Important Notice: On February 29th, this community was put into read-only mode. All existing posts will remain but customers are unable to add new posts or comment on existing. Please feel to join our Community Discord for any questions and discussions.

Generate report if dynamic collection membership changes

Martin Kirkley

June 18, 2018 21:53

Hi there,

I have a dynamic collection that is only populated by machines exhibiting the symptoms of being affected by the TLP:AMBER virus, and I have set the collection to generate a report at 3pm every day. It would be much better if the report could be triggered by membership of the collection changing so we'd know when a new infection had been found, or had been resolved. Is there any way to do this? Would using the Heartbeat trigger be better?

Thanks

Comments

1 comment

Chris James
June 21, 2018 12:56

Hey Martin! Currently it is not possible to generate a report on membership change as you've described. There is probably a clunky way to do this with a schedule in PDQ Deploy and the post deployment notifications. To do that, you would make a schedule to target that TLP:AMBER collection you've made, and set the schedule trigger to a very aggressive trigger. I would say every hour might be good? Then attach a small package to the schedule. A CMD step running Dir is a great one for this. Then just make sure this schedule has Post-Deployment Notifications enabled and you could get a report everytime a computer get's deployed your canary package.

Hopefully that made sense!

0