SCOM Alert Enrichment Script Template

D Walsham • 8 June 2021

Know how to enrich your alerts with information that paints a clearer picture!

Introduction

Here is the repository for the SCOM Alert Enrichment Workflow process.

Which essentially is a workflow which allows you to gain the most from your SCOM Monitoring solution by simply enhancing the details of your SCOM Alert details.

How often do we see scenarios in which we have alerts generated and the following issues arise in terms of how you perceive the mapping to be such as;

  • What CI is actually affected
  • What area of the business does this affect
  • Is this a false positive/negative
  • What priority is this overall
  • Which monitoring management pack does this derive from

These are a short-list of very frequent "want to be known now" answers in which we may not have access to right away without performing some kind of due diligence to see where this information is.

And that is where the Alert Enrichment Workflow comes into play.

Scomathon 2021

Hopefully you would have been redirected here after viewing the SCOMATHON 2021 presentation which goes into finer detail of the whole Alert Enrichment process. Which doesnt just follow a management pack which you can simply import, but also a several phase exercise and technical/business strategy which can be applied to capture the best and most vital information of your business.

For those who have not seen the Scomathon 2021 presentation this can be viewed here (will be updated once recordings are available of course)

Where to Download

You can download the sealed and unsealed versions of this management pack here.

by D Walsham 13 December 2021
Looking through the current SQL Server topology and how it affects our decision
by D Walsham 7 October 2021
Introduction
by D Walsham 6 October 2021
Introduction
by D Walsham 12 August 2021
All the parts of the series we went into great detail about how we analyse an end to end solution and how we would design a solution in which would allow us to build endpoints without SCCM being a dependency. Whilst we did this, there is another scenario which we have not touched on yet, which is the hybrid scenarios. In a perfect world ideally you would have your Azure Active Directory within the cloud, every machine meets the recommended requirements for Windows 10, everything is imported into Intune/Autopilot and everyone is happy. But we know this isn't realistic in all cases. Many organisations cannot just simply up and go from on-premise into the cloud therefore the checkpoint here is of course getting into hybrid solutions such as; Co-Management Between Intune and SCCM Hybrid AD with Azure AD and On-Premise AD syncing together These things can play a very interesting part in how you would tackle this if you envisage the next step in the blueprint is to be in a position in which you can build and manage endpoints soley within Intune. With this final part of the series we will go in-depth in how the common hybrid setups look like and how we go about moving into the next step of being able to manage and build devices without SCCM.
by D Walsham 29 July 2021
In continuation from the previous part where we had discussed how we create the "on site" piece of the solution, this was the part which would allow us to get our endpoints into a state in which they would essentially be ready to go through the Autopilot process. Which leaves our next piece of the puzzle, to begin the configuration of the actual backend side that resides within our Endpoint Management console. And you will see how everything ties up together to satisfy the full end to end process of getting an unknown (or known) device to proceed thorough the whole workflow to be finally managed by Intune without the aid of SCCM taking part in any of the prerequisites or preparation at hand.
by D Walsham 15 July 2021
In this part we are now going to look into the technical step by step points on how we put everything together. In the previous part we spoke about the structure of how we would asses whether a machine was actually ready to be built with Autopilot or not with a build checklist process which would step through all areas which would cover an endpoints eligibility. Now with everything planned out we finally want to step into making things reality by putting everything together.
by D Walsham 2 July 2021
When it comes to managing your endpoints in endpoint manager, one of the things you may be looking to do is to get all of your Intune registered machines to also be enrolled as Autopilot devices. Now we can of course just have the deployment profile deployed to all machines and then hit the "Convert targeted machines to autopilot" but this might not necessarily be feasible for every client. We may want to perform some due diligence first so we can at least understand what devices in Intune are not in Autopilot.
Show More