{ "checks": [ { "name": "AD DS Service", "auto_add": true, "check_mode": "agent", "check_type": "agent_service", "parameters": { "service": "NTDS" }, "sort_order": 0, "value_type": "status", "description": "", "check_config": { "service": "NTDS" }, "is_telemetry": false, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 120, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "DNS Server", "auto_add": true, "check_mode": "agent", "check_type": "agent_service", "parameters": { "service": "DNS" }, "sort_order": 1, "value_type": "status", "description": "", "check_config": { "service": "DNS" }, "is_telemetry": false, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 120, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Kerberos KDC", "auto_add": true, "check_mode": "agent", "check_type": "agent_service", "parameters": { "service": "Kdc" }, "sort_order": 2, "value_type": "status", "description": "", "check_config": { "service": "Kdc" }, "is_telemetry": false, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 120, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Netlogon", "auto_add": true, "check_mode": "agent", "check_type": "agent_service", "parameters": { "service": "Netlogon" }, "sort_order": 3, "value_type": "status", "description": "", "check_config": { "service": "Netlogon" }, "is_telemetry": false, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 120, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "AD Replication", "auto_add": true, "check_mode": "agent", "check_type": "agent_script", "parameters": { "script_id": "aaed932f-c14d-545d-af69-816c7363db06" }, "sort_order": 4, "value_type": "gauge", "description": "", "check_config": { "script_id": "aaed932f-c14d-545d-af69-816c7363db06" }, "is_telemetry": false, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 600, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "AD Sync Event 13561", "auto_add": true, "check_mode": "agent", "check_type": "agent_script", "parameters": { "script_id": "7c0eda30-1f13-5721-a9a4-cb48113d34db" }, "sort_order": 5, "value_type": "gauge", "description": "", "check_config": { "script_id": "7c0eda30-1f13-5721-a9a4-cb48113d34db" }, "is_telemetry": false, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 600, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Agent Overview", "auto_add": true, "check_mode": "agent", "check_type": "agent_overview", "parameters": {}, "sort_order": 5, "value_type": "info", "description": "Live-Telemetrie (CPU, RAM, Disks, Netzwerk, Top-Prozesse, Eventlog, Benutzer) für das Command Center Dashboard.", "check_config": {}, "is_telemetry": true, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 30, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Agent Netzwerk-Status", "auto_add": true, "check_mode": "agent", "check_type": "agent_network_state", "parameters": {}, "sort_order": 6, "value_type": "info", "description": "Interfaces, Listener, Verbindungen, Routing.", "check_config": {}, "is_telemetry": true, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 300, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "AD Sync Event 13568", "auto_add": true, "check_mode": "agent", "check_type": "agent_script", "parameters": { "script_id": "6ff9a9d7-2952-5a4e-81ca-c6a773791837" }, "sort_order": 6, "value_type": "gauge", "description": "", "check_config": { "script_id": "6ff9a9d7-2952-5a4e-81ca-c6a773791837" }, "is_telemetry": false, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 600, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "AD Sync Event 13555", "auto_add": true, "check_mode": "agent", "check_type": "agent_script", "parameters": { "script_id": "f214e8a8-52a3-5156-b1ec-4ad4038a2e3c" }, "sort_order": 7, "value_type": "gauge", "description": "", "check_config": { "script_id": "f214e8a8-52a3-5156-b1ec-4ad4038a2e3c" }, "is_telemetry": false, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 600, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Agent Sicherheit", "auto_add": true, "check_mode": "agent", "check_type": "agent_security", "parameters": {}, "sort_order": 7, "value_type": "info", "description": "Defender, Firewall, TPM, BitLocker, offene Ports, Zertifikate.", "check_config": {}, "is_telemetry": true, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 3600, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "AD Sync Event 13552", "auto_add": true, "check_mode": "agent", "check_type": "agent_script", "parameters": { "script_id": "1f2b0647-5ba5-5c60-8b72-80bad1ba0732" }, "sort_order": 8, "value_type": "gauge", "description": "", "check_config": { "script_id": "1f2b0647-5ba5-5c60-8b72-80bad1ba0732" }, "is_telemetry": false, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 600, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Agent Lebenszyklus", "auto_add": true, "check_mode": "agent", "check_type": "agent_lifecycle", "parameters": {}, "sort_order": 8, "value_type": "info", "description": "Aktivierung, Domain, Update-Historie, BSODs, Backup.", "check_config": {}, "is_telemetry": true, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 43200, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Agent Inventar", "auto_add": true, "check_mode": "agent", "check_type": "agent_inventory", "parameters": {}, "sort_order": 