Definitions/checks.json
|
{
"Version": "0.23.0", "Generated": "2026-10-12", "Scopes": [ { "Name": "Hardware", "Title": "Hardware", "Apps": false, "Checks": [ "System", "Power", "CPU at rest", "Memory", "Storage", "Disk write test", "Disk health", "Temperature", "Battery", "CPU stress test", "Recent changes", "Stability", "Crash dumps", "Network disruptions" ] }, { "Name": "Network", "Title": "Netzwerk", "Apps": false, "Checks": [ "System", "Network", "Network dependencies", "Network dependencies of all accounts", "Network disruptions", "Network protocols", "Domain", "Windows Firewall", "Remote Desktop connections", "Web folders", "Printing", "Startup" ] }, { "Name": "SignIn", "Title": "Anmeldung und Dom\u00e4ne", "Apps": false, "Checks": [ "System", "Storage", "Network", "Network dependencies", "Network dependencies of all accounts", "Network disruptions", "Network protocols", "Domain", "Windows Firewall", "Recent changes", "Startup", "Printing", "Boot performance", "Group Policy", "Sign-in", "User sessions of all accounts", "User session", "User profiles of all accounts", "User profile", "User settings" ] }, { "Name": "Apps", "Title": "Anwendungen", "Apps": true, "Checks": [ "System", "Recent changes", "Stability", "Network disruptions", "Disk health", ".NET versions", "Running programs of all accounts", "Running programs" ] }, { "Name": "Quick", "Title": "Schnell (ohne Belastungstests)", "Apps": true, "Except": [ "CPU stress test", "Disk write test" ] } ], "Checks": [ { "Name": "System", "Kind": "System" }, { "Name": "Power", "Kind": "Power" }, { "Name": "CPU at rest", "Kind": "Cpu" }, { "Name": "Memory", "Kind": "Memory" }, { "Name": "Storage", "Kind": "Storage" }, { "Name": "Disk write test", "Kind": "DiskTest" }, { "Name": "Network", "Kind": "Network" }, { "Name": "Network dependencies", "Kind": "NetworkDependency", "MinimumModuleVersion": "0.5" }, { "Name": "Network disruptions", "Kind": "NetworkDisruption", "MinimumModuleVersion": "0.5", "Parameters": { "ContextKinds": [ "smb-reconnect", "smb-share-refused", "smb-auth-failed", "link-down", "link-up", "wlan-disconnect", "wlan-connect-failed", "standby", "resume", "system-start", "offline-files-online", "offline-files-slow-link" ], "Scans": [ { "Log": "Microsoft-Windows-SmbClient/Connectivity", "Provider": [ "Microsoft-Windows-SMBClient" ], "Id": [ 30800, 30803, 30829 ], "Kind": "smb-connect-failed", "ServerIndex": 3 }, { "Log": "Microsoft-Windows-SmbClient/Connectivity", "Provider": [ "Microsoft-Windows-SMBClient" ], "Id": [ 30804 ], "Kind": "smb-disconnect", "ServerIndex": 5, "ServerIndexByVersion": { "0": 3 } }, { "Log": "Microsoft-Windows-SmbClient/Connectivity", "Provider": [ "Microsoft-Windows-SMBClient" ], "Id": [ 30805, 30807 ], "Kind": "smb-share-not-found", "ServerIndex": 4, "AddressIndex": 6, "Match": { "0": [ 3221225676, -1073741620 ] } }, { "Log": "Microsoft-Windows-SmbClient/Connectivity", "Provider": [ "Microsoft-Windows-SMBClient" ], "Id": [ 30805, 30807 ], "Kind": "smb-disconnect", "ServerIndex": 4, "AddressIndex": 6, "Except": { "0": [ 3221225676, -1073741620 ] } }, { "Log": "Microsoft-Windows-SmbClient/Connectivity", "Provider": [ "Microsoft-Windows-SMBClient" ], "Id": [ 30806, 30808 ], "Kind": "smb-reconnect", "ServerIndex": 4, "AddressIndex": 6 }, { "Log": "Microsoft-Windows-SmbClient/Connectivity", "Provider": [ "Microsoft-Windows-SMBClient" ], "Id": [ 30809 ], "Kind": "smb-timeout", "ServerIndex": 5 }, { "Log": "Microsoft-Windows-SmbClient/Connectivity", "Provider": [ "Microsoft-Windows-SMBClient" ], "Id": [ 30823 ], "Kind": "smb-timeout", "ServerIndex": 3 }, { "Log": "Microsoft-Windows-SMBClient/Operational", "Provider": [ "Microsoft-Windows-SMBClient" ], "Id": [ 30611, 30612 ], "Kind": "smb-handle-lost", "ServerIndex": 9 }, { "Log": "Microsoft-Windows-SMBClient/Operational", "Provider": [ "Microsoft-Windows-SMBClient" ], "Id": [ 30906 ], "Kind": "smb-handle-lost", "ServerIndex": 3 }, { "Log": "Microsoft-Windows-SmbClient/Security", "Provider": [ "Microsoft-Windows-SMBClient" ], "Id": [ 31010 ], "Kind": "smb-share-refused", "ServerIndex": 3 }, { "Log": "Microsoft-Windows-SmbClient/Security", "Provider": [ "Microsoft-Windows-SMBClient" ], "Id": [ 31017 ], "Kind": "smb-auth-failed", "ServerIndex": 