Home
  •  

MECM Malware Detection Monitor

MECM.MalwareDetection.EPAlertState.Monitor (UnitMonitor)

This monitor forwards the Configuration Manager malware detection alert to the Configuration Manager console.

Knowledge Base article:

Summary

Configuration Manager generates an alert when it detects a malware on a single device in a collection.

Causes

Resolutions

Element properties:

TargetMECM.AlertMalwareDetection
Parent MonitorSystem.Health.ConfigurationState
CategoryCustom
EnabledFalse
Alert GenerateTrue
Alert SeverityMatchMonitorHealth
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMECM.EPAlertState.MT
RemotableTrue
AccessibilityPublic
Alert Message
MECM Malware detected on the device
Malware is detected on a device in the collection. Check the Configuration Manager console for details.
RunAsDefault

Source Code:

<UnitMonitor ID="MECM.MalwareDetection.EPAlertState.Monitor" Accessibility="Public" Enabled="false" Target="MECM.AlertMalwareDetection" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="Normal" TypeID="MECM.EPAlertState.MT" ConfirmDelivery="true">

  <Category>Custom</Category>

  <AlertSettings AlertMessage="MECM.MalwareDetection.EPAlertState.Monitor.AlertMessage">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="UIGeneratedOpStateId0e75f5fe70ce4196ad696a4e8bbb4798" MonitorTypeStateID="Good" HealthState="Success"/>

    <OperationalState ID="UIGeneratedOpStateId19ee88c616d247beb8f56be5e438632c" MonitorTypeStateID="Warning" HealthState="Warning"/>

    <OperationalState ID="UIGeneratedOpStateIdb3ee5d749b0d4c1ea7000960c353d983" MonitorTypeStateID="Error" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <TypeId>$Target/Property[Type="MECM.AlertBaseClass"]/TypeId$</TypeId>

    <TypeInstanceId>$Target/Property[Type="MECM.AlertBaseClass"]/TypeInstanceId$</TypeInstanceId>

    <IntervalSeconds>900</IntervalSeconds>

    <ProviderLocation>$Target/Host/Property[Type="MECM.SiteServer"]/ProviderLocation$</ProviderLocation>

    <SiteCode>$Target/Host/Property[Type="MECM.Server"]/SiteCode$</SiteCode>

  </Configuration>

</UnitMonitor>