Home
  •  

secRMMCentralEvent Discovery

Squadra.secRMMCentral.Event.Discovery (Discovery)

This discovery finds computers running the secRMMCentral product by looking in the computers registry for the secRMMCentral event log entry.

Knowledge Base article:

Summary

This discovery uses the computers registry. It looks for the secRMMCentral event log registry key.

Configuration

Ensure the secRMMCentral product is installed on the computer where you want to monitor Removable Media activity.

Causes

Resolutions

Additional

External

Squadra Technologies web site

Element properties:

TargetMicrosoft.Windows.Computer
EnabledTrue
Frequency86400
RemotableFalse

Object Discovery Details:

Discovered Classes and their attribuets:

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.FilteredRegistryDiscoveryProvider Default

Source Code:

<Discovery ID="Squadra.secRMMCentral.Event.Discovery" Enabled="true" Target="Windows!Microsoft.Windows.Computer" ConfirmDelivery="false" Remotable="true" Priority="Normal">

  <Category>Discovery</Category>

  <DiscoveryTypes>

    <DiscoveryClass TypeID="Squadra.secRMMCentral.Event"/>

  </DiscoveryTypes>

  <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.FilteredRegistryDiscoveryProvider">

    <ComputerName>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <RegistryAttributeDefinitions>

      <RegistryAttributeDefinition>

        <AttributeName>secRMMCentralExists</AttributeName>

        <Path>SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\secRMMCentral</Path>

        <PathType>0</PathType>

        <AttributeType>0</AttributeType>

      </RegistryAttributeDefinition>

    </RegistryAttributeDefinitions>

    <Frequency>86400</Frequency>

    <ClassId>$MPElement[Name="Squadra.secRMMCentral.Event"]$</ClassId>

    <InstanceSettings>

      <Settings>

        <Setting>

          <Name>$MPElement[Name="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Name>

          <Value>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Value>

        </Setting>

      </Settings>

    </InstanceSettings>

    <Expression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="Boolean">Values/secRMMCentralExists</XPathQuery>

        </ValueExpression>

        <Operator>Equal</Operator>

        <ValueExpression>

          <Value Type="Boolean">true</Value>

        </ValueExpression>

      </SimpleExpression>

    </Expression>

  </DataSource>

</Discovery>