This monitor forwards the Configuration Manager malware outbreak alert to the Configuration Manager console.
Configuration Manager generates an alert when it detects that the percentage of devices infected with malware in a specific collection exceeds the preset threshold.
To change the alert threshold
Open the Configuration Manager console.
Navigate to the collection and open its properties.
In the properties dialog, click the Alert tab.
Modify the Malware outbreak threshold.
Configuration Manager detected that multiple devices in a collection are infected with malware.
Check the Endpoint Protection dashboard and reports in the Configuration Manager console for detailed information about the devices and the detected malware.
Remove the malware.
Target | Microsoft.SystemCenter2012.ConfigurationManager.AlertMalwareOutbreak | ||
Parent Monitor | System.Health.ConfigurationState | ||
Category | Custom | ||
Enabled | False | ||
Alert Generate | True | ||
Alert Severity | MatchMonitorHealth | ||
Alert Priority | Normal | ||
Alert Auto Resolve | True | ||
Monitor Type | Microsoft.SystemCenter2012.ConfigurationManager.EPAlertStateMonitor | ||
Remotable | True | ||
Accessibility | Public | ||
Alert Message |
| ||
RunAs | Default | ||
Comment | SIV:FEP0002 |
<UnitMonitor ID="Microsoft.SystemCenter2012.ConfigurationManager.MalwareOutBreakMonitor" Comment="SIV:FEP0002" Accessibility="Public" Enabled="false" Target="SCCM!Microsoft.SystemCenter2012.ConfigurationManager.AlertMalwareOutbreak" ParentMonitorID="SystemHealth!System.Health.ConfigurationState" Remotable="true" Priority="Normal" TypeID="Microsoft.SystemCenter2012.ConfigurationManager.EPAlertStateMonitor" ConfirmDelivery="true">
<Category>Custom</Category>
<AlertSettings AlertMessage="Microsoft.SystemCenter2012.ConfigurationManager.MalwareOutBreakMonitor_AlertMessageResourceID">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>MatchMonitorHealth</AlertSeverity>
</AlertSettings>
<OperationalStates>
<OperationalState ID="UIGeneratedOpStateId8c574989e65a4716ba644c45c1bb6d12" MonitorTypeStateID="Good" HealthState="Success"/>
<OperationalState ID="UIGeneratedOpStateId7f3f32f712d546e3bfab79576eca2eb7" MonitorTypeStateID="Warning" HealthState="Warning"/>
<OperationalState ID="UIGeneratedOpStateId0e55b9e6856542118df8882925d7f35c" MonitorTypeStateID="Error" HealthState="Error"/>
</OperationalStates>
<Configuration>
<TypeId>$Target/Property[Type="SCCM!Microsoft.SystemCenter2012.ConfigurationManager.AlertBaseClass"]/TypeId$</TypeId>
<TypeInstanceId>$Target/Property[Type="SCCM!Microsoft.SystemCenter2012.ConfigurationManager.AlertBaseClass"]/TypeInstanceId$</TypeInstanceId>
<IntervalSeconds>900</IntervalSeconds>
<ProviderLocation>$Target/Host/Property[Type="SCCM!Microsoft.SystemCenter2012.ConfigurationManager.SiteServer"]/ProviderLocation$</ProviderLocation>
<SiteCode>$Target/Host/Property[Type="SCCM!Microsoft.SystemCenter2012.ConfigurationManager.Server"]/SiteCode$</SiteCode>
</Configuration>
</UnitMonitor>