examples/EverydayChecks.json
|
{ "$schema": "../Data/Baseline.schema.json", "Name": "Contoso.EverydayChecks", "Version": "2.0.0", "Description": "Editable examples for everyday computer health, applications, jobs, files, logs, certificates, access, and approved network checks. Replace every Contoso sample before use.", "Controls": [ { "Id": "APP-CONFIG-PRESENT", "Title": "The app configuration file is present", "Description": "Checks that the file the Contoso app needs is available.", "WhyItMatters": "The app may not start correctly without its approved configuration file.", "HowChecked": "EndpointForge looks for this exact local file path. It reads file information but does not open the file contents or change the file.", "WhatWouldChange": "Nothing. This is a report-only check.", "ManualAction": "Ask the application owner to restore or reinstall the approved configuration file.", "SafetyNotes": "Replace this sample path before use. Local drive paths are allowed; network shares, wildcards, links, and relative paths are blocked.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "FileExists", "Severity": "High", "Path": "%ProgramData%\\Contoso\\App\\settings.json", "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "APP-STARTED-IN-LOG", "Title": "The app reported a successful start in its log", "Description": "Looks for the app's normal startup words near the end of one text log.", "WhyItMatters": "A recent startup message is one sign that the app reached its normal running state.", "HowChecked": "EndpointForge searches for exact ordinary text in the newest 2,000 lines, ignoring letter case. It does not use a wildcard or regular expression.", "WhatWouldChange": "Nothing. EndpointForge does not edit, clear, copy, or rotate the log.", "ManualAction": "Confirm that the app is installed and running, then review its full log with the application owner.", "SafetyNotes": "Replace the sample path and text before use. A matching line can be old or incomplete evidence and does not prove the entire app is healthy. Matching lines are never included in EndpointForge results.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "FileContainsText", "Severity": "Medium", "Path": "%ProgramData%\\Contoso\\App\\app.log", "Text": "Application started successfully", "TailLines": 2000, "CaseSensitive": false, "Encoding": "Utf8", "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "APP-SUCCESS-EVENT", "Title": "The app recorded a recent success event", "Description": "Looks for the Contoso app's documented success event during the last 24 hours.", "WhyItMatters": "A recent success event provides evidence that the app completed an important action.", "HowChecked": "EndpointForge counts event 1000 from Contoso App in the Application log during the last 1,440 minutes. It does not include event messages or event data in the result.", "WhatWouldChange": "Nothing. EndpointForge never writes to or clears Windows event logs.", "ManualAction": "Review the app console and its event history if no recent success event is found.", "SafetyNotes": "Replace the fictional source and event ID with values documented by your product. An event ID has meaning only together with its log and usually its source.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "WindowsEvent", "Severity": "High", "LogName": "Application", "ProviderName": "Contoso App", "EventIds": [1000], "LookbackMinutes": 1440, "MinimumCount": 1, "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "APP-SERVER-HTTPS", "Title": "The app server accepts secure web connections", "Description": "Checks whether this computer can start a TCP connection to the named server.", "WhyItMatters": "The app needs this network path before it can contact its server.", "HowChecked": "EndpointForge makes one connection attempt to app.contoso.example on TCP port 443, then closes it without sending application data.", "WhatWouldChange": "Nothing on this computer. The destination server, firewall, or network monitoring tools may record the brief connection attempt.", "ManualAction": "Check the server name, DNS, network path, firewall policy, and application service with the responsible team.", "SafetyNotes": "Replace the .example host before use. A successful TCP connection does not prove that HTTPS, sign-in, or the application itself is healthy.", "RecoveryGuidance": "EndpointForge makes no local change, so there is nothing to undo.", "Type": "TcpPort", "Severity": "High", "HostName": "app.contoso.example", "Port": 443, "TimeoutMilliseconds": 3000, "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "RESTART-NOT-WAITING", "Title": "The computer does not have unfinished work waiting for a restart", "Description": "Checks whether Windows reports that a restart is needed.", "WhyItMatters": "Updates and configuration changes may not finish until Windows restarts.", "HowChecked": "EndpointForge reads Windows servicing, update, installer, rename, and file-replacement indicators.", "WhatWouldChange": "Nothing. EndpointForge never restarts the computer automatically.", "ManualAction": "Save your work and restart through your organization's approved process.", "SafetyNotes": "A passing answer means Windows did not report a pending restart when checked; it does not predict future update activity.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "PendingRestart", "Severity": "Medium", "DesiredValue": false, "Remediable": false, "RequiresReboot": false }, { "Id": "SYSTEM-DRIVE-SPACE", "Title": "The Windows drive has enough free space", "Description": "Checks that the Windows drive has at least 15 percent free space.", "WhyItMatters": "Windows and applications need free space to update and work reliably.", "HowChecked": "EndpointForge reads the total and free space reported for the exact fixed local drive.", "WhatWouldChange": "Nothing. EndpointForge does not delete, move, compress, or clean up files.", "ManualAction": "Use your organization's approved storage cleanup or capacity process.", "SafetyNotes": "Change the drive and threshold to match the computer's role.