AvantGuard - NinjaOne icon

AvantGuard - NinjaOne

AvantGuard - NinjaOne

Actions159

Overview

This node operation allows users to create a Windows Event Policy Condition within a management system. It is designed to define specific conditions based on Windows event logs that trigger policies for monitoring or alerting purposes. This can be useful in IT security and operations scenarios where automated responses or notifications are needed when certain Windows events occur.

For example, an administrator might use this node to create a condition that triggers when a particular event source generates specific event IDs, enabling automated incident response or logging.

Properties

Name Meaning
Policy Id Numeric identifier of the policy to which the condition will be added (required).
Source The event source name from Windows event logs (required).
Event Ids JSON array of event IDs to match against (required).
Additional Body Fields Optional fields to further customize the policy condition:
- Enabled Boolean flag to enable or disable the policy condition.
- Display Name A string to set a display name for the policy condition.
- Severity Severity level of the condition; options: NONE, MINOR, MODERATE, MAJOR, CRITICAL.
- Priority Priority level of the condition; options: NONE, LOW, MEDIUM, HIGH.
- Channels JSON array specifying notification channels for the condition.
- Scripts JSON array defining scripts to run with the condition, including runAs user and variables.
- Notification Action Notification action type; options: NONE, SEND.
- Notify On Reset Boolean indicating if notifications should be sent when the condition resets.
- Reset Threshold Number representing reset threshold in seconds.
- Text JSON object defining text-based matching criteria with values, condition type, and inclusion.
- Occurrence JSON object defining occurrence settings: enabled flag, threshold count, and duration in minutes.

Output

The node outputs JSON data representing the created Windows Event Policy Condition as returned by the API. This typically includes details such as the assigned ID, configured properties, status, and metadata of the newly created condition.

No binary data output is indicated.

Dependencies

  • Requires an API key credential for authentication to the AvantGuard NinjaOne service.
  • The node uses the base URL and headers configured via credentials.
  • Depends on the external AvantGuard NinjaOne API endpoint for creating policy conditions.

Troubleshooting

  • Common issues:

    • Missing required fields like Policy Id, Source, or Event Ids will cause errors.
    • Invalid JSON format in fields like Event Ids, Channels, Scripts, Text, or Occurrence may lead to parsing errors.
    • Authentication failures due to incorrect or missing API credentials.
    • Network connectivity issues to the API endpoint.

  • Error messages:

    • "Missing required parameter" indicates a mandatory property was not provided.
    • "Invalid JSON format" suggests malformed JSON input in one of the JSON-type fields.
    • "Unauthorized" or "Authentication failed" points to credential problems.

  • Resolutions:

    • Ensure all required properties are filled correctly.
    • Validate JSON inputs before execution.
    • Verify API credentials and network access.

Links and References

Discussion