Is there any detailed information regarding the use of PowerShell in NTP? Things such as will AD modules like Get-ADUser work? Also things like sending email or SIEM outputs via the script? Detailed breakdown of the $helper variable and $event variable especially how to pull certain attributes (samaccountname, etc.) from the new attributes.
Would love to dive deeper on this.
Thanks!
Hi Art. The NTP PowerShell command let module is documented with examples in the appendix section of the user guides. There are PS cmds to get agent status and list, read, write and create policies as XML objects among other things. In general the NTP PS cmds extension is for managing NTP but not for individual event processing.
For individual events will want to focus on custom action scripts using VB, C# or PS. In the NTP console look under Templates | Actions for 8 sample scripts that demonstrate a number of things that can be done to augment processing of induvial events. When you create a policy the default ‘write to file’ custom action script is a good example to see all the event data items – look for the sw.WriteLine examples showing data item description and corresponding helper data element.