Agent Client Collector ACC-V - How to Launch Powershell Script on Agent through Check Definition

[Paul Curwen]

Has anyone successfully managed to get a Check Definition to run a Powershell script on an Agent?

Our business requirement is to get a Virtual Agent Topic to use the ACC Spoke to invoke the Flow Action 'Run Agent Client Collector Check Definition'.

The challenge is how to configure the ACC Check Definition as I can see no examples that run Powershell scripts on the agents only osquery as they supplied Ruby Scripts are provided OOTB.  We can get the VA Topic to call the 'Run Agent Client Collector Definition', but I'm having issues understanding the correct syntax in the Check Definition to launch a  Powershell script on the agent. 

[Fabian Kunzke]

Hello,

I may be incorrect about this, but i am fearly certain that you cannot directly execute a powershell command through the agent client collector.

This has several reasons:
The ACC is based on the Sensu framework. It is exclusively running ruby scripts. This allows you to extend the ACC functionality, but - as you stated - only ruby based scripts.

However, the Sensu framework comes with a very active community. I found this github repository which provides windows based checks run in correlation with .ps scripts. Now, i have to admit that i did not use it personally yet, but it could help you going in the right direction.

Note: The repro does contain the .ps scripts under the "bin" folder.

Note 2: I sadly did not have the time to try this out. But sticking to the readme in the github repository should give you a good direction.

You will have to create a agent client collector plugin record for these checks similar to the "monitoring-plugin-windows" one supplied ootb. You can then create a check definition for this plugin (for the monitoring-plugin-windows one this is os.windows.metrics-system-disk-usage).

tl:dr You will need to setup a plugin containing the .ps files you want to run. Then create the check you want to call in your flow.

I know, this is just very rough guidance. Still hope this helps.

Regards

Fabian

[Paul Curwen]

Thanks for the reply. I have figured out how to do this and will post my findings for others shortly

[Fabian Kunzke]

I would encourage you to write an article and post the link here. That way the solution (which i would deem a very interseting one) gets more visibility.

Regards

Fabian

[jevans74]

Hey Paul,  

Did you ever post your findings for this anywhere?

Thanks in advance!
Joe