Generate report if dynamic collection membership changes

0

Hi there,

I have a dynamic collection that is only populated by machines exhibiting the symptoms of being affected by the TLP:AMBER virus, and I have set the collection to generate a report at 3pm every day. It would be much better if the report could be triggered by membership of the collection changing so we'd know when a new infection had been found, or had been resolved. Is there any way to do this? Would using the Heartbeat trigger be better?

Thanks

Cancel
login to comment
0

Hey Martin! Currently it is not possible to generate a report on membership change as you've described. There is probably a clunky way to do this with a schedule in PDQ Deploy and the post deployment notifications. To do that, you would make a schedule to target that TLP:AMBER collection you've made, and set the schedule trigger to a very aggressive trigger. I would say every hour might be good? Then attach a small package to the schedule. A CMD step running Dir is a great one for this. Then just make sure this schedule has Post-Deployment Notifications enabled and you could get a report everytime a computer get's deployed your canary package.

Hopefully that made sense!

Cancel
login to comment

Reply