3 }, { "Log": "System", "Provider": [ "mrxsmb" ], "Id": [ 3013 ], "Kind": "smb-timeout", "ServerIndex": 1 }, { "Log": "System", "Provider": [ "mrxsmb" ], "Id": [ 3029 ], "Kind": "smb-connect-failed", "ServerIndex": 1 }, { "Log": "System", "Provider": [ "mrxsmb" ], "Id": [ 3036 ], "Kind": "smb-disconnect" }, { "Log": "System", "Provider": [ "Microsoft-Windows-NDIS" ], "Id": [ 10400 ], "Kind": "adapter-reset" }, { "Log": "System", "Provider": [ "Tcpip" ], "Id": [ 4202 ], "Kind": "link-down" }, { "Log": "System", "Provider": [ "e1dexpress" ], "Id": [ 27 ], "Kind": "link-down" }, { "Log": "System", "Provider": [ "e1dnexpress" ], "Id": [ 27 ], "Kind": "link-down" }, { "Log": "System", "Provider": [ "Tcpip" ], "Id": [ 4201 ], "Kind": "link-up" }, { "Log": "System", "Provider": [ "e1dexpress" ], "Id": [ 32 ], "Kind": "link-up" }, { "Log": "System", "Provider": [ "e1dnexpress" ], "Id": [ 32 ], "Kind": "link-up" }, { "Log": "System", "Provider": [ "Microsoft-Windows-Kernel-Boot" ], "Id": [ 27 ], "Kind": "system-start" }, { "Log": "System", "Provider": [ "Microsoft-Windows-Kernel-Power" ], "Id": [ 42, 506 ], "Kind": "standby" }, { "Log": "System", "Provider": [ "Microsoft-Windows-Kernel-Power" ], "Id": [ 107, 507 ], "Kind": "resume" }, { "Log": "System", "Provider": [ "Microsoft-Windows-Power-Troubleshooter" ], "Id": [ 1 ], "Kind": "resume" }, { "Log": "Microsoft-Windows-NetworkProfile/Operational", "Provider": [ "Microsoft-Windows-NetworkProfile" ], "Id": [ 10001 ], "Kind": "network-disconnected" }, { "Log": "Microsoft-Windows-WLAN-AutoConfig/Operational", "Provider": [ "Microsoft-Windows-WLAN-AutoConfig" ], "Id": [ 8003 ], "Kind": "wlan-disconnect" }, { "Log": "Microsoft-Windows-WLAN-AutoConfig/Operational", "Provider": [ "Microsoft-Windows-WLAN-AutoConfig" ], "Id": [ 8002 ], "Kind": "wlan-connect-failed" }, { "Log": "Microsoft-Windows-OfflineFiles/Operational", "Provider": [ "Microsoft-Windows-OfflineFiles" ], "Id": [ 9 ], "Kind": "offline-files", "ServerIndex": 0 }, { "Log": "Microsoft-Windows-OfflineFiles/Operational", "Provider": [ "Microsoft-Windows-OfflineFiles" ], "Id": [ 10, 1005 ], "Kind": "offline-files-online", "ServerIndex": 0 }, { "Log": "Microsoft-Windows-OfflineFiles/Operational", "Provider": [ "Microsoft-Windows-OfflineFiles" ], "Id": [ 1004 ], "Kind": "offline-files-slow-link", "ServerIndex": 0 } ] } }, { "Name": "Network protocols", "Kind": "NetworkProtocol", "MinimumModuleVersion": "0.15", "Parameters": { "StartEvents": [ { "Log": "System", "Provider": [ "Microsoft-Windows-Kernel-Boot" ], "Id": [ 27 ], "Kind": "system-start" }, { "Log": "System", "Provider": [ "Microsoft-Windows-Kernel-Power" ], "Id": [ 107, 507 ], "Kind": "resume" }, { "Log": "System", "Provider": [ "Microsoft-Windows-Power-Troubleshooter" ], "Id": [ 1 ], "Kind": "resume" } ], "Topics": { "dns": { "WarnAbove": 50 }, "domain": { "WarnAbove": 10, "WarnKinds": [ "domain-trust-broken" ], "AwayKinds": [ "domain-no-controller", "domain-controller-silent" ], "StartKinds": [ "domain-no-controller", "domain-controller-silent", "domain-channel-failed" ], "QuietKinds": [ "domain-channel-retried", "domain-kerberos-fallback" ] }, "time": { "WarnAbove": 20, "WarnKinds": [ "time-too-far" ], "AwayKinds": [ "time-no-source", "time-source-silent", "time-unsynced" ] }, "dhcp": { "WarnAbove": 5, "WarnKinds": [ "dhcp-conflict", "dhcp-autoconfig" ] }, "dot1x": { "WarnAbove": 3 }, "tls": { "WarnAbove": 100 }, "internet": { "WarnAbove": 30 }, "vpn": { "WarnAbove": 5 } }, "Scans": [ { "Log": "System", "Provider": [ "Microsoft-Windows-DNS-Client" ], "Id": [ 1014 ], "Topic": "dns", "Kind": "dns-timeout", "SubjectIndex": 0 }, { "Log": "System", "Provider": [ "NETLOGON" ], "Id": [ 5719 ], "Topic": "domain", "Kind": "domain-channel-retried", "Match": { "1": [ "%%1359" ] } }, { "Log": "System", "Provider": [ "NETLOGON" ], "Id": [ 5719 ], "Topic": "domain", "Kind": "domain-no-controller", "CodeIndex": 1, "CodeType": "win32", "Except": { "1": [ "%%1359" ] } }, { "Log": "Microsoft-Windows-Security-Netlogon/Operational", "Provider": [ "Microsoft-Windows-Security-Netlogon" ], "Id": [ 9005 ], "Topic": "domain", "Kind": "domain-kerberos-fallback" }, { "Log": "Microsoft-Windows-Security-Netlogon/Operational", "Provider": [ "Microsoft-Windows-Security-Netlogon" ], "Id": [ 9006 ], "Topic": "domain", "Kind": "domain-channel-failed", "CodeIndex": 0, "CodeType": "ntstatus" }, { "Log": "System", "Provider": [ "NETLOGON" ], "Id": [ 3210 ], "Topic": "domain", "Kind": "domain-trust-broken", "SubjectIndex": 1 }, { "Log": "System", "Provider": [ "NETLOGON" ], "Id": [ 5783 ], "Topic": "domain", "Kind": "domain-controller-silent", "SubjectIndex": 0 }, { "Log": "System", "Provider": [ "Microsoft-Windows-Security-Kerberos" ], "Id": [ 4 ], "Topic": "domain", "Kind": "kerberos-ticket-refused", "SubjectIndex": 0 }, { "Log": "System", "Provider": [ "Microsoft-Windows-Security-Kerberos" ], "Id": [ 5 ], "Topic": "domain", "Kind": "kerberos-clock", "SubjectIndex": 0 }, { "Log": "System", "Provider": [ "LsaSrv" ], "Id": [ 40960 ], "Topic": "domain", "Kind": "auth-failed", "SubjectIndex": 0, "SubjectType": "spn", "CodeIndex": 2, "CodeType": "text" }, { "Log": "System", "Provider": [ "LsaSrv" ], "Id": [ 40961 ], "Topic": "domain", "Kind": "auth-no-protocol", "SubjectIndex": 0, "SubjectType": "spn" }, { "Log": "System", "Provider": [ "Microsoft-Windows-Time-Service" ], "Id": [ 24, 38, 47 ], "Topic": "time", "Kind": "time-source-silent", "SubjectIndex": 0, "SubjectType": "peer" }, { "Log": "System", "Provider": [ "Microsoft-Windows-Time-Service" ], "Id": [ 29, 129 ], "Topic": "time", "Kind": "time-no-source" }, { "Log": "System", "Provider": [ "Microsoft-Windows-Time-Service" ], "Id": [ 131, 134 ], "Topic": "time", "Kind": "time-no-source", "SubjectIndex": 2, "SubjectType": "peer" }, { "Log": "System", "Provider": [ "Microsoft-Windows-Time-Service" ], "Id": [ 36 ], "Topic": "time", "Kind": "time-unsynced" }, { "Log": "System", "Provider": [ "Microsoft-Windows-Time-Service" ], "Id": [ 50 ], "Topic": "time", "Kind": "time-jump" }, { "Log": "System", "Provider": [ "Microsoft-Windows-Time-Service" ], "Id": [ 34 ], "Topic": "time", "Kind": "time-too-far" }, { "Log": "Microsoft-Windows-Dhcp-Client/Admin", "Provider": [ "Microsoft-Windows-Dhcp-Client" ], "Id": [ 1000 ], "Topic": "dhcp", "Kind": "dhcp-lease-lost" }, { "Log": "Microsoft-Windows-Dhcp-Client/Admin", "Provider": [ "Microsoft-Windows-Dhcp-Client" ], "Id": [ 1001 ], "Topic": "dhcp", "Kind": "dhcp-no-address" }, { "Log": "Microsoft-Windows-Dhcp-Client/Admin", "Provider": [ "Microsoft-Windows-Dhcp-Client" ], "Id": [ 1002 ], "Topic": "dhcp", "Kind": "dhcp-refused" }, { "Log": "Microsoft-Windows-Dhcp-Client/Admin", "Provider": [ "Microsoft-Windows-Dhcp-Client" ], "Id": [ 1003 ], "Topic": "dhcp", "Kind": "dhcp-renew-failed" }, { "Log": "Microsoft-Windows-Dhcp-Client/Admin", "Provider": [ "Microsoft-Windows-Dhcp-Client" ], "Id": [ 1005 ], "Topic": "dhcp", "Kind": "dhcp-conflict" }, { "Log": "Microsoft-Windows-Dhcp-Client/Admin", "Provider": [ "Microsoft-Windows-Dhcp-Client" ], "Id": [ 1006, 1008 ], "Topic": "dhcp", "Kind": "dhcp-config-failed" }, { "Log": "Microsoft-Windows-Dhcp-Client/Admin", "Provider": [ "Microsoft-Windows-Dhcp-Client" ], "Id": [ 1007 ], "Topic": "dhcp", "Kind": "dhcp-autoconfig" }, { "Log": "System", "Provider": [ "Tcpip" ], "Id": [ 4198, 4199 ], "Topic": "dhcp", "Kind": "dhcp-conflict" }, { "Log": "Microsoft-Windows-Wired-AutoConfig/Operational", "Provider": [ "Microsoft-Windows-Wired-AutoConfig" ], "Id": [ 15514 ], "Topic": "dot1x", "Kind": "dot1x-auth-failed", "SubjectIndex": 1, "SubjectType": "text", "CodeIndex": 9, "CodeType": "text" }, { "Log": "System", "Provider": [ "Schannel" ], "Id": [ 36887 ], "Topic": "tls", "Kind": "tls-alert-received", "SubjectIndex": 1, "SubjectType": "file", "CodeIndex": 2, "CodeType": "tls-alert" }, { "Log": "System", "Provider": [ "Schannel" ], "Id": [ 36888 ], "Topic": "tls", "Kind": "tls-alert-sent", "SubjectIndex": 1, "SubjectType": "file", "CodeIndex": 2, "CodeType": "tls-alert" }, { "Log": "System", "Provider": [ "Schannel" ], "Id": [ 36871 ], "Topic": "tls", "Kind": "tls-no-credentials", "SubjectIndex": 1, "SubjectType": "file" }, { "Log": "System", "Provider": [ "Schannel" ], "Id": [ 36881 ], "Topic": "tls", "Kind": "tls-cert-expired", "SubjectIndex": 1, "SubjectType": "file" }, { "Log": "System", "Provider": [ "Schannel" ], "Id": [ 36882 ], "Topic": "tls", "Kind": "tls-cert-untrusted", "SubjectIndex": 