search

EvotecIT / PSWinReporting

This PowerShell Module has multiple functionalities, but one of the signature features of this module is the ability to parse Security logs on Domain Controllers providing easy to use access to AD Events.
MIT License
705 stars 70 forks source link

E-mail comes through even if there are no changes #39

Closed el-chazmo closed 3 years ago

el-chazmo commented 5 years ago

Not sure if this is possible - but is there a way that you can NOT send an e-mail if no changes happened? image If this is running every hour - there's no need to know that nothing changed.

PrzemyslawKlys commented 5 years ago

In the Legacy version (1.7.X) which you are using currently no. In 2.X that is in master probably that can be added. However, for per hour verification, I would stop using it the way you do.

You should use forwarding and use the on Event version.

https://evotec.xyz/pswinreporting-forwarders-microsoft-teams-slack-microsoft-sql-and-more/

In the legacy version, only Teams, Slack, Discord, and SQL were supported and on each event, notification was sent. In new version which is currently in Preview, it's also possible to send to email. It's also possible to have different priority on events based on defined parameters (like sending "user was added to Domain Admins to different Teams Channel, different email). I've to yet write a blog post about 2.0.X with explanation on how to use it, what features it has and probably fix a few bugs but should be out soon enough.

I'll add the switch to not send an email if there are no events however I was always worried that this can quickly get out of control. For example, if SMTP stops working you won't notice...

el-chazmo commented 5 years ago

Completely understand what you said about SMTP not working. This is when Monthly / Weekly etc reports are useful. The whole point in hourly reports is for security. If someone is added to certain security groups for example, we should know about it as quickly as possible.

PrzemyslawKlys commented 5 years ago

I understand. Do you have Teams. Slack or Discord?

el-chazmo commented 5 years ago

Unfortunately not. We use our own internal chat - Rocketchat

PrzemyslawKlys commented 5 years ago

Ok, this will be added as part of 2.0, maybe 1.7.x will get it as well, it shouldn't be a big deal to add that. But in 2.0 you should switch to using per event rather than using hourly scan. Per event basically triggers sending email only when an event happens. There's no scan going. You would need forwarding enabled thou.

el-chazmo commented 5 years ago

I understand. I'll look into the forwarding the events into SQL. Thank you again for your speedy response

PrzemyslawKlys commented 5 years ago

This has now been added to 1.8.1. Please add SendMailOnlyOnEvents = $true

$ReportOptions = @{
    JustTestPrerequisite  = $false # runs testing without actually running script

    AsExcel               = $false # attaches Excel to email with all events, required ImportExcel module
    AsCSV                 = $false # attaches CSV to email with all events,
    AsHTML                = $true # puts exported data into email directly with all events
    SendMail              = $true
    SendMailOnlyOnEvents  = $true
    OpenAsFile            = $true
    KeepReports           = $true # keeps files after reports are sent (only if AssExcel/AsCSV are in use)
    KeepReportsPath       = "C:\Support\Reports\ExportedEvents" # if empty, temp path is used
    FilePattern           = "Evotec-<currentdate>.<extension>"
    FilePatternDateFormat = "yyyy-MM-dd-HH_mm_ss"
    RemoveDuplicates      = $true #

Update-Module PSWinReporting Update-Module PSSharedgoods (fixes some issue with SQL)

Version 2.0 is still in progress.