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "DiskSpace", "Severity": "High", "Drive": "%SystemDrive%", "MinimumFreePercent": 15, "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "WINDOWS-UPDATES-CLEAR", "Title": "No required Windows software updates are waiting", "Description": "Checks whether the number of waiting Windows updates is within the allowed limit.", "WhyItMatters": "Required updates can contain reliability and security improvements.", "HowChecked": "After explicit network approval, EndpointForge asks the configured Windows Update or WSUS service for assigned, non-hidden, uninstalled software updates and returns only the number waiting.", "WhatWouldChange": "Nothing is installed or configured. The scan can contact the update service and refresh Windows Update scan metadata.", "ManualAction": "Use your organization's approved update schedule and deployment tool.", "SafetyNotes": "MaximumCount is the largest passing count and is 0 here. Optional updates and drivers are excluded. EndpointForge never downloads updates, accepts licenses, installs updates, or restarts Windows. An incomplete scan or warning is reported as Could not check.", "RecoveryGuidance": "EndpointForge installs nothing, so there is no EndpointForge change to undo.", "Type": "WindowsUpdateAvailable", "Severity": "High", "MaximumCount": 0, "IncludeOptional": false, "IncludeDrivers": false, "TimeoutSeconds": 120, "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "APP-INSTALLED", "Title": "The approved application is installed at the required version", "Description": "Checks one exact application display name and minimum version.", "WhyItMatters": "The computer may need an approved application version to provide the expected service.", "HowChecked": "EndpointForge reads the explicit 32-bit and 64-bit machine uninstall registry views and never uses Win32_Product or triggers an installer consistency check.", "WhatWouldChange": "Nothing. EndpointForge does not install, repair, update, or remove software.", "ManualAction": "Use your organization's approved software deployment tool.", "SafetyNotes": "Replace the fictional application name, publisher, and version. Scope and Architecture must be compatible; Windows Arm requires Architecture All. CurrentUser means the account running EndpointForge, which may be SYSTEM in management tools. Unusable version evidence is reported as Could not check.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "InstalledApplication", "Severity": "High", "ApplicationName": "Contoso Endpoint Agent", "Publisher": "Contoso", "Scope": "Machine", "Architecture": "All", "MinimumVersion": "1.0.0", "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "APP-TASK-HEALTHY", "Title": "The application maintenance job ran successfully today", "Description": "Checks an exact scheduled job's enabled state, last result, and last run time.", "WhyItMatters": "A missed or failed scheduled job can leave maintenance work incomplete.", "HowChecked": "EndpointForge reads the exact job's enabled state, last run time, and result code, and compares its age in UTC without returning actions or arguments.", "WhatWouldChange": "Nothing. EndpointForge does not start, stop, enable, disable, create, or edit the job.", "ManualAction": "Review the job in Task Scheduler with the application owner.", "SafetyNotes": "Replace the fictional path and name. Choose an age that matches how often the job is expected to run. A missing or never-run job does not pass; unavailable or untrustworthy job information is reported as Could not check.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "ScheduledTaskHealth", "Severity": "High", "TaskPath": "\\Contoso\\", "TaskName": "Endpoint Agent Maintenance", "MaximumAgeMinutes": 1440, "ExpectedLastTaskResult": 0, "RequireEnabled": true, "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "DEFENDER-DEFINITIONS-RECENT", "Title": "Microsoft Defender threat definitions are recent", "Description": "Checks that Defender definitions are no more than seven days old.", "WhyItMatters": "Recent threat definitions help Defender recognize newly identified threats.", "HowChecked": "EndpointForge reads the definition age reported by Microsoft Defender.", "WhatWouldChange": "Nothing. EndpointForge does not refresh Defender or change antivirus settings.", "ManualAction": "Use your organization's approved Defender update and troubleshooting process.", "SafetyNotes": "If Defender is present but not the active antivirus provider, this item reports Not applicable instead of passing. If Defender status cannot be read, it reports Could not check.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "DefenderSignatureHealth", "Severity": "High", "MaximumAgeDays": 7, "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "BACKUP-MARKER-RECENT", "Title": "The backup status file was updated recently", "Description": "Checks whether one exact local file was modified during the last day.", "WhyItMatters": "A current status file can provide evidence that a backup or export job is still producing output.", "HowChecked": "EndpointForge reads only the file modified time; it does not read the file contents.", "WhatWouldChange": "Nothing. EndpointForge does not create, edit, move, or delete the file.", "ManualAction": "Review the backup tool and its approved logs with the responsible team.", "SafetyNotes": "Replace the sample path and choose an age that matches the expected job schedule. A recent file alone does not prove a complete backup.