1, "SubjectType": "file" }, { "Log": "System", "Provider": [ "Schannel" ], "Id": [ 36884 ], "Topic": "tls", "Kind": "tls-cert-name", "SubjectIndex": 1, "SubjectType": "file" }, { "Log": "Microsoft-Windows-NCSI/Operational", "Provider": [ "Microsoft-Windows-NCSI" ], "Id": [ 4042 ], "Topic": "internet", "Kind": "internet-lost", "Match": { "3": [ 0, 1 ], "5": [ 2 ] }, "Except": { "4": [ 14 ] }, "CodePattern": "ChangeReason: (\\w+)", "CodeType": "ncsi" }, { "Log": "Application", "Provider": [ "RasClient" ], "Id": [ 20227 ], "Topic": "vpn", "Kind": "vpn-connect-failed", "SubjectIndex": 2, "SubjectType": "text", "CodeIndex": 3, "CodeType": "ras" }, { "Log": "Application", "Provider": [ "RasClient" ], "Id": [ 20226 ], "Topic": "vpn", "Kind": "vpn-dropped", "SubjectIndex": 2, "SubjectType": "text", "CodeIndex": 3, "CodeType": "ras", "Except": { "3": [ 631 ] } } ] } }, { "Name": "Domain", "Kind": "Domain", "MinimumModuleVersion": "0.17" }, { "Name": "Remote Desktop connections", "Kind": "RemoteDesktop", "MinimumModuleVersion": "0.15", "Parameters": { "FailedWarnAbove": 3, "FailedTotalWarnAbove": 9, "DroppedWarnAbove": 9, "DroppedTotalWarnAbove": 19 } }, { "Name": "Web folders", "Kind": "WebFolder", "MinimumModuleVersion": "0.15" }, { "Name": "Recent changes", "Kind": "Change", "MinimumModuleVersion": "0.11", "Parameters": { "WindowDays": 30 } }, { "Name": "Stability", "Kind": "Stability", "Parameters": { "ChangeWindowDays": 3, "ChangeQuietDays": 14 } }, { "Name": ".NET versions", "Kind": "DotNet", "MinimumModuleVersion": "0.5", "Parameters": { "MinimumFrameworkRelease": 528040 } }, { "Name": "Security", "Kind": "Security" }, { "Name": "Windows Firewall", "Kind": "Firewall", "MinimumModuleVersion": "0.21" }, { "Name": "Updates", "Kind": "Updates" }, { "Name": "Startup", "Kind": "Startup" }, { "Name": "Printing", "Kind": "Printing", "MinimumModuleVersion": "0.2" }, { "Name": "Disk health", "Kind": "DiskHealth" }, { "Name": "Temperature", "Kind": "Temperature" }, { "Name": "Battery", "Kind": "Battery" }, { "Name": "Boot performance", "Kind": "BootPerformance" }, { "Name": "Group Policy", "Kind": "GroupPolicy", "MinimumModuleVersion": "0.2" }, { "Name": "Crash dumps", "Kind": "CrashDump" }, { "Name": "CPU stress test", "Kind": "Stress", "Parameters": { "DurationSeconds": 60 } }, { "Name": "Running programs of all accounts", "Kind": "ProgramElevated", "MinimumModuleVersion": "0.10" }, { "Name": "Network dependencies of all accounts", "Kind": "NetworkDependencyElevated", "MinimumModuleVersion": "0.14" }, { "Name": "Running programs", "Kind": "Program", "MinimumModuleVersion": "0.10", "Parameters": { "GuiObjectFailAbove": 8000, "HandleWarnAbove": 20000 } }, { "Name": "User sessions of all accounts", "Kind": "SessionElevated", "MinimumModuleVersion": "0.11" }, { "Name": "Sign-in", "Kind": "Logon", "MinimumModuleVersion": "0.16", "Parameters": { "DesktopWarnSeconds": 60, "AutostartWarnSeconds": 180 } }, { "Name": "User session", "Kind": "Session", "MinimumModuleVersion": "0.11", "Parameters": { "DisconnectedIdleWarnDays": 1, "DisconnectedMemoryWarnMB": 1024 } }, { "Name": "User profiles of all accounts", "Kind": "UserProfileElevated", "MinimumModuleVersion": "0.11", "Parameters": { "OtherMeasureSeconds": 180 } }, { "Name": "User profile", "Kind": "UserProfile", "MinimumModuleVersion": "0.11", "Parameters": { "RoamingWarnMB": 1024, "RoamingFailMB": 5120, "LoadWarnSeconds": 30, "MeasureSeconds": 20, "UnusedDays": 180 } }, { "Name": "User settings", "Kind": "UserSetting", "MinimumModuleVersion": "0.11" }, { "Name": "App: Outlook", "Kind": "App", "Parameters": { "App": "Outlook", "Process": "^outlook$", "Exe": "outlook.exe", "Match": "^Outlook$|^Outlook \\(classic\\)$" } }, { "Name": "App: Outlook mail files", "Kind": "OutlookData", "Parameters": { "App": "Outlook" } }, { "Name": "App: Outlook add-ins", "Kind": "OfficeAddins", "Parameters": { "App": "Outlook", "OfficeApp": "Outlook" } }, { "Name": "App: Outlook Exchange Online endpoints", "Kind": "HttpsEndpoint", "MinimumModuleVersion": "0.3", "Parameters": { "App": "Outlook", "Endpoints": [ { "Url": "https://outlook.office365.com/mapi/emsmdb/?MailboxId=probe@outlook.com", "Method": "POST", "BearerProbe": true, "ExpectStatus": [ 401 ], "ExpectChallenge": "Bearer" }, { "Url": "https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration", "Method": "GET", "ExpectStatus": [ 200 ] } ], "ExpectIssuerPattern": "\\bO=(Microsoft Corporation|DigiCert Inc)(,|$)", "CertificateWarnDays": 7, "CertificateFailDays": 0 } }, { "Name": "App: Outlook Autodiscover", "Kind": "Autodiscover", "MinimumModuleVersion": "0.3", "Parameters": { "App": "Outlook" } }, { "Name": "App: Outlook servers", "Kind": "Server", "Parameters": { "App": "Outlook", "MailboxServers": true, "Servers": [ "outlook.office365.com:443", "login.microsoftonline.com:443" ] } }, { "Name": "App: Outlook sign-in", "Kind": "OutlookAuth", "MinimumModuleVersion": "0.3", "Parameters": { "App": "Outlook" } }, { "Name": "App: Outlook (new)", "Kind": "App", "Parameters": { "App": "Outlook (new)", "Process": "^olk$", "Exe": "olk.exe", "Appx": "Microsoft.OutlookForWindows" } }, { "Name": "App: Word", "Kind": "App", "Parameters": { "App": "Word", "Process": "^winword$", "Exe": "winword.exe", "Match": "^Word$" } }, { "Name": "App: Word add-ins", "Kind": "OfficeAddins", "Parameters": { "App": "Word", "OfficeApp": "Word" } }, { "Name": "App: Excel", "Kind": "App", "Parameters": { "App": "Excel", "Process": "^excel$", "Exe": "excel.exe", "Match": "^Excel$" } }, { "Name": "App: Excel add-ins", "Kind": "OfficeAddins", "Parameters": { "App": "Excel", "OfficeApp": "Excel" } }, { "Name": "App: PowerPoint", "Kind": "App", "Parameters": { "App": "PowerPoint", "Process": "^powerpnt$", "Exe": "powerpnt.exe", "Match": "^PowerPoint$" } }, { "Name": "App: PowerPoint add-ins", "Kind": "OfficeAddins", "Parameters": { "App": "PowerPoint", "OfficeApp": "PowerPoint" } }, { "Name": "App: OneNote", "Kind": "App", "Parameters": { "App": "OneNote", "Process": "^onenote$|^onenotem$", "Exe": "OneNote.exe", "Appx": "Microsoft.Office.OneNote", "Match": "^OneNote" } }, { "Name": "App: OneNote add-ins", "Kind": "OfficeAddins", "Parameters": { "App": "OneNote", "OfficeApp": "OneNote" } }, { "Name": "App: Access", "Kind": "App", "Parameters": { "App": "Access", "Process": "^msaccess$", "Exe": "MSACCESS.EXE", "Match": "^Access$" } }, { "Name": "App: Access add-ins", "Kind": "OfficeAddins", "Parameters": { "App": "Access", "OfficeApp": "Access" } }, { "Name": "App: Access database sources", "Kind": "Odbc", "Parameters": { "App": "Access" } }, { "Name": "App: Teams", "Kind": "App", "Parameters": { "App": "Teams", "Process": "^ms-teams$|^teams$", "Exe": "ms-teams.exe", "Appx": "MSTeams", "Match": "^Microsoft Teams" } }, { "Name": "App: Teams servers", "Kind": "Server", "Parameters": { "App": "Teams", "Servers": [ "teams.microsoft.com:443" ] } }, { "Name": "App: Teams cache", "Kind": "FolderSize", "Parameters": { "App": "Teams", "Path": "%LOCALAPPDATA%\\Packages\\MSTeams_8wekyb3d8bbwe\\LocalCache" } }, { "Name": "App: Teams legacy cache", "Kind": "FolderSize", "Parameters": { "App": "Teams", "Path": "%APPDATA%\\Microsoft\\Teams" } }, { "Name": "App: Zoom", "Kind": "App", "Parameters": { "App": "Zoom", "Process": "^Zoom$|^CptHost$", "Match": "^Zoom" } }, { "Name": "App: Zoom servers", "Kind": "Server", "Parameters": { "App": "Zoom", "Servers": [ "zoom.us:443" ] } }, { "Name": "App: Edge", "Kind": "App", "Parameters": { "App": "Edge", "Process": "^msedge$", "Exe": "msedge.exe", "Match": "^Microsoft Edge$" } }, { "Name": "App: Edge profile", "Kind": "FolderSize", "Parameters": { "App": "Edge", "Path": "%LOCALAPPDATA%\\Microsoft\\Edge\\User Data", "FolderSizeWarnAboveGB": 5 } }, { "Name": "App: Chrome", "Kind": "App", "Parameters": { "App": "Chrome", "Process": "^chrome$", "Exe": "chrome.exe", "Match": "^Google Chrome$" } }, { "Name": "App: Chrome profile", "Kind": "FolderSize", "Parameters": { "App": "Chrome", "Path": "%LOCALAPPDATA%\\Google\\Chrome\\User Data", "FolderSizeWarnAboveGB": 5 } }, { "Name": "App: Firefox", "Kind": "App", "Parameters": { "App": "Firefox", "Process": "^firefox$", "Exe": "firefox.exe", "Match": "^Mozilla Firefox|^Firefox$" } }, { "Name": "App: Firefox profile", "Kind": "FolderSize", "Parameters": { "App": "Firefox", "Path": "%LOCALAPPDATA%\\Mozilla\\Firefox\\Profiles", "FolderSizeWarnAboveGB": 2 } }, { "Name": "App: Thunderbird", "Kind": "App", "Parameters": { "App": "Thunderbird", "Process": "^thunderbird$", "Exe": "thunderbird.exe", "Match": "^Mozilla