Actions: Step by Step

This topic contains step by step instructions for creating Edge Intelligence actions and linking them to a query or an alert. It also explains the use of action variables, placeholders and using query data in your action.

Prerequisites

Ivanti Neurons Agent installed on endpoints you want to query or for which you want to set alerts. See Ivanti Neurons Agent.
- Endpoints must have a Policy that has the Capability Edge Intelligence enabled. See Agent Policy Capabilities in the Policy.
A role with permissions to configure actions, perform actions and set alerts for Edge Intelligence. See Roles.

Create a custom query action from the Edge Intelligence Configuration panel

In this example you will add an action to the App State query to uninstall an application. The action uses a PowerShell script, with a placeholder for information retrieved by the query. After the application has been uninstalled, the user will be notified.

Go to Insights > Edge Intelligence, and click in the top-right corner of the page.
The Edge Intelligence Configuration panel appears.
On the Actions tab select Add new action.
The New action page opens inside the panel.
1. Specify a Name for the action, for example Uninstall application.
2. In the Variables section select Add new variable.
  The New variable panel appears.
  1. Specify a Name for the variable, for example Name.
    For illustration purposes, the specified names for the variables in this example are identical to the auto-generated variables in the next example. This is not a requirement.
  2. Do not specify a Value. This will be provided by the query.
  3. Leave the option Public variable enabled. This allows the value of the variable to be set during execution of the action.
  4. Click Save.
    The variable is saved and the New variable panel closes.
  5. Repeat steps i through iv to create variables for Version and Vendor.
3. In the Tasks section select Add new task.
  The New task panel appears.
  1. Specify a Name for the task, for example Uninstall application by name.
  2. In the bottom section click Select to see a list of available tasks. Select Execute PowerShell.
  3. In the Script field that appears, insert your (draft) PowerShell script.
    For this example:
    Copy
    $application = Get-WmiObject -Class Win32_Product -Filter "Name = '$(var placeholder)'" $application.Uninstall()
    If you are confident about the exact spelling of the text that should replace $(var placeholder), you can directly type or paste the final version into the Script field. In that case, you can skip ahead to step vi.
  4. From the Available Placeholders section (below the Script field) copy $(action.Name) using . This is the variable Name you created in step 2b.
  5. In the Script field replace $(var placeholder) with the placeholder you copied in step iv.
    The script should now look like this:
    Copy
    $application = Get-WmiObject -Class Win32_Product -Filter "Name = '$(action.Name)'" $application.Uninstall()
  6. Click Save.
    The task is saved and the New task panel closes.
4. In the Tasks section select Add new task again.
  The New task panel appears.
  1. Specify a Name for the task, for example Notify end user.
  2. In the bottom section click Select to see a list of available tasks. Select Notify user.
  3. In the Subject field that appears, type (for example) Successfully uninstalled application: $(action.Name).
    The placeholders are again listed below the task-specific fields of the New task panel, in this case the Subject and Message fields.
  4. In the Message field type the body of the message you want to send to the user. For example:
    Dear user,
    
    The following application was successfully uninstalled:
    $(action.Name)
    $(action.Vendor)
    $(action.Version)
    
    Best regards,
    The IT Team
  5. Click Save.
    The task is saved and the New task panel closes.
  The result should look like the image below.
5. Click Save.
  The action is saved and the New action page closes.
On the Queries tab of the Edge Intelligence Configuration panel find the App State query and click on its name.
The details page for the query opens inside the panel, displaying an overview of linked actions.
1. In the Actions section select Add action.
  The Add action panel opens.
2. From the drop-down select Uninstall application, the name of the action you created in step 2a-e.
  The Action data section (listing the variables you created in step 2b) and the Available Placeholders section (listing data retrieved by the query) appear.
  1. In the Action section, for Name:
    - at Type select Use the following value:
    - at Value specify $(query.name), the placeholder for Program.
  2. In the Action section, for Vendor:
    - at Type select Use the following value:
    - at Value specify $(query.publisher), the placeholder for Publisher.
  3. In the Action section, for Version:
    - at Type select Use the following value:
    - at Value specify $(query.version), the placeholder for Version.
  You can copy a placeholder by using the icon displayed next to the placeholder definition.
3. Click Add to save your changes.
  The Add action panel closes.
Click Close.
The Edge Intelligence Configuration panel closes.

