Creating Alerts Off of a Query?

[waynediesel]

Is it possible to create an automated alert based off of query in ePO?

I have a query that utilizes the EEGo and EEPC products (both EEPC 5.x and 6.x since we have both in our environment at this time) to look for any machines that do not have either EEPC installed, or some other incompatible encryption products as defined by EEGo. I would like the ability to be alerted on this as the query increases or decreases, but I have not figured out a way to use the Automated Response portion of ePo to do this.

Short of manually checking the query every day, is there a more efficient way to do this?

For those interested, the query is as follows in SQL:

select top 360 count(*) as 'count', [EPOComputerProperties].[OSType], [EPOComputerProperties].[OSType] from [EPOLeafNode] left join [EPOComputerProperties] on [EPOLeafNode].[AutoID] = [EPOComputerProperties].[ParentID] left join [EPOProdPropsView_MCAFEE_EEPC] on [EPOLeafNode].[AutoID] = [EPOProdPropsView_MCAFEE_EEPC].[LeafNodeID] left join [EPOProductPropertyProducts] on [EPOLeafNode].[AutoID] = [EPOProductPropertyProducts].[ParentID] left join [EEGOProductDetection] on [EPOLeafNode].[AutoID] = [EEGOProductDetection].[LeafNodeID] where ( ( [EPOComputerProperties].[IsPortable] = 1 ) and ( [EPOProductPropertyProducts].[Products] not like N'%SBDE%' ) and ( not ( ( [EPOProdPropsView_MCAFEE_EEPC].[verProductMajor] >= 6 ) ) ) and ( [EEGOProductDetection].[Product] is null or ltrim( rtrim( [EEGOProductDetection].[Product] ) ) = '' ) ) group by [EPOComputerProperties].[OSType] order by 'count' desc, [EPOComputerProperties].[OSType] asc

[Tristan]

I don't think it's possible from within ePO

1. To measure an increase or decrease you would need to compare the result against a stored result of a previous run of the query. I don't think there's any way of storing values within ePO.

2. From what i can tell the automated alerts are triggered from events not queries.

The only way i can think of doing would be to script it outside of ePO using the API and another piece of reporting software

[waynediesel]

Thanks, Tristan.

I had a feeling it would come to API scripting. Sadly this is expertise that we currently do not have in house.

[Tristan]

Not quite the full solution your looking for but you could schedule ePO to run the query  and email you the results as a PDF, csv, graph or pie chart.

It would remove the need to log into ePO every day and you could track and compare previous results within your mailbox.

[waynediesel]

That is the same conclusion I came to, as well. Luckily the query only produces a low number of results, so monitoring it from day -to-day should not be too overwhelming. Thanks for the help!