‘## Title: MakeAlertFromEvent.vbs
‘## Author: Eric Payne
‘## Client\Company: xxxx
‘## Date: 10/16/2006
‘##                          
‘## Purpose:
‘##        1. Response script for MOM. When generating a Windows Application Event on a remote computer,
‘##        the "Computer" field in the header of the event is actually the name of the comptuer that
‘##        sent the event (Logging computer), not the actual sever it was found on (Source Computer).
‘##        When creating a MOM event rule to monitor for this event and generating an alert based on it,
‘##        the source field appears as if it was from the Logging Computer and not the Source Computer.
‘##        This script changes that Source Computer field to be that of the Source computer
‘##        Example:
‘##        Server A writes an event to Server B that the "alerter service is down"
‘##        On Server B the "Computer" field in the header of the event says "Server A"
‘##        When configuring a standard MOM event rule to watch for this event and when generating an alert based on this event
‘##        the alert will show "Source Computer" as Server A. This is misleading and is not accurate, but technically correct.
‘##        Server B has the problem with the alerter service, not Server A
‘##        This script corrects that problem by inserting the correct "Source Computer" into the Source
‘##        computer field. So now when an event happens, instead of the rule generating an event, it responds with
‘##        this script and generates a custom alert with the source computer showing "Server B"
‘##                                                                          
‘## Requirements:
‘##                          1. Mom Script Parameter – Alert Type: Type of alert to raise (ALERT_ERROR, ALERT_INFORMATION, ‘##                             ALERT_WARNING)
‘##                          2. Mom Script Parameter – Alert Name: Name of the Rule this is run from
‘##
‘## Basic Logic:
‘##                          1. Read in Alert Name and Alert Type
‘##                          2. Parse Alert Type
‘##                          3. Generate alert with correct source computer
‘#####================================================================================

If (ScriptContext.IsEvent()) Then
    Dim objParams: Set objParams = ScriptContext.Parameters
    Dim strName: strName = objParams.Get("Name")
    Set objParams = Nothing
    Dim strAlertType: strAlertType = objParams.Get("AlertType")
                Dim intAlertID
                Select Case strAlertType
                                Case "ALERT_SUCCESS"
                                                intAlertID = 10
                                Case "ALERT_INFORMATION"
                                                intAlertID = 20
                                Case "ALERT_WARNING"
                                                intAlertID =  30
                                Case "ALERT_ERROR"
                                                intAlertID = 40
                                Case "ALERT_CRITICAL_ERROR"
                                                intAlertID = 50
                                Case "ALERT_SECURITY_BREACH"
                                                intAlertID = 60
                                Case "ALERT_SERVICE_UNAVAILABLE"
                                                intAlertID =  70
                End Select
    Dim objEvent: Set objEvent = ScriptContext.Event
    Dim objAlert: Set objAlert = ScriptContext.CreateAlert()
    objAlert.Name = strName
    objAlert.AlertLevel = intAlertID
    objAlert.Computer = objEvent.SourceComputer
    objAlert.AlertSource = objEvent.SourceComputer
    objAlert.ComputerDomain = objEvent.SourceDomain
    objAlert.Description = objEvent.EventParameter(1)
    ScriptContext.Submit objAlert
                Set objAlert = Nothing
                Set objEvent = Nothing
End If