Monitoring - Start and Shutdown events

Microsoft.IntelligencePacks.SecurityBaseline.CollectAgentStartAndShutdown (Rule)

Collects agent start and shutdown events for monitoring purposes

Element properties:

Member Modules:

Source Code:

<Rule ID="Microsoft.IntelligencePacks.SecurityBaseline.CollectAgentStartAndShutdown" Target="Windows!Microsoft.Windows.Computer" Enabled="false" ConfirmDelivery="false" Remotable="false" Priority="Normal" DiscardLevel="100">

  <Category>Custom</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>

      <LogName>Operations Manager</LogName>

      <Expression>

        <RegExExpression>

          <ValueExpression>

            <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

          </ValueExpression>

          <Operator>MatchesRegularExpression</Operator>

          <Pattern>^(102|103)$</Pattern>

        </RegExExpression>

      </Expression>

    </DataSource>

  </DataSources>

  <ConditionDetection ID="CD" TypeID="Monitoring!Microsoft.EnterpriseManagement.Advisor.DiagnosticsMapper">

    <PropertyMappings>

      <PropertyMapping>

        <PropertyName>LoggingComputer</PropertyName>

        <XPath>LoggingComputer</XPath>

        <HashValue>true</HashValue>

      </PropertyMapping>

      <PropertyMapping>

        <PropertyName>EventDisplayNumber</PropertyName>

        <XPath>EventDisplayNumber</XPath>

        <HashValue>false</HashValue>

      </PropertyMapping>

      <PropertyMapping>

        <PropertyName>ManagementGroupName</PropertyName>

        <XPath>Params/Param[1]</XPath>

        <HashValue>true</HashValue>

      </PropertyMapping>

    </PropertyMappings>

  </ConditionDetection>

  <WriteActions>

    <WriteAction ID="WA" TypeID="Types!Microsoft.SystemCenter.DiagnosticsInformationDataWriteAction"/>

  </WriteActions>

</Rule>