Thunderbird|^Thunderbird$" } }, { "Name": "App: Thunderbird mail store", "Kind": "FolderSize", "Parameters": { "App": "Thunderbird", "Path": "%APPDATA%\\Thunderbird\\Profiles", "FolderSizeWarnAboveGB": 20, "FolderSizeFailAboveGB": 45 } }, { "Name": "App: Bitwarden", "Kind": "App", "MinimumModuleVersion": "0.22", "Parameters": { "App": "Bitwarden", "Process": "^Bitwarden$", "Exe": "Bitwarden.exe", "Match": "^Bitwarden$" } }, { "Name": "App: Bitwarden application log", "Kind": "AppLog", "MinimumModuleVersion": "0.22", "Parameters": { "App": "Bitwarden", "Path": "%APPDATA%\\Bitwarden\\app.log", "LinePattern": "^\\[(?<time>\\d{4}-\\d\\d-\\d\\d \\d\\d:\\d\\d:\\d\\d\\.\\d+)\\] \\[(?<level>\\w+)\\]\\s+(?:\\[(?<source>[^\\]]+)\\]:?\\s*)?(?<message>.*)$", "ErrorLevels": [ "ERROR" ], "FileDatePattern": "^$", "ErrorWarnAbove": 100 } }, { "Name": "App: Bitwarden browser extension", "Kind": "BrowserExtension", "MinimumModuleVersion": "0.22", "Parameters": { "App": "Bitwarden", "Title": "Bitwarden", "Ids": { "Chrome": "nngceckbapebfimnlniiiahkandclblb", "Edge": "jbkfoedolllekgbhcbcoahefnbanhhlh", "Firefox": "{446900e4-71c2-419f-a6a7-df9c091e268b}" }, "NativeHost": "com.8bit.bitwarden" } }, { "Name": "App: Nextcloud", "Kind": "App", "MinimumModuleVersion": "0.22", "Parameters": { "App": "Nextcloud", "Process": "^nextcloud$", "Exe": "nextcloud.exe", "Match": "^Nextcloud$" } }, { "Name": "App: Nextcloud sync", "Kind": "Nextcloud", "MinimumModuleVersion": "0.22", "Parameters": { "App": "Nextcloud" } }, { "Name": "App: OneDrive", "Kind": "App", "Parameters": { "App": "OneDrive", "Process": "^OneDrive$", "Match": "^(Microsoft )?OneDrive$" } }, { "Name": "App: OneDrive sync", "Kind": "OneDrive", "MinimumModuleVersion": "0.22", "Parameters": { "App": "OneDrive" } }, { "Name": "App: OneDrive client folder", "Kind": "FolderSize", "Parameters": { "App": "OneDrive", "Path": "%LOCALAPPDATA%\\Microsoft\\OneDrive", "FolderSizeWarnAboveGB": 6 } }, { "Name": "App: Acrobat", "Kind": "App", "Parameters": { "App": "Acrobat", "Process": "^Acrobat$|^AcroRd32$|^AcroCEF$|^RdrCEF$", "Exe": "Acrobat.exe", "Appx": "AdobeAcrobatReaderCoreApp", "Match": "^Adobe Acrobat" } }, { "Name": "App: PDF24", "Kind": "App", "Parameters": { "App": "PDF24", "Process": "^pdf24", "Exe": "pdf24-Creator.exe", "Match": "^PDF24" } }, { "Name": "App: 7-Zip", "Kind": "App", "Parameters": { "App": "7-Zip", "Process": "^7zFM$|^7zG$", "Exe": "7zFM.exe", "Match": "^7-Zip" } }, { "Name": "App: TeamViewer", "Kind": "App", "Parameters": { "App": "TeamViewer", "Process": "^TeamViewer$|^TeamViewer_Service$|^tv_w32$|^tv_x64$", "Match": "^TeamViewer" } }, { "Name": "App: TeamViewer servers", "Kind": "Server", "Parameters": { "App": "TeamViewer", "Servers": [ "teamviewer.com:443" ] } }, { "Name": "App: AnyDesk", "Kind": "App", "Parameters": { "App": "AnyDesk", "Process": "^AnyDesk$", "Match": "^AnyDesk" } }, { "Name": "App: AnyDesk servers", "Kind": "Server", "Parameters": { "App": "AnyDesk", "Servers": [ "boot.net.anydesk.com:443" ] } }, { "Name": "App: DATEV", "Kind": "App", "Parameters": { "App": "DATEV", "Process": "^DATEV", "Match": "^DATEV" } }, { "Name": "App: DATEV servers", "Kind": "Server", "Parameters": { "App": "DATEV", "Servers": [ "datev.de:443" ] } }, { "Name": "App: DATEV services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "DATEV", "Services": [ "^DATEV", "^MSSQL\\$DATEV" ] } }, { "Name": "App: SAP", "Kind": "App", "Parameters": { "App": "SAP", "Process": "^saplogon$|^saplgpad$|^sapgui$", "Exe": "saplogon.exe", "Match": "^SAP GUI|^SAP Logon" } }, { "Name": "App: Lexware", "Kind": "App", "Parameters": { "App": "Lexware", "Match": "^Lexware" } }, { "Name": "App: Lexware services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "Lexware", "Services": [ "Lexware" ] } }, { "Name": "App: Sage", "Kind": "App", "Parameters": { "App": "Sage", "Match": "^Sage " } }, { "Name": "App: Sage services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "Sage", "Services": [ "^Sage", "^MSSQL\\$SAGE" ] } }, { "Name": "App: Citrix Workspace", "Kind": "App", "Parameters": { "App": "Citrix Workspace", "Process": "^wfica32$|^SelfService$|^Receiver$|^concentr$", "Match": "^Citrix