Script to monitor blacklisted critical event

Download JSON Download Python

Ratings

Release Time

09/01/2022

Downloads

344 times

Update Time

11/18/2024

Views

344 times

Share-it:

Tags

Script monitroing NUMsp

Please use this script to custom critical events when the event occurs.
The script will check the event logs for every 15 min by default. Whenever the event happened, an alert will be generated.

Note:

This script as Custom Monitoring script. Please refer https://wiki.comodo.com/frontend/web/topic/how-to-use-custom-script-procedure-monitoring

And set the custom Monitoring condition duration as 15 min

This script run as a custom monitoring script

Procedure's Instructions

Eventid=10010## Here mention the Event Id to get the details 
Mins=15 ##Here mention the minutes to check the crashed files (It should be same as monitoring time period)
logname="System"
import os 
import sys
import ctypes
import _winreg
import ctypes
from subprocess import PIPE,Popen

def alert(arg): 
   sys.stderr.write("%d%d%d" % (arg, arg, arg))

# Please use "alert(1)" to turn on the monitor(trigger an alert) # Please use "alert(0)" to turn off the monitor(disable an alert) 
# Please do not change above block and write your script below
def eventid(logname,Eventid,Mins):
    class disable_file_system_redirection:
        _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
        _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection
        def __enter__(self):
            self.old_value = ctypes.c_long()
            self.success = self._disable(ctypes.byref(self.old_value))
        def __exit__(self, type, value, traceback):
            if self.success:
                self._revert(self.old_value)

with disable_file_system_redirection():
        setpolicy=os.popen('powershell "Set-ExecutionPolicy RemoteSigned"').read()
        cmd="""powershell.exe Get-EventLog -LogName '%s' -EntryType 'Critical' -After (Get-Date).AddMinutes(-%s)| where {$_.eventID -eq "%s"} | Format-List -Property *"""%(logname,Mins,Eventid)
        #print cmd
        logs=os.popen(cmd).read()
        if logs:
            alert(1)
            print logs
        else:
            print "No Given event Occured %s"%Eventid
            alert(0)
     
eventid(logname,Eventid,Mins)

Comments

No Comments.

Script to monitor blacklisted critical event

Comments

Leave a Comment