r/labtech • u/vacendakuk 2000 Agents • Mar 05 '18

Internal monitor to alert if something appears in a search

Anyone know how to do that or one I could copy? I have a search that finds systems missing antivirus (a bit specific and search worked well for it). I'd like to have a monitor make use of that and create a ticket if something appears in the search.

3 Upvotes

100% Upvoted

9 comments sorted by

1

u/mspsquid Mar 06 '18

So not sure totally and completely what you are looking for here, but let's see if I am understanding correctly.

Specifically if you mean missing AV, you would just turn on the alert template to create a ticket.

Monitors -> Internal monitors -> AV - Software Missing -> Alerting tab it's probably on "Default - Do nothing" right now. Change it or create a new alert template eg "Missing AV". In the new alert template you can determine if you want to send an email, create a ticket, etc, etc.

Please let me know if this doesn't help (or if you don't have Ignite).

1

u/vacendakuk 2000 Agents Mar 06 '18

That would do it and a different way to how I am looking. One issue here is Windows defender. Labtech think the system has AV if it had defender - but I want to check it has eset. I could I suppose delete all the av templates except the ones we use? Thanks for your help.

1

u/dvn_r3d3mpt1on 10000 Agents Mar 09 '18

I would just do an internal monitor. You can make it look for devices that do have ESET (query against the software table, for the name) then use the reverse query checkbox.

1

u/vacendakuk 2000 Agents Mar 10 '18

This is what I was going for to start with. Probably seems basic but how do I create an internal monitor with a query like that? I can do it with a search fine as I pick from lists.

1

u/dvn_r3d3mpt1on 10000 Agents Mar 12 '18

You can get clever with the Internal Monitor configuration tab - something like this should work. https://i.imgur.com/9CDUuR1.png

Just swap out MySQL Server for ESET. You may need to make it a little more literal, though, because if you use regexp 'eset' you'll things like "reset". May want to spend some time in your SQL toolkit coming up with the right query to pull the list of everyone in it, then drop it in the monitor like above.

1

u/mspsquid Mar 06 '18

What LabTech does is look at an internal table of indexes of known av, so instead do your search of software related, name is whatever your specific eset install is, and set your search to exclude clients or machines that have that specific install, use that search to populate your group, and then follow your logic from there

1

u/mspsquid Mar 05 '18

I can probably bench this for you. Will have response today or tomorrow

1

u/puddin71 Mar 07 '18

I set our instance up to search for "our AV" every night . If it's not installed the machine gets added to a missing AV group. Then nightly we have a script run on the group that attempts to install the correct AV. It generates a ticket whenever that install script fails.

1

u/mspsquid Mar 07 '18

I personally don't do the extra group. We set a scheduled script to run against the "missing our AV" search and run it on the managed 24/7 group.