9, "value_type": "info", "description": "Installierte Programme, geplante Tasks, Autostart, Dienste.", "check_config": {}, "is_telemetry": true, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 21600, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "AD Group: Domain Admins", "auto_add": true, "check_mode": "agent", "check_type": "agent_script", "parameters": { "script_id": "c0565ebf-3655-51d1-b753-6d90163d89cd" }, "sort_order": 9, "value_type": "gauge", "description": "", "check_config": { "script_id": "c0565ebf-3655-51d1-b753-6d90163d89cd" }, "is_telemetry": false, "interpretation": null, "threshold_crit": 20, "threshold_warn": 10, "interval_seconds": 3600, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 }, { "name": "Agent Hardware", "auto_add": true, "check_mode": "agent", "check_type": "agent_hardware", "parameters": {}, "sort_order": 10, "value_type": "info", "description": "CPU, Speicher, Mainboard, BIOS, Disks, GPUs, Akku.", "check_config": {}, "is_telemetry": true, "interpretation": null, "threshold_crit": null, "threshold_warn": null, "interval_seconds": 86400, "threshold_direction": "upper", "confirmation_attempts": 1, "confirmation_interval_seconds": 10 } ], "profile": { "icon": "server", "name": "Windows - Active Directory", "tags": [ "windows", "agent", "ad", "active-directory" ], "vendor": "microsoft", "category": "server", "os_family": "windows", "description": "AD Domain Controller: replication, sync events, group member count. Auf Basis-Template + dieses anwenden.", "ip_required": false, "port_layout": null, "visual_type": null, "snmp_enabled": false, "agent_capable": true, "requires_snmp": false, "description_md": "AD Domain Controller: replication, sync events, group member count. Auf Basis-Template + dieses anwenden.", "requires_agent": true, "sysoid_patterns": null, "sysdescr_patterns": null, "requires_collector": false }, "scripts": [ { "name": "AD Replication Check", "script_id": "aaed932f-c14d-545d-af69-816c7363db06", "is_builtin": true, "description": "Checks AD replication health via repadmin", "interpreter": "powershell", "script_body": "$output = repadmin /replsummary /bysrc /bydest /csvdelim 2>&1\n$failures = @($output | Select-String '^\\s*\\S+.*,\\s*\\d+,\\s*[1-9]' -AllMatches).Count\nif ($failures -gt 0) { Write-Output \"CRITICAL - $failures AD replication failures | failures=$failures\"; exit 2 }\nWrite-Output \"OK - AD replication healthy | failures=0\"; exit 0", "expected_output": "nagios" }, { "name": "AD Event 13561", "script_id": "7c0eda30-1f13-5721-a9a4-cb48113d34db", "is_builtin": true, "description": "AD sync warning event check", "interpreter": "powershell", "script_body": "$c = @(Get-WinEvent -FilterHashtable @{LogName='Directory Service';ID=13561;StartTime=(Get-Date).AddHours(-24)} -EA SilentlyContinue).Count\nif ($c -gt 0) { Write-Output \"WARNING - $c AD sync warning (Event 13561) | count=$c\"; exit 1 }\nWrite-Output \"OK - No AD sync warning (Event 13561) | count=0\"; exit 0", "expected_output": "nagios" }, { "name": "AD Event 13568", "script_id": "6ff9a9d7-2952-5a4e-81ca-c6a773791837", "is_builtin": true, "description": "AD sync conflict event check", "interpreter": "powershell", "script_body": "$c = @(Get-WinEvent -FilterHashtable @{LogName='Directory Service';ID=13568;StartTime=(Get-Date).AddHours(-24)} -EA SilentlyContinue).Count\nif ($c -gt 0) { Write-Output \"WARNING - $c AD sync conflict (Event 13568) | count=$c\"; exit 1 }\nWrite-Output \"OK - No AD sync conflict (Event 13568) | count=0\"; exit 0", "expected_output": "nagios" }, { "name": "AD Event 13555", "script_id": "f214e8a8-52a3-5156-b1ec-4ad4038a2e3c", "is_builtin": true, "description": "AD replication error event check", "interpreter": "powershell", "script_body": "$c = @(Get-WinEvent -FilterHashtable @{LogName='Directory Service';ID=13555;StartTime=(Get-Date).AddHours(-24)} -EA SilentlyContinue).Count\nif ($c -gt 0) { Write-Output \"CRITICAL - $c AD replication error (Event 13555) | count=$c\"; exit 2 }\nWrite-Output \"OK - No AD replication error (Event 13555) | count=0\"; exit 0", "expected_output": "nagios" }, { "name": "AD Event 13552", "script_id": "1f2b0647-5ba5-5c60-8b72-80bad1ba0732", "is_builtin": true, "description": "AD replication failure event check", "interpreter": "powershell", "script_body": "$c = @(Get-WinEvent -FilterHashtable @{LogName='Directory Service';ID=13552;StartTime=(Get-Date).AddHours(-24)} -EA SilentlyContinue).Count\nif ($c -gt 0) { Write-Output \"CRITICAL - $c AD replication failure (Event 13552) | count=$c\"; exit 2 }\nWrite-Output \"OK - No AD replication failure (Event 13552) | count=0\"; exit 0", "expected_output": "nagios" }, { "name": "AD Group Member Count", "script_id": "c0565ebf-3655-51d1-b753-6d90163d89cd", "is_builtin": true, "description": "Returns member count of an AD group", "interpreter": "powershell", "script_body": "# Change group name below. Duplicate this check for each group you want to monitor.\n$group = \"Domain Admins\"\nImport-Module ActiveDirectory -EA SilentlyContinue\ntry { $count = @(Get-ADGroupMember -Identity $group -EA Stop).Count }\ncatch { Write-Output \"UNKNOWN - Cannot query group '$group': $_\"; exit 3 }\nWrite-Output \"$count\"", "expected_output": "text" } ], "schema_version": 1 }