0
Closed

Session/Security Triggers for Commands

Kyle Simpson 4 months ago updated by swhite (Product Manager) 4 months ago 2

Hi,

Is it possible to create sessions/security triggers for when host run commands such as "NET USER "LOGIN" "NEWPASSWORD" ?

Available in Version:

Answer

Answer

Yes, it is possible, here are a couple of examples to get you started along with a link to our Trigger references, these are both Session Event triggers.

Here is what a Run Command trigger would look like, the RanCommand is processed on the guest side so is technically after the command is queued:
Event.EventType = 'RanCommand' AND Event.Data LIKE '%ipconfig%'

The QueuedCommand event is what the Host does, so the command is Queued and then Run on the guest side.

Event.EventType = 'QueuedCommand' AND Event.Data LIKE '%ipconfig%'

Note that the Event.Data I used a LIKE with surrounding wildcards as the data will contain both the command and the resulting output. 

https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Administration_page/Triggers_page/List_of_trigger_definitions

Answer

Yes, it is possible, here are a couple of examples to get you started along with a link to our Trigger references, these are both Session Event triggers.

Here is what a Run Command trigger would look like, the RanCommand is processed on the guest side so is technically after the command is queued:
Event.EventType = 'RanCommand' AND Event.Data LIKE '%ipconfig%'

The QueuedCommand event is what the Host does, so the command is Queued and then Run on the guest side.

Event.EventType = 'QueuedCommand' AND Event.Data LIKE '%ipconfig%'

Note that the Event.Data I used a LIKE with surrounding wildcards as the data will contain both the command and the resulting output. 

https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Administration_page/Triggers_page/List_of_trigger_definitions