Trigger templates and preconditions reference
Reference for all the precondition fragments and trigger templates available in Integrated Product Packs included in the Tachyon Platform zip. These can be used to create your own custom rules and policies.
Trigger templates
Name | Readable Payload and summary | Parameters | Included in |
|---|---|---|---|
On change of file "<fileName>" When a file changes (Windows only) | File Name
| ||
Every <intervalHours> hours Periodic (hours) | Interval Hours
|
| |
Every <intervalMinutes> minutes Periodic (minutes) | Interval Minutes
|
| |
Every <intervalSeconds> seconds Periodic (seconds) | Interval Seconds
|
| |
On crash of process "<executable>" When a process crashes (Windows only) Monitors the Windows Application Event Log for event 1000. NoteExecutable is case insensitive but is required to be the whole filename without the folder path, such as unreliableapp.exe A partial string such as unreliableapp will not trigger on a crash of unreliableapp.exe. | Executable
| ||
On launch of process "<executable>" When a process starts (Windows only) Monitors the Windows Security Event Log for event 4688. | Executable
|
| |
On change of running state of the "<serviceName>" service When the state of the named Windows service changes NoteYou can determine the short name of a service using the PowerShell cmdlet get-service -DisplayName "Network Location Awareness" This will return NlaSvc in the above example. It is this short name you specify in the <ServiceName> parameter. | Service Name
|
| |
On Windows"<channel>"; event log entry matching "<query>" (debounce for <debounce> seconds) When an event log entry is created (Windows only) NoteA channel is an event sink, example standard channel names are Application or Security. To determine the available event channels execute the following PowerShell command: Get-WinEvent -ListLog * Or to view the event channels on a remote computer: Get-WinEvent -ListLog * -ComputerName <hostname> Similarly to view event log entries for a given channel either use Event Viewer or from PowerShell for example: Get-EventLog application | where {($_.EntryType -Match "Error")
-or ($_.EntryType -Match "Warning")}Or: [dateTime]$oneWeekAgo = (get-date).addDays(-7) Get-EventLog -LogName Application
-After $oneWeekAgo -computerName . | ? {$_.EventID -eq 1000}NoteA query is used to filter the event log messages for a given channel. Examples can be found at https://docs.microsoft.com/en-us/windows/win32/wes/consuming-events. For example to query all OneNote application crashes error log messages: *[System[(Level=2) and (EventID=1000)]] and *[EventData[Data='onenote.exe']] Debounce is a settling period to ensure that in the case of multiple events, only a single event is registered within the space of a given time period. | Channel
Query
Debounce Time Seconds
| ||
On change of registry values in "<hive>\<subkey>" (include subkeys=<includeSubkeys>) When the value of a Windows registry key changes. | Hive, which must be one of:
Subkey : free text string, default empty. Include Sub Keys : 1/0 default 0. |
Precondition fragments
Name | Readable Payload and Description | Parameters | Included in |
|---|---|---|---|
Run if the ConfigMgr client is installed Uses the Device.GetSummary method to determine if the device is running Windows. Uses the OperatingSystem.GetServiceInfo method to determine if the ConfigMgr client service (ccmexec) is installed, although not necessarily running. | No parameters. | ||
Run if <SoftwareTitle> is installed Uses the Software.GetInstallations to see if SoftwareTitle is installed. NoteThe Software Title parameter can be a partial string such as SQL Server which will match on the first SQL Server title that is found installed on the device. | Software Title
| ||
Run if device is Windows <MinimumVersion> Uses Agent.GetSummary method to get MinimumVersion, and passes if it matches the given parameter.
| Minimum Version
| ||
Run if device is running <Variant> variant of Windows <MinimumVersion> Uses the Agent.GetSummary method to get Variant and MinimumVersion, and passes if they match the given parameters. If the text Server is in OsVersionText then it's a Server, otherwise it's a Desktop.
| Minimum Version
Variant Windows OS variant:
| ||
Run if operating system is <OsText> Uses the Agent.GetSummary method to get OsText, and passes if it matches the given parameter. | OsText
| ||
Run if operating system is <OsText> and <SoftwareTitle> is installed Uses the Agent.GetSummary method to get OsText. Uses the Software.GetInstallations to see if SoftwareTitle is installed. | OsText
SoftwareTitle
| ||
Check whether a device has an OS of <OsType> and an architecture of <Architecture> Passes if the OsType agent enumeration and the Architecture match the given parameters. Uses the Device.GetSummary method. | OsType
Architecture
| ||
Run if <ServiceName> service is installed Uses the OperatingSystem.GetServiceInfo method to check the specified service is in the specified state. You specify the service by its short name. NoteService names are listed under registry HKLM\CurrentControlSet\Services. You can determine the short name of a service using the PowerShell cmdlet: The above example will return NlaSvc, whch is the short name you specify in the <ServiceName> parameter. Another example is WindDefend, which is the short name of the Microsoft Defender Antivirus Service. | ServiceName
| ||
Determine if device is running Windows Is Operating System type = Windows. Uses the Device.GetSummary method. | No parameters. | ||
Nomad client passes 3 standard tests plus any/all of the following tests if enabled The precondition passes for all of the following standard tests:
The precondition also tests for each of the following if it is enabled by changing its parameter from 0 to 1:
If smbEnabled test is set in the rule precondition then an additonal test is made to see if the device is a Domain Controller (DC). When installed on a DC Nomad must use its computer account instead of SMSNomadP2P& in order to share its cache. This requires registry value |
Defaults are 0. |