Workspace" } }, { "Name": "App: FortiClient", "Kind": "App", "Parameters": { "App": "FortiClient", "Process": "^FortiClient$|^FortiTray$", "Match": "^FortiClient" } }, { "Name": "App: FortiClient services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "FortiClient", "Services": [ "^Forti" ] } }, { "Name": "App: GlobalProtect", "Kind": "App", "Parameters": { "App": "GlobalProtect", "Process": "^PanGPA$", "Match": "^GlobalProtect" } }, { "Name": "App: GlobalProtect services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "GlobalProtect", "Services": [ "^PanGPS$" ] } }, { "Name": "App: Securepoint VPN", "Kind": "App", "Parameters": { "App": "Securepoint VPN", "Process": "^SSLVpnClient$|^Securepoint VPN Client$", "Match": "^Securepoint (SSL VPN|VPN Client)$" } }, { "Name": "App: Securepoint VPN services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "Securepoint VPN", "Services": [ "^Securepoint VPN" ] } }, { "Name": "App: Securepoint VPN service log", "Kind": "AppLog", "MinimumModuleVersion": "0.22", "Parameters": { "App": "Securepoint VPN", "Path": "%ProgramFiles%\\Securepoint VPN Client\\Logs\\SpVpnServiceLogs.db", "Table": "Logs", "TimeColumn": "Date", "LevelColumn": "Severity", "MessageColumn": "Message", "SourceColumn": "", "LevelNames": { "0": "INFO", "1": "WARN", "2": "ERROR" }, "ErrorWarnAbove": 100 } }, { "Name": "App: SwyxIt! trace log", "Kind": "AppLog", "MinimumModuleVersion": "0.22", "Parameters": { "App": "SwyxIt!", "Path": "%LOCALAPPDATA%\\Swyx\\SwyxIt!\\Traces\\*.log", "LinePattern": "^(?<time>\\d\\d \\d\\d:\\d\\d:\\d\\d\\.\\d{3})\\s+(?:[0-9A-Fa-f]{6,10}\\s+)?(?:\\d+\\s+)?(?<level>\\*?[A-Za-z]{3,5})\\s+(?<source>\\S+)\\s+(?<message>.*)$", "ErrorLevels": [ "*ERR" ], "FileDatePattern": "^$", "ErrorWarnAbove": 200, "IgnoreMessagePattern": "^\\(\\d+\\)\\s+(-{5,}|Stacktrace|bei |at |in |---)" } }, { "Name": "App: SwyxIt! Outlook access", "Kind": "Companion", "MinimumModuleVersion": "0.22", "Parameters": { "App": "SwyxIt!", "Process": "^IpPbxOutlookAccess$", "Title": "SwyxIt! Outlook-Zugriff (IpPbxOutlookAccess.exe)", "Host": "^outlook$", "HostTitle": "Outlook", "HostEvents": [ { "Provider": "Microsoft-Windows-RestartManager", "Id": [ 10002 ], "Match": "Outlook", "Means": "stopped" }, { "Provider": "Outlook", "Id": [ 45 ], "Means": "started" } ] } }, { "Name": "App: SwyxIt!", "Kind": "App", "Parameters": { "App": "SwyxIt!", "Process": "^SwyxIt!$|^SwyxIt!\\.UI$|^CLMgr$|^IMClient$|^SwyxMessenger$", "Match": "^SwyxIt!" } }, { "Name": "App: estos ProCall", "Kind": "App", "Parameters": { "App": "estos ProCall", "Match": "^estos ProCall|^ProCall" } }, { "Name": "App: STARFACE", "Kind": "App", "Parameters": { "App": "STARFACE", "Match": "^STARFACE" } }, { "Name": "App: Securepoint Antivirus", "Kind": "App", "Parameters": { "App": "Securepoint Antivirus", "Process": "^guardxservice(_x64)?$|^guardxkickoff(_x64)?$|^guardxup$|^virusutilities$", "Match": "^Securepoint Anti-?Virus" } }, { "Name": "App: Securepoint Antivirus services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "Securepoint Antivirus", "Services": [ "^GuardX" ] } }, { "Name": "App: Securepoint Antivirus updates", "Kind": "Server", "Parameters": { "App": "Securepoint Antivirus", "Servers": [ "updates.ikarus.at:443", "mirrorcdn.mailsecurity.at:443" ] } }, { "Name": "App: ESET", "Kind": "App", "Parameters": { "App": "ESET", "Process": "^egui$|^ekrn$", "Match": "^ESET" } }, { "Name": "App: ESET services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "ESET", "Services": [ "^ekrn$", "^ESET" ] } }, { "Name": "App: G DATA", "Kind": "App", "Parameters": { "App": "G DATA", "Match": "^G ?DATA" } }, { "Name": "App: G DATA services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "G DATA", "Services": [ "^G ?DATA" ] } }, { "Name": "App: Sophos", "Kind": "App", "Parameters": { "App": "Sophos", "Match": "^Sophos" } }, { "Name": "App: Sophos services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "Sophos", "Services": [ "^Sophos" ] } }, { "Name": "App: Server-Eye", "Kind": "App", "Parameters": { "App": "Server-Eye", "Process": "^ClientAgentContainerService$|^MasterAgentContainerService$|^EmergencyRecoveryService$", "Match": "^Server-Eye" } }, { "Name": "App: Server-Eye