easy alert solution

[DSoda]

Hello to all experts.

I am looking for easy solution for alerting remote computer via e-mail when desktop intrusion alert appears.

I can see such invents in motherboard (Q35JO ) AMT web page but how to alert e-mail ?

Thank you.

[Jacob_G_Intel]

I'm not sure how easy it will be, but it can be done. First thing to understand is that AMT can not send emails. The good news is it can send PET events (which are really SNMP trap events) and with AMT 3.2 and up it can also send WS-Events. So, the process will look like this; AMT sends a PET event to a trap receiver. The trap receiver acts as a relay and sends email.

To set this up, you'll first need to identify a system and software that will act as the trap receiver to email relay. Luckily I know of a free one called http://www.trapreceiver.com/ Trap Receiver, but you can use what ever you like. I do recommend giving the system a static IP if possible.

The next step is to configure AMT to send PET events. This is the hardest part. You can either write your own code to do this (using the AMT SDK as a guide) or try using http://software.intel.com/en-us/articles/download-the-latest-version-of-manageability-developer-tool-kit/ commander from the AMT DTK. I'd start with the DTK just to see if you can get everything to work. Then, if needed, build your scripts for automation from there. A caution on commander for alerts, however: the alerting feature is not fully implimented or tested so things may not work or options may be missing. The good news is that I've had some success with commander and alerts in the past so all is not lost.

Unfortunately, there isn't much documentation so it'll take some trial and error to figure this out. I can at least give some general direction on commander. You'll add your AMT system and then connect. Expand the tree and find the event log. Next, you'll create or edit an event filter. I can't help much on exactly how this should look. You may try by just matching everything and see if the events start to come. Then, turn things off one-by-one until you only get the event you're after. Alternatively, you may just let all events be sent and have your trap receiver filter out the unwanted ones before emailing. OK, now that you have a filter, you'll create an alert subscription that uses your custom filter and points to your trap receiver.

Sorry I don't have an easy answer. If you do try try this, let me know how it goes. Good luck!