Filter Alert Events

When you create an application filter, you may want it to register an alert event that the ISA administrator can use to raise an alert. For example, if your filter looks for a particular string in e-mail, you may want to make it possible for an administrator to be notified when that string is found.

For information on alerts, see Adding a Custom Event and Alert.

The steps you need to take in the code of your filter are as follows:

1. Register alert events in ISA.

   The filter must define an alert event, which it will signal whenever the event (not to be confused with a firewall event) occurs.

   Definition of the alert event should take place during registration of the filter with the Firewall service because you want the administrator to be able to define alerts by using this event. When the filter is unregistered, it should remove this event definition.

2. Create an alert that uses the event.

   Creation of an alert is described in the ISA product documentation.

3. Signal event when the string is found.

   To raise an event, the filter must use the alert service API.

4. Call the IFPCAlertNotification::SignalEvent method to signal when the event occurs.

An example of this procedure is provided in the topic Raising an Event When a String is Found. The procedure is also used in the SMTP filter sample (SMTPFLTR) provided with the ISA Server SDK.

Note  Uninstalling a filter should remove the events that were defined during filter installation, and any related alerts.