Solution

Requirements

1. It needs the latest version (1.6.7) of PowerShellGet
2. It needs a specific version of the AzureRM.Profile (5.5.0)

Install the module

1. Open an admin PowerShell console
2. Update PowerShellGet

   PS>Install-Module -Name PowerShellGet -Force

3. Install the right AzureRM.Profile version (in addition to newer versions that might already exists on your system)

   PS>Install-Module -name AzureRM.Profile -requiredversion 5.5.0

4. Install the new ASC module

   PS>Install-Module -Name AzureRM.Security -AllowPrerelease

5. Close the PowerShell

Test the new module

1. Open a new PowerShell console
2. Import AzureRM.Security

   PS>import-module AzureRM.Security

3. Log on to Azure with an Account that has access to ASC

   PS> Connect-AzureRmAccount

4. Test the Cmdlets, e.g.

   PS> Get-AzureRmSecurityAlert

• One trigger: Recurrence Trigger every x Minutes
• One action: Run query and list result Execute a query against a Log Analytics workspace and return the result as JSON objects

Requirements

1. A ServicePrincipal For detailed instruction on how to create a ServicePrincipal see https://docs.microsoft.com/de-de/azure/azure-resource-manager/resource-group-create-service-principal-portal . For our  template we need: - Client-ID (APP-ID) - Our Tenant-ID - The App secret
2. An export of a working Logic App as an ARM template. It is much easier to build a PoC in the Azure Portan and than export it into an ARM template. That export can be done either in the Azure portal or with Visual Studio. Within Visual Studio you can use the Cloud Explorer to navigate to your Logic App and  open it with the Logic App Editor. There you can download the template:

Creating the base ARM template

• One resource for the logic app
• One resource for the API connection

• "token:clientId" This is our Client ID
• "token:clientSecret" This is our App secret
• "token:TenantId" This is our TenantID
• "token:grantType” Must be “client_credentials”
• "token:resourceUri" This parameter caused me a lot of headache, as Visual Studio does not dump its value and I could not find the correct value anywhere in the LogicApp documentation. After a lot of try and error I figured out, that it has to be https://management.azure.com/.

Testing the ARM template

My personal lessons learned

1. Create a PoC in Azure Portal first Having this PoC as a starting point and not needing to start from scratch is very helpful. Just keep in mind, that you have to clean up the exported template later on.
2. Use Visual Studio Yes, it is complex, and I do only understand a fraction of its capabilities, but it simplifies your journey into Azure a lot!
3. Exporting templates from Azure Portal is not always a good idea. Some settings/parameters might be missing. Especially in the API connection case. Use Visual Studio instead and get at least all parameters (unfortunately not all needed values).
4. Use the Logic App “Run Details” function in the “Run History” to get deep error messages for a failed action. They can be much more descriptive than the errors in the visual designer:

Measure-command {$agent.GetFailoverManagementServers()}

Days              : 0 Hours             : 0 Minutes           : 0 Seconds           : 26 Milliseconds      : 44 Ticks             : 260445702 TotalDays         : 0,000301441784722222 TotalHours        : 0,00723460283333333 TotalMinutes      : 0,43407617 TotalSeconds      : 26,0445702 TotalMilliseconds : 26044,5702

Background information:

Solution:

$Class   = Get-SCOMClass -Name Microsoft.SystemCenter.HealthService $Agent = Get-SCOMClassInstance -Class $class | Where-Object {$_.DisplayName -eq "name.of.my.agent" } Get-SCOMRelationshipInstance -SourceInstance $agent | ? {(($_.RelationshipId -eq '37848e16-37a2-b81b-daaf-60a5a626be93') -or ($_.RelationshipId -eq 'ca26f3f0-b8ce-c193-d6df-632d53dee714')) -and ($_.IsDeleted -eq $False)} | Sort TargetObject | FT SourceObject,TargetObject,RelationshipId

Measure-command {Get-SCOMRelationshipInstance -SourceInstance $target | ? {($_.RelationshipId -eq '37848e16-37a2-b81b-daaf-60a5a626be93') -or ($_.RelationshipId -eq 'ca26f3f0-b8ce-c193-d6df-632d53dee714')} | Sort TargetObject | FT SourceObject,TargetObject,RelationshipId }

