Acknowledge Solarwinds alert by email with oAuth and Azure AD

Updated 2022-07-05 to use oAuth (modern authentication) and to require the AlertObjectID in the message body. If you have been using an older version of this script, please read the documentation again, as there have been several changes since the previous version.

This Powershell script allows end users to acknowledge or comment upon a Solarwinds alert via email. The script assumes that your organization uses Exchange and Azure AD as its email platform.

Prerequisites:

• An email account ("the email account") for the default reply-to address used by your Solarwinds installation. This should be a dedicated account that isn't used by any other applications or users.
• An Azure AD tenant.
• An Azure AD application and a client secret for that application.
• A Solarwinds individual account ("the Solarwinds account") that can acknowledge alerts. This account must have the following permissions in Solarwinds:
  • Allow alert management rights = yes
  • Allow account to disable actions = yes
  • Allow account to disable alerts = yes
  • Allow account to disable all actions = yes
  • Allow Account to Clear Events, Acknowledge Alerts and Syslogs = yes
• MS Exchange Web Services Managed API 2.2 installed on the server that will run the script. Download and install the API.

Configuration:

1. Log in to Windows as the account that will run the PowerShell script. Create a Windows credentials file for the Exchange application and for the Solarwinds account. For each account, run the PowerShell command
   Get-Credential | Export-Clixml -Path [full path to file]
2. In your Solarwinds alerts, configure the alert to send email. Make sure that the email body includes this text and variable:
   [AlertObjectID=${N=Alerting;M=AlertObjectID}]
3. Edit the script as follows.

   1. Edit the line
      $exchangeEmail = "solarwinds@mydomain.com"
      and replace "solarwinds@mydomain.com" with the address of the email account.

   2. Edit the line
      $SWServer = "solarwinds.mydomain.com"
      and replace "solarwinds.mydomain.com" with the fully-qualified domain name or IP address of your Solarwinds server

   3. Edit the line
      $TenantName = 'mydomain.onmicrosoft.com'
      and replace 'mydomain.onmicrosoft.com' with the name of your Azure AD tenant.
      
      

   4. Edit the line
      Import-Module "C:\Program Files (x86)\SolarWinds\Orion SDK\SWQL Studio\SwisPowerShell.dll"
      to point to the correct location of the SWIS PowerShell library

   5. Edit the line
      Import-Module -Name 'C:\Program Files\Microsoft\Exchange\Web Services\2.2\Microsoft.Exchange.WebServices.dll'
      to point to the correct location of the EWS 2.2 library
4. Copy the script to your Solarwinds server. You can run the script from the Powershell IDE to test it.
5. Configure a task manager job to run the script at the desired interval. I run it once per minute to ensure that acknowledgement/comment emails are processed quickly enough to satisfy my end users.

Use:

This script assumes that the first word in the email message is a command verb such as ack or comment. Any text between the command and a return and/or newline character(s) is treated as a comment, and it will be appended to the alert in Solarwinds.

Message syntax:

The email message must contain the Alert Object ID, formatted as described below. This element can appear anywhere in the message body.

Alert Object ID: A string of digits, in brackets, formatted like this:

    [AlertObjectID=99999]

Commands:

The command must be the first word in the message body.

ack:    Acknowledge the alert and append a comment if one is supplied.

comment: Append a comment to the alert

Comments:

Comments are optional. Any text between the command verb and a newline or return character will be treated as a comment. There are no formatting requirements for comments.

Example 1:

This message would acknowledge an alert without a comment

    Ack

    [AlertObjectID=46673]

Example 2:

This message would acknowledge an alert and append a comment

    Ack  Alert comment from ME

    [AlertObjectID=46673]

Example 3:

This message would append a comment without acknowledging the alert

    comment  Comment from ME

    [AlertObjectID=46673]