Adding a Custom Event

ISA events describe conditions that require the attention of an administrator, such as a disk-full event. Because an event may occur frequently, you may want to configure the related alert to be activated only if an event occurs a certain number of times. For more information, see the documentation for the FPCAlertNotification.SignalEvent and FPCAlertNotification.Signal_N_Events methods.

Following is an example of adding a new event definition to the FPCEventDefinitions collection using VBScript code. In this example, the additional-keys table is used. Additional keys serve as a way to subdivide event objects into related subevents; for example, subdividing a disk-full event into log-disk-full or system-disk-full subevents. This allows you to define several alerts that are specific to subevents or one alert that is specific to all subevents.

Note  The additional key with an index = 0 means all subevents.

Example

Sub AddEvent()
Set eventdefs = CreateObject("FPC.Root").Arrays.GetContainingArray.PolicyElements.EventDefinitions
eventdefs.Refresh			' Update object
	EventGUID = "{DF2D1202-929C-11d2-872C-00A02453BDDE}"
 
	' Define a new custom event
 
	' Fill in table of additional keys
	Dim AdditionalKeys(4)
	AdditionalKeys(0) = "All DNS attacks"
	AdditionalKeys(1) = "DNS Host Name overflow"
	AdditionalKeys(2) = "DNS Length Overflow"
	AdditionalKeys(3) = "DNS Zone High Port"
	AdditionalKeys(4) = "DNS Zone Transfer"

	Set MyEvent = eventdefs.Add("DNS Attack", EventGUID, AdditionalKeys)

	MyEvent.Save			' Save changes
End Sub

See Also

FPCEventDefinition