We would like to have more alert variables available to include in emails originating from the "Rogue MAC Address" alert. Currently provided variables:
Requested additional variables:
- Connected Port
- Connected Node
- VLAN
- IP Address
- Vendor
- Hostname
- Connection Type
Currently using the following SWQL statements which tend to not populate on newly-introduced MACs:
Device Info:
- MAC: ${N=SwisEntity;M=MACAddress}
- Vendor: ${N=SWQL;M=SELECT ISNULL(Vendor, 'Unknown') AS Vendor FROM Orion.UDT.DeviceInventory WHERE MACAddress = '${N=SwisEntity;M=MACAddress}' AND PortName LIKE 'Gi%'}
- IP Address: ${N=SWQL;M=SELECT ISNULL(IpAddress, 'Unknown') AS IpAddress FROM Orion.UDT.DeviceInventory WHERE MACAddress = '${N=SwisEntity;M=MACAddress}' AND PortName LIKE 'Gi%'}
- Hostname: ${N=SWQL;M=SELECT ISNULL(DnsName, 'Unknown') AS DnsName FROM Orion.UDT.DeviceInventory WHERE MACAddress = '${N=SwisEntity;M=MACAddress}' AND PortName LIKE 'Gi%'}
Connection Info:
- Switch: ${N=SWQL;M=SELECT ISNULL(ConnectedTo, 'Unknown') AS ConnectedTo FROM Orion.UDT.DeviceInventory WHERE MACAddress = '${N=SwisEntity;M=MACAddress}' AND PortName LIKE 'Gi%'} (${N=SWQL;M=SELECT ISNULL(DNS, 'Unknown') AS DNS FROM Orion.Nodes WHERE Caption= (SELECT ISNULL(ConnectedTo, 'Unknown') AS ConnectedTo FROM Orion.UDT.DeviceInventory WHERE MACAddress = '${N=SwisEntity;M=MACAddress}' AND PortName LIKE 'Gi%')} / ${N=SWQL;M=SELECT ISNULL(IP_Address, 'Unknown') AS IP_Address FROM Orion.Nodes WHERE Caption= (SELECT ISNULL(ConnectedTo, 'Unknown') AS ConnectedTo FROM Orion.UDT.DeviceInventory WHERE MACAddress = '${N=SwisEntity;M=MACAddress}' AND PortName LIKE 'Gi%')})
- Port: ${N=SWQL;M=SELECT ISNULL(PortName, 'Unknown') AS PortName FROM Orion.UDT.DeviceInventory WHERE MACAddress = '${N=SwisEntity;M=MACAddress}' AND PortName LIKE 'Gi%'} (${N=SWQL;M=SELECT ISNULL(PortId, 'Unknown') AS PortId FROM Orion.UDT.DeviceInventory WHERE MACAddress = '${N=SwisEntity;M=MACAddress}' AND PortName LIKE 'Gi%'})
- Port VLAN(s): ${SQL: SELECT STUFF( (SELECT ', ' + Convert(varchar, VlanID) FROM UDT_VLAN WHERE PortID = (SELECT ISNULL(PortId, 'Unknown') AS PortId FROM UDT_DeviceInventory WHERE MACAddress = '${N=SwisEntity;M=MACAddress}' AND PortName LIKE 'Gi%') for xml path('')), 1, 2, '') }
- VLAN (if known): ${N=SWQL;M=SELECT VLAN FROM Orion.UDT.AllEndPoints WHERE MACAddress = '${N=SwisEntity;M=MACAddress}'}
- Connection Type: ${N=SWQL;M=SELECT ISNULL(EndpointType, 'Unknown') AS EndpointType FROM Orion.UDT.DeviceInventory WHERE MACAddress = '${N=SwisEntity;M=MACAddress}' AND PortName LIKE 'Gi%'}
