Project VCM Agent Context - SS67/project-docs GitHub Wiki

1 collect evidence playbooks/collect_evidence.yml
2 main roles/compliance_evidence/tasks/main.yml
3 main roles/compliance_evaluate/tasks/main.yml
4 defender windows roles/compliance_evidence/tasks/defender_windows.yml
5 defender linux roles/compliance_evidence/tasks/defender_linux.yml
6 rapid7 windows roles/compliance_evidence/tasks/rapid7_windows.yml
7 rapid7 linux roles/compliance_evidence/tasks/rapid7_linux.yml
8 sccm roles/compliance_evidence/tasks/sccm.yml
9 wsus roles/compliance_evidence/tasks/wsus.yml
10 aap roles/compliance_evidence/tasks/aap.yml
11 main roles/compliance_evidence/vars/main.yml
12 main roles/compliance_evidence/defaults/main.yml

---

1. Rapid7 Insight Agent, Linux.

- name: Rapid7 linux probe
ansible.builtin.shell: |
set +e
INSTALLED=false
RUNNING=false
AGE=-1
[ -x {{ ce_linux.rapid7_binary }} ] && INSTALLED=true
systemctl is-active —quiet {{ ce_linux.rapid7_service }} && RUNNING=true

LOG=$(ls -t /opt/rapid7/ir_agent/components/insight_agent/common/*.log 2>/dev/null | head -1) if [ -n “$LOG” ]; then MT=$(stat -c %Y “$LOG” 2>/dev/null) if [ -n “$MT” ]; then NOW=$(date -u +%s) AGE=$(echo “scale=2; ($NOW – $MT) / 3600” | bc) fi fi echo “${INSTALLED} ${RUNNING} ${AGE}” args: executable: /bin/bash register: ce_rapid7_lnx changed_when: false failed_when: false

- name: Record rapid7 result
ansible.builtin.set_fact:
ce_result_rapid7:
installed: “{{ (ce_rapid7_lnx.stdout | trim).split(’ ’)⁰ | bool }}”
service_running: “{{ (ce_rapid7_lnx.stdout | trim).split(’ ’)¹ | bool }}”
last_checkin_hours: >-
{{ none if ((ce_rapid7_lnx.stdout | trim).split(’ ‘)² | float) < 0
else ((ce_rapid7_lnx.stdout | trim).split(’ ‘)² | float) }}
probe_error: "{{ ce_rapid7_lnx.stdout | default(’’) | trim | length == 0 }}"

---

---

1. SCCM client. Windows, domain joined only.
2. Registration is the real test. A client can be installed, running and
3. assigned to a site while never having registered with the MP.
4. LastMPServerName plus a recent policy request is the health signal.

- name: SCCM probe
ansible.windows.win_shell: |
$ErrorActionPreference = ‘SilentlyContinue’
$out = [ordered]@{
installed = $false
service_running = $false
registered = $false
site_code = $null
mp_server = $null
client_version = $null
last_checkin_hours = $null
}

$svc = Get-Service -Name ‘{{ ce_windows.sccm_service }}’ if ($svc) { $out.installed = $true $out.service_running = ($svc.Status -eq ‘Running’) } $sms = Get-CimInstance -Namespace ‘root\ccm’ -ClassName ‘SMS_Client’ if ($sms) { $out.installed = $true $out.client_version = $sms.ClientVersion } $reg = Get-CimInstance -Namespace ‘root\ccm’ -ClassName ‘CCM_ClientIdentificationInformation’ if ($reg) { $out.registered = [bool]$reg.ClientId } $sc = (New-Object -ComObject ‘Microsoft.SMS.Client’).GetAssignedSite() if ($sc) { $out.site_code = $sc } $mp = Get-ItemProperty -Path ‘HKLM:\SOFTWARE\Microsoft\CCM’ -Name ‘LastMPServerName’ if ($mp) { $out.mp_server = $mp.LastMPServerName }

1. Most recent successful policy request from the policy agent log.
   $pl = ‘C:\Windows\CCM\Logs\PolicyAgent.log’
   if (Test-Path $pl) {
   $out.last_checkin_hours = [math]::Round(
   ((Get-Date).ToUniversalTime() – (Get-Item $pl).LastWriteTimeUtc).TotalHours, 2)
   }

$out | ConvertTo-Json -Compress register: ce_sccm changed_when: false failed_when: false

- name: Record sccm result
ansible.builtin.set_fact:
ce_result_sccm: >-
{{ (ce_sccm.stdout | trim | from_json)
if (ce_sccm.stdout | default(‘’) | trim | length > 0)
else { ’installed’: none, ‘service_running’: none,
‘last_checkin_hours’: none, ‘probe_error’: true } }}

---

---

1. WSUS. Windows, standalone only.
2. There is no agent here, so the contract keys map differently.
3. installed means the policy points at a WSUS server.
4. service_running means the Windows Update service is up.
5. last_checkin_hours comes from the last detection time.