Days              : 0 Hours             : 0 Minutes           : 0 Seconds           : 0 Milliseconds      : 94 Ticks             : 948595 TotalDays         : 1,09791087962963E-06 TotalHours        : 2,63498611111111E-05 TotalMinutes      : 0,00158099166666667 TotalSeconds      : 0,0948595 TotalMilliseconds : 94,8595

Issue

Solution

• Community Add-On RID issuance Monitoring for AD 2008-2012 MP v6 Needed if you still use our v6 AD MP
• Community Add-On RID issuance Monitoring for AD 2012 MP v10 Needed, if you use our new v10 AD MP with Windows 2012(R2)
• Community Add-On RID issuance Monitoring for AD 2016 MP v10 Needed, if you use our new v10 AD MP with Windows 2016

OMS solutions and alarming overview

DirkBriClimateSensorDataV2_CL 
| where DeviceLocation_s matches regex "Lager*" 
| summarize arg_max(TimeGenerated, *) by DeviceLocation_s 
| project Location=DeviceLocation_s,HealthState=HealthState_s 
| order by Location asc

DirkBriClimateSensorDataV2_CL 
| where DeviceLocation_s matches regex "Lager*" and IsAlertMessage_b==false 
| summarize avg(TemperatureValue_d) by DeviceLocation_s,bin(TimeGenerated, 1h) 
| project Location=DeviceLocation_s,Temperature=avg_TemperatureValue_d,TimeGenerated 

Alarming

DirkBriClimateSensorDataV2_CL
| where DeviceLocation_s matches regex "Lager*"
| summarize  arg_max(TimeGenerated, *) by DeviceLocation_s
| where HealthState_s <> "OK"

Costs of the solution

• One time costs One time costs occur only for purchasing the devices. The DRH-3015 costs about 70 EUR, the RTU-5023 with antenna and power suply around 90 EUR
• Re-occuring (monthly) costs
  • Twilio You need a mobile phone number from Twilio. That will cost 5 USD per Month. Every text message received will charge 0,0075 USD/message. Every text message send will be charged 0,085 USD/message.
  • Azure Automation You can use the free version for this solution. 500 min per month should be enough -> 0 EUR
  • OMS You can use the free tier for this solution. 500 mb data and 7 days of storage should be enough -> 0 EUR
  • Text messages from devices These costs are hard to calculate, as they depend on how frequently you want to get status messages and/or trigger these. And it depends on your provider. I am using a provider that charges me 4 EUR/month per device (SIM card) for 300 text messages. That would allow me to send 8 status messages every day (every 3h) and some buffer for out-of-band messages.

Results realized?

• Get an alert as quick as possible, when the room temperature fall out of a defined range The device will send an out-of-band alert message to Twilio that gets translated into a record with HealthState <> "OK" and IsAlertMessage = TRUE. That will trigger an OMS alert. Additionally I could have created a query that checks, if the TempValue_d property is above/below a certain value. Succeeded!!!
• Get an alert as quick as possible, when there is a power outage in one of the locations The device will send an out-of-band alert message to Twilio that gets translated into a record with HealthState <> "OK" and IsAlertMessage = TRUE. I also created a query that checks for devices not sending any data in a certain time frame. So either way I will get an alert, if a device dies. Succeeded!!!
• Get an overview (dashboard) of the current state of all locations from wherever I might be See the dashboard above. Succeeded!!!
• Get an alert whenever one of the monitoring devices in a location dies (malfunction or other issue) I also created a query that checks for devices not sending any data in a certain time frame. So either way I will get an alert, if a devices dies. Succeeded!!!
• [Optional] Track the temperature on a very basic level See the dashboard above. Succeeded!!!
• [Optional] Track and alert the humidity in the room See the dashboard above. Succeeded!!!
• Spent as little time and as little money as possible Well, that is an interesting question. I spend around 3 days total for testing and developing. From a cost perspective, it is within my personal limits. But to be honest: this solution does not scale well regarding costs. The more frequent I want to collect data from the devices, the more I have to pay...