The Uninstall application action is now available for use:

Run the App State query.
From the list view of the query results find the line with the desired Computer Name and Program.
Optionally, you can use filters and/or parameters to do this.
Open the options menu ( ) for the selected line and select Uninstall application.
1. The action uninstalls the program and the App State query results are updated.
2. The notification you created in step 2d is displayed to the end user.

If you go to the query-level options menu instead of to the record-level options menu, Edge Intelligence will apply the action to all records in the query result. Depending on your query parameters, this can mean every application on every computer in your environment.

Create a Quick Action using the 'Manage actions for query' panel

In this example you will add a similar action as in the example Create a custom query action from the Edge Intelligence Configuration panel, but as a Quick Action. This automates some of the configuration steps for you.

Go to Insights > Edge Intelligence, and open the App State query (in the Inventory category).
The App State query widget appears.
Use the toggle to switch to the list view.
Open the options menu ( ) and select Manage.
The Manage actions for App State query panel appears, displaying a list of linked actions.
Select Create a Quick Action.
The Create a Quick Action panel appears.
1. Specify an Action name, for example Uninstall application by name Quick Action.
2. Select the Execute Powershell task.
  The selected task is added under Tasks, and additional configuration fields for the task appear.
  1. In the Script field, insert your (draft) PowerShell script.
    For this example:
    Copy
    $application = Get-WmiObject -Class Win32_Product -Filter "Name = '$(var placeholder)'" $application.Uninstall()
  2. In the Script field, select $(var placeholder) and click on the placeholder Program, under Available Placeholders.
    The placeholder is inserted and the script should now look like this:
    Copy
    $application = Get-WmiObject -Class Win32_Product -Filter "Name = '$(query.name)'" $application.Uninstall()
    You can insert placeholders as you type the script.
3. Select Add another task.
  The list of available tasks appears.
4. Select the Notify user task.
  The selected task is added under Tasks, and additional configuration fields for the task appear.
  1. Specify a Subject and a Message for the notification. You can use placeholders in these fields.
5. Click Save.
  The Create a quick action panel closes and the Manage actions for Sessions query panel becomes visible again. Your new action is listed under Linked actions.
Click Close.
The Manage actions for Sessions query panel closes.

The Uninstall application by name Quick Action action is now available for use.

Link an existing action to a query or an alert

Go to Insights > Edge Intelligence, and click in the top-right corner of the page.
The Edge Intelligence Configuration panel appears.
On the Queries tab select the query to which you want to link an action. For example: Active Directory Users.
The list of linked actions for the Active Directory Users query opens inside the panel.
1. In the Actions section select Add action.
  The Add action panel opens.
2. From the drop-down select Remove from local admins, a default action that is provided by Ivanti.
  The Action data section (listing the variables for the action) and the Available Placeholders section (listing data retrieved by the Active Directory Users query) appear.
  1. In the Action data section, for accountName:
    - at Type select Use the following value:
    - at Value specify $(query.accountName), the placeholder for Accountname.
    Not all queries have relevant or useful placeholders available for use with an action that was created for a different query.
    You can also copy the placeholder by using the icon displayed next to the placeholder definition.
3. Click Add to save your changes.
  The Add action panel closes and Remove from local admins is listed in the Actions section for the Active Directory Users query.
Click Close.
The Edge Intelligence Configuration panel closes.

The action is now available for selection in the options menu ( ) of the Active Directory Users query.

The procedure is the same for adding an action to an alert, except that in step 2 the alert must be selected on the Alerts tab.
After adding an action from the Edge Intelligence Configuration panel, the action is available for selection when setting the alert.