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "FileFreshness", "Severity": "High", "Path": "%ProgramData%\\Contoso\\Backup\\backup.status", "MaximumAgeMinutes": 1440, "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "APP-CERTIFICATE-VALID", "Title": "The application certificate will remain valid for at least 30 days", "Description": "Checks one exact certificate thumbprint in the local computer personal store.", "WhyItMatters": "An expired certificate can interrupt authentication or encrypted service connections.", "HowChecked": "EndpointForge opens the selected Windows certificate store read-only and compares its validity dates in UTC using complete days remaining.", "WhatWouldChange": "Nothing. EndpointForge does not import, export, renew, remove, or access private keys.", "ManualAction": "Use your organization's approved certificate renewal and deployment process.", "SafetyNotes": "Replace the fictional thumbprint. The result does not include the certificate subject, names, or private-key details.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "CertificateExpiry", "Severity": "High", "StoreLocation": "LocalMachine", "StoreName": "My", "Thumbprint": "0123456789ABCDEF0123456789ABCDEF01234567", "MinimumDaysRemaining": 30, "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "APP-SERVER-DNS", "Title": "This computer can find the application server name", "Description": "Checks whether Windows can resolve one absolute server name.", "WhyItMatters": "Applications usually need DNS to translate a server name before they can connect.", "HowChecked": "After explicit network approval, EndpointForge performs one time-limited Windows name-resolution operation and returns only a yes-or-no answer.", "WhatWouldChange": "Nothing. Name-resolution and network monitoring systems may record the activity.", "ManualAction": "Check the name, DNS settings, network path, and the responsible DNS service.", "SafetyNotes": "Replace the .example name with one approved absolute, multi-label DNS name. IP addresses and URLs are rejected. Resolved addresses are not included in EndpointForge results.", "RecoveryGuidance": "EndpointForge makes no local change, so there is nothing to undo.", "Type": "DnsResolution", "Severity": "High", "HostName": "app.contoso.example", "TimeoutMilliseconds": 3000, "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "APP-WEB-HEALTH", "Title": "The application web service is responding normally", "Description": "Checks whether one exact HTTPS health address returns status 200.", "WhyItMatters": "A web response provides stronger evidence than an open port that the service is answering HTTP requests.", "HowChecked": "After explicit network approval, EndpointForge sends a time-limited HEAD request and compares only the status code.", "WhatWouldChange": "Nothing. The web service and network monitoring systems may record the request.", "ManualAction": "Review the application service, certificate, proxy, firewall, and network path with the responsible team.", "SafetyNotes": "Replace the .example address. Redirects are blocked here. If enabled, EndpointForge follows at most five safe same-origin redirects. It uses normal certificate validation, sends no explicit origin or proxy credentials or custom headers, does not include response headers in results, and does not read the response body.", "RecoveryGuidance": "EndpointForge makes no local change, so there is nothing to undo.", "Type": "HttpEndpointHealth", "Severity": "High", "Uri": "https://app.contoso.example/health", "Method": "Head", "ExpectedStatusCode": 200, "AllowRedirects": false, "TimeoutMilliseconds": 5000, "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "APP-PROCESS-RUNNING", "Title": "The application program is running", "Description": "Checks for one exact process name.", "WhyItMatters": "A running process is a quick sign that the application has started.", "HowChecked": "EndpointForge checks the exact process name. IDs and other process details are not included in results; command lines, owners, and modules are not read.", "WhatWouldChange": "Nothing. EndpointForge does not start, stop, suspend, or inspect process contents.", "ManualAction": "Review the application service or console with the application owner.", "SafetyNotes": "Replace the fictional name. A running process does not prove that the application is healthy or responsive.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "ProcessRunning", "Severity": "Medium", "ProcessName": "ContosoAgent.exe", "DesiredValue": true, "Remediable": false, "RequiresReboot": false }, { "Id": "APP-LOCAL-GROUP-MEMBER", "Title": "The approved support account is in the application operators group", "Description": "Checks one exact direct membership in one exact local group.", "WhyItMatters": "Expected group membership can be required for approved application support access.", "HowChecked": "After explicit network approval, EndpointForge resolves only the requested account to a SID, reads direct group members as raw SIDs, and returns only the requested yes-or-no relationship.", "WhatWouldChange": "Nothing. EndpointForge does not add or remove accounts or change groups.", "ManualAction": "Use your organization's approved identity and local-access management process.", "SafetyNotes": "Replace both fictional names. Account-name resolution can contact an organizational identity provider; use a direct SID to avoid that lookup. Nested groups are not expanded, at most 4,096 direct members are compared, and unrelated identities are not resolved or included. Use 64-bit PowerShell on 64-bit Windows.", "RecoveryGuidance": "EndpointForge makes no change, so there is nothing to undo.", "Type": "LocalGroupMembership", "Severity": "High", "GroupName": "Contoso App Operators", "MemberName": "CONTOSO\\Endpoint Operators", "TimeoutSeconds": 15, "DesiredValue": true, "Remediable": false, "RequiresReboot": false } ] } |