services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "Server-Eye", "Services": [ "^Server-Eye Sensorhub$", "^Server-Eye Emergency Recovery$" ], "OptionalServices": [ "^Server-Eye OCC Connector$" ] } }, { "Name": "App: Server-Eye servers", "Kind": "Server", "Parameters": { "App": "Server-Eye", "Servers": [ "occ.server-eye.de:443", "update.server-eye.de:443" ] } }, { "Name": "App: Server-Eye file depot", "Kind": "FolderSize", "Parameters": { "App": "Server-Eye", "Path": "%ProgramData%\\ServerEye3\\filedepot", "FolderSizeWarnAboveGB": 20 } }, { "Name": "App: Server-Eye patch downloads", "Kind": "FolderSize", "Parameters": { "App": "Server-Eye", "Path": "%ProgramData%\\ServerEye3\\patchdownload", "FolderSizeWarnAboveGB": 20 } }, { "Name": "App: c-entron", "Kind": "App", "Parameters": { "App": "c-entron", "Process": "^c-entron 2\\.0$", "Match": "^c-entron" } }, { "Name": "App: c-entron log", "Kind": "FolderSize", "Parameters": { "App": "c-entron", "Path": "%ProgramData%\\c-entron software gmbh\\c-entron.NET\\Logs" } }, { "Name": "App: c-entron connections", "Kind": "AppConnection", "MinimumModuleVersion": "0.7", "Parameters": { "App": "c-entron", "Sources": [ { "Path": "%APPDATA%\\c-entron software gmbh\\c-entron\\CentronConnections.xml", "Item": "//ConnectionFileItem", "Name": "Caption", "Server": "Server", "Database": "Database", "Url": "WebServiceAddress", "Default": "IsDefault" } ] } }, { "Name": "App: c-entron application log", "Kind": "AppLog", "MinimumModuleVersion": "0.7", "Parameters": { "App": "c-entron", "Path": "%ProgramData%\\c-entron software gmbh\\c-entron.NET\\Logs\\Log*.csv", "IgnoreMessagePattern": "^\\s*Not an error\\b" } }, { "Name": "App: c-entron runtime", "Kind": "AppRuntime", "MinimumModuleVersion": "0.7", "Parameters": { "App": "c-entron", "Path": "%ProgramFiles(x86)%\\c-entron software gmbh\\c-entron 2.0\\*.runtimeconfig.json" } }, { "Name": "App: pcvisit", "Kind": "App", "Parameters": { "App": "pcvisit", "Process": "^pcvisit_service_client$|^pcvisit_client$|^pcvisitSupportJournal$", "Match": "^pcvisit" } }, { "Name": "App: pcvisit services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "pcvisit", "Services": [ "^Pcvisit Caloa Agent Service" ] } }, { "Name": "App: pcvisit servers", "Kind": "Server", "Parameters": { "App": "pcvisit", "Servers": [ "lb3.pcvisit.de:443" ] } }, { "Name": "App: StarMoney", "Kind": "App", "Parameters": { "App": "StarMoney", "Process": "^StarMoney$|^StarMoneyOnlineUpdate$", "Match": "^StarMoney" } }, { "Name": "App: StarMoney services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "StarMoney", "OptionalServices": [ "^StarMoney" ] } }, { "Name": "App: StarMoney servers", "Kind": "Server", "Parameters": { "App": "StarMoney", "Servers": [ "services.starfinanz.de:443" ] } }, { "Name": "App: SFirm", "Kind": "App", "Parameters": { "App": "SFirm", "Process": "^sfirm$|^sfautomat$|^sfonlineupdate$|^sfhbcigateway$|^sfInfocenter$|^SFEbicsWorker$", "Match": "^SFirm" } }, { "Name": "App: SFirm services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "SFirm", "Services": [ "^MSSQL\\$SFIRMV4SQL$|^MSSQL\\$SFirm4SQL$" ], "OptionalServices": [ "^SFirmV4SQLServerBackingService$" ] } }, { "Name": "App: SFirm servers", "Kind": "Server", "Parameters": { "App": "SFirm", "Servers": [ "download.sfirm.de:443", "services.starfinanz.de:443" ] } }, { "Name": "App: ADDISON", "Kind": "App", "Parameters": { "App": "ADDISON", "Process": "^ADDISON$|^10itAkte$", "Match": "^ADDISON" } }, { "Name": "App: ADDISON services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "ADDISON", "Services": [ "^ADDISON", "^FastObjects" ] } }, { "Name": "App: DocuWare", "Kind": "App", "Parameters": { "App": "DocuWare", "Process": "^DocuWare\\.Desktop$|^DocuWare\\.DesktopService$", "Match": "^DocuWare" } }, { "Name": "App: DocuWare services", "Kind": "Service", "MinimumModuleVersion": "0.2", "Parameters": { "App": "DocuWare", "Services": [ "^DocuWare Desktop Service$" ] } }, { "Name": "App: ELO Java Client", "Kind": "App", "Parameters": { "App": "ELO Java Client", "Process": "^ELOJavaClientW?$|^ELOclient$", "Match": "^ELO Java Client" } }, { "Name": "App: ELOoffice", "Kind": "App", "Parameters": { "App": "ELOoffice", "Process": "^Elo32$", "Match": "^ELOoffice" } } ] } |