Summary

Overview solution architecture

Handling text messages with Twilio

Sending text messages

function send-twiliosms
{
    param($RecipientNumber,
            $SMSText  )

    $TwilioSID = Get-AutomationVariable -Name "DirkBri-Twilio-AccountSID"
    $TwilioToken = Get-AutomationVariable -Name "DirkBri-Twilio-AuthToken"
    $TwilioNumber = Get-AutomationVariable -Name "DirkBri-Twilio-Number"

    $secureAuthToken = ConvertTo-SecureString $TwilioToken -AsPlainText -force 
    $TwilioCredential = New-Object System.Management.Automation.PSCredential($TwilioSID,$secureAuthToken)  

    $TwilioMessageBody = @{ 
       From = $TwilioNumber 
       To = $RecipientNumber 
       Body = $SMSText 
    } 

    $TwilioApiEndpoint= "https://api.twilio.com/2010-04-01/Accounts/$TwilioSID/Messages.json" 
    $Result = Invoke-RestMethod -Uri $TwilioApiEndpoint -Body $TwilioMessageBody  -Credential $TwilioCredential -Method "POST" -ContentType "application/x-www-form-urlencoded"  

    return $Result
}

$Result = send-twiliosms -RecipientNumber $Device -SMSText $dicDevicesToTrigger.item($Device)
write-host $Result

Receiving text messages

Azure Runbooks

• One runbook that actively triggers the DRH-3015 devices to send their status message
• One runbook to receive all text messages, parse them and create an OMS custom log record out of it

Trigger text message runbook

Receive and process text message runbook

• Converts the URL encoded Webhook data from JSON to a PowerShell object with multiple properties like Sender, Message body, SMS ID etc.
• Checks, if the sender is valid and approved. The runbook will not accept data from unknown numbers (devices) to prevent SPAM or malicious data.
• Parses the different text message formats and transforms them into a single, standardized Hash table. If for any reason the device sends a message that cannot be transformed properly (e.g. due to an unknown format), consider this as an alert and set the properties of the record accordingly. This is an important fallback, in case my script has a flaw and cannot handle some specific kind of text message correctly.
• Converts the Hash table into a JSON object and sends the JSON object to my OMS workspace using the REST API. I use a custom OMS log called DirkBriClimateSensorDataV2_CL You can find detailed information on how to send data to OMS via PowerShell and the REST-API here and here

Properties for OMS custom log

• HealthState Allows me to show the overall health state of each device by showing the current (latest) HealthState value per device.
• HumidityValue,TemperatureValue,PowerValue Number values that will allow me to draw charts in OMS
• HumidityState, TemperatureState, PowerState State values that allow me to show the individual component state of each device.
• IsAlertMessage Very important property that will be needed to create out-of-band alerts in OMS.
• DeviceType,PhoneNumer,Location Content fields to identify the different devices.
• TwilioSMSMessageID, RunbookInvokeTime, TwilioSMSBody, RunbookScriptVersion Additional information that will help troubleshooting in case of any issue. Lesson learned This is a lesson I learned when I started creating SCOM Management Packs: You can never have too much data for debugging an troubleshooting purpose :). By including this data in the OMS log record I can easily track e.g. a text message throughout the whole process, determine the time difference between sending the data from Azure Automation to OMS and its availability for searching in Log Analytics and so on.

• Part 1 describes the initial situation and my decision criteria for the devices, tools and services I used to build the solution.
• Part 2 describes the overall technical architecture, some technical details and some lessons learned
• Part 3 describes how I created the dashboard tiles and the alarmin based on the data I collected

My initial situation

Objectives for my solution

• Get an alert as quick as possible, when the room temperature fall out of a defined range
• Get an alert as quick as possible, when there is a power outage in one of the locations
• Get an overview (dashboard) of the current state of all locations from wherever I might be
• Get an alert whenever one of the monitoring devices in a location dies (malfunction or other issue)
• [Optional] Track the temperature on a very basic level
• [Optional] Track and alert the humidity in the room
• Spent as little time and as little money as possible :)

Sensor devices

• External antenna connector for better 2G quality of reception
• Allows to monitor temperature and humidity
• Can send status messages (reports) on a scheduled base
• You can call the device from an authorized mobile phone number. The device will not answer the call, but cancel it immediately so the call is free of charge. But it will trigger a status message sent to the caller. So querying the status of the device will cost you just one text message instead of two!

Designing the solution

• Send text messages to the device automatically to trigger a status message (for the DRH-3015 devices)
• Receive text messages and transfer them into a custom OMS log record (for out-of-band messages from both device types and periodic status messages from RTU-5023 devices)
• Convert the text message into a standardized custom OMS log record

• Trigger and receive text messages via Twilio
• Get data from Twilio with an Azure Automation runbook
• Send modified data to a custom log in OMS Log Analytics via an Azure Automation runbook
• Built a dashboard based on the custom log records in OMS
• Create E-Mail alerts based on the custom log records in OMS