- name: WSUS probe
ansible.windows.win_shell: |
$ErrorActionPreference = ‘SilentlyContinue’
$out = [ordered]@{
installed = $false
configured = $false
service_running = $false
server = $null
use_wsus_server = $null
last_checkin_hours = $null
}

$key = ‘{{ ce_windows.wsus_key }}’ if (Test-Path $key) { $p = Get-ItemProperty -Path $key if ($p.WUServer) { $out.server = $p.WUServer $out.configured = $true $out.installed = $true } } if (Test-Path “$key\AU”) { $au = Get-ItemProperty -Path “$key\AU” $out.use_wsus_server = ($au.UseWUServer -eq 1) } $svc = Get-Service -Name ‘wuauserv’ if ($svc) { $out.service_running = ($svc.Status -eq ‘Running’) } $lt = (New-Object -ComObject ‘Microsoft.Update.AutoUpdate’).Results.LastSearchSuccessDate if ($lt) { $out.last_checkin_hours = [math]::Round( ((Get-Date).ToUniversalTime() – $lt.ToUniversalTime()).TotalHours, 2) } $out | ConvertTo-Json -Compress register: ce_wsus changed_when: false failed_when: false

- name: Record wsus result
ansible.builtin.set_fact:
ce_result_wsus: >-
{{ (ce_wsus.stdout | trim | from_json)
if (ce_wsus.stdout | default(‘’) | trim | length > 0)
else { ’installed’: none, ‘service_running’: none,
‘last_checkin_hours’: none, ‘probe_error’: true } }}

---

---

1. AAP onboarding.
2. Circular validation guard: inventory presence alone proves nothing,
3. the vSphere dynamic source adds every VM whether managed or not.
4. Reachability is the part that actually means something, and we have
5. already proven it by getting this far in the play.

- name: Record aap result
ansible.builtin.set_fact:
ce_result_aap:
installed: true
in_inventory: true
service_running: true
reachable: true
inventory_source: “{{ vmc_inventory_source | default(‘vsphere_dynamic’) }}”
connection_plugin: “{{ ansible_connection | default(‘unknown’) }}”
last_checkin_hours: 0
inventory_sync_age_hours: “{{ vmc_inventory_sync_age_hours | default(none) }}”

---

---

1. Service and path constants. Change here, not in task files.

ce_windows:
defender_service: Sense
defender_av_service: WinDefend
defender_status_key: ‘HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status’
rapid7_service: ir_agent
rapid7_path: ‘C:\Program Files\Rapid7\Insight Agent’
sccm_service: CcmExec
wsus_key: ‘HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate’

ce_linux:
defender_binary: /usr/bin/mdatp
defender_service: mdatp
rapid7_binary: /opt/rapid7/ir_agent/ir_agent
rapid7_service: ir_agent

---

---

1. Compliance thresholds
   ce_checkin_threshold_hours: 24

1. Control enablement. Flip to false to skip a control entirely.
   ce_controls_enabled:
   defender: true
   rapid7: true
   sccm: true
   wsus: true
   aap: true

1. Domain state drives SCCM vs WSUS applicability.
2. Set by the calling playbook. Default assumes standalone so we never
3. assert SCCM compliance on a host we have not confirmed as joined.
   ce_domain_joined: false

1. Where the assembled evidence lands on the controller when
2. ce_write_artifact is true. Report only mode uses this.
   ce_write_artifact: false
   ce_artifact_dir: /var/lib/awx/vmc_reports

Read AGENT.md, HANDOFF.md, FSSANDBOX.md, TRACKER.md from project files
end to end before responding. Then do exactly three things in one reply.

Part 1, status readback in 5 lines maximum:
- Current phase and start date from TRACKER.md
- Top 3 items from HANDOFF.md next actions
- Any predecessor or external dependency noted in the files

Part 2, knowledge check. Answer from the files only. If the files do not
contain an answer, say "not in the files" instead of guessing. A wrong
guess ends the session.
1. Who owns lifecycle for laptops and desktops, and what is Intune's role?
2. Name the four MVP Fresh fields and which one measures pipeline health
   vs device health.
3. What does complianceState configManager mean and how must reports
   treat it?
4. Why was the Freshservice Intune marketplace plugin rejected? Two
   reasons minimum.
5. What is the Entra Secret ID vs Value trap?
6. What is the sandbox rate limit and what is the prod rate limit?
7. What happens to a corporate Intune device with no Fresh match?
8. What must be true before anything writes to prod Freshservice?
9. What is tracker item W1.1 and why does it run first?
10. What did the Used By activity log check conclude?

Part 3, only after I confirm the checks pass: I will name one tracker
item. Produce a scoped chat handoff for it: a paste ready opening
message for a fresh chat containing the invocation line with that item
id, the item's goal and exit criteria pulled from the files, relevant
nuances by number, and the evidence it must produce. Nothing outside
that item's scope.

Drain paused since early August. Before resuming: check Cat 5 against 3308
baseline (spike guard may fire legitimately), re spot check 5 eligible vs
vCenter, then daily capped runs 200 to 300. Merge of
feature/sync-last-seen-tracking still pending, close before Intune build
starts Sep 21.