0

I’ve got a monitor that looks for rogue KMS servers using PowerShell to run ‘nslookup -type=all _vlmcs._tcp’

The monitor is working as expected, but I’d like to show the results of the nslookup cmd within the Alert description. Is that possible?

I’ve tried putting entries like $Data/Context/Property[@Name=’Error’]$ within the alert description, where ‘error’ is the PropertyBag that references the nslookup in the PS script, but it just returns a numerical value for each entry that I add.

Get-KMS.PS1 script:

Alert description entries I’ve tried:

$Data/Context/DataItem/Property[@Name=’Error’]$
$Data/Context/DataItem/Property[@Name=’State’]$
$Data/Context/DataItem/Property[@Name=’Count’]$
$Data/Property[@Name=’Error’]$
$Data/Property[@Name=’State’]$

jannep commented
    • I use this and it works in my setup: In the script: $PropertyBag.AddValue("MessageText",$errorhash) In alert description: $Data/Context/DataItem/Property[@Name='Messagetext']$