Configure a custom script to run when an alert triggers

This guide covers the configuration of a custom script in the Execution tab of an alert.

When an alert is triggered, FileAudit can automatically react by executing an action. Some predefined scripts are available to make configuration easier. But this guide covers the case where you want to use your own script or executable.

So before you begin, make sure you have:

• An alert already configured, without the Execution tab configured yet. See Manage alerts Guide

• An account allowed to execute the script or executable, with enough rights to perform the action implemented in the script or executable.

• Your script copied locally in a folder with access permissions for the account that FileAudit will use to execute the script.

1. In the Execution tab of an alert, select Add a new action from the Executed action dropdown list.

2. Create your own script by completing the form:

   

3. In Name, enter the name of the script. It must be unique.

4. In Executable, select the path to your script or executable file. Permitted executable types are .bat, .exe, or .ps1.

5. In Working folder, optionally select the current directory for the execution process. If empty, the process will have the same current drive and directory as the Executable.

6. In Arguments(s), enter the arguments for the executable file.
   You can use dynamic variables in this field. Example: {Username} {ClientAddresses}
   Please note that the following list of dynamic variables is applicable.

7. In Domain, enter the Active Directory domain of the account that FileAudit will use to run the executable.

8. In Username, enter the account that has the permissions required for the execution and that FileAudit will use to run the executable.

9. In Password, enter the password of the previous account.

10. Click Save.

1. From the Executed action dropdown list, select the executable you want to edit or delete.

2. The Action settings appear below the dropdown list. Click Edit.

3. Edit the Execution settings, or click Delete.