its log and usually its source.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "WindowsEvent", "Severity": "High", "LogName": "Application", "ProviderName": "Contoso App", "EventIds": [1000], "LookbackMinutes": 1440, "MinimumCount": 1, "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "APP-SERVER-HTTPS", "Title": "The app server accepts secure web connections", "Description": "Checks whether this computer can start a TCP connection to the named server.", "WhyItMatters": "The app needs this network path before it can contact its server.", "HowChecked": "EndpointForge makes one connection attempt to app.contoso.example on TCP port 443, then closes it without sending application data.", "WhatWouldChange": "Nothing on this computer. The destination server, firewall, or network monitoring tools may record the brief connection attempt.", "ManualAction": "Check the server name, DNS, network path, firewall policy, and application service with the responsible team.", "SafetyNotes": "Replace the .example host before use. A successful TCP connection does not prove that HTTPS, sign-in, or the application itself is healthy.", "RecoveryGuidance": "EndpointForge makes no local change, so there is nothing to undo.", "Type": "TcpPort", "Severity": "High", "HostName": "app.contoso.example", "Port": 443, "TimeoutMilliseconds": 3000, "DesiredValue": true, "Remediable": false, "RequiresReboot": false } ] } |