Preparing Custom Data Source for Alerting

The following PowerShell script represents Action1’s built-in Disk Drive data source with a designated A1_Key:

$result = New-Object System.Collections.ArrayList;

try {
    $wmiObject = Get-WmiObject -Namespace ROOT\CIMV2 -Class Win32_DiskDrive;

    try { 
        $helthStatusInfo = Get-PhysicalDisk;
    }
    catch {
        $helthStatusInfo = 'Unknown';
    }

    function convertBytesInGB ($size) {
        $rounding = if ( $size -lt 1Gb ) { 2 } else { 0 };
        $sizeGB = [math]::Round($size / 1Gb, $rounding);

        return $sizeGB;
    }

    if (![string]::IsNullOrEmpty($wmiObject)) {
        $wmiObject | ForEach-Object {
            $currentOutput = "" | Select-Object Model, 'Device ID', 'Interface Type', 'PNP Device Id', 'Serial Number', 'Size (Gb)', Name, 'Error Description', Status, A1_Key;
            $currentOutput.Model = $_.Model;
            $currentOutput.'Device ID' = $_.DeviceID;
            $currentOutput.'Interface Type' = $_.InterfaceType;
            $currentOutput.'PNP Device Id' = $_.PNPDeviceId;
            $currentOutput.'Serial Number' = $_.SerialNumber;
            $currentOutput.'Size (Gb)' = convertBytesInGB $_.Size;
            $currentOutput.Name = $_.Name;
            $currentOutput.'Error Description' = $_.ErrorDescription;
            $currentOutput.Status = if ($_.Status) { $_.Status } else { 'Unknown' };
            $index = $_.Index;

            if ($helthStatusInfo -ne 'Unknown') {
                $status = ($helthStatusInfo | Where-Object { $_.DeviceID -eq $index }).HealthStatus;
                if ($status -and $status -isnot [system.array]) {
                    $currentOutput.Status = $status;
                }
            };
            $currentOutput.A1_Key = $_.PNPDeviceId;

            $result.Add($currentOutput) | Out-Null;
        }
    }
}
catch { $_ }

$result;

The script assigns the disk’s Plug and Play device identifier to A1_Key:

$currentOutput.A1_Key = $_.PNPDeviceId

This PNPDeviceId is used to identify each physical disk across consecutive snapshots. A returned disk object may look like this:

Model: Samsung SSD 980 

Device ID: \.\PHYSICALDRIVE0 

Interface Type: SCSI 

PNP Device Id: SCSI\DISK&VEN_NVME&PROD_SAMSUNG_SSD_980... 

Serial Number: ABC123456 

Size (Gb): 1000 

Name: \.\PHYSICALDRIVE0 

Error Description: 

Status: Healthy 

A1_Key: SCSI\DISK&VEN_NVME&PROD_SAMSUNG_SSD_980...

# ===== Disk Drive Capacity and Free Space - Action1 Custom Data Source =====


# Description: Collects the capacity and available free space of each fixed
# disk detected on a Windows endpoint. The drive letter uniquely identifies
# each disk object and is used as A1_Key.


# ----- Result Collection -----


$result = New-Object System.Collections.ArrayList


# ----- Helper Function -----


function Convert-BytesToGB {
    param (
        [Parameter(Mandatory = $false)]
        [Nullable[long]]$Bytes
    )


    if ($null -eq $Bytes) {
        return $null
    }


    return [math]::Round($Bytes / 1GB, 2)
}


# ----- Primary Data Collection -----


try {
    # DriveType 3 represents fixed local disks.
    $drives = Get-CimInstance -ClassName Win32_LogicalDisk `
        -Filter "DriveType = 3" `
        -ErrorAction Stop


    foreach ($drive in $drives) {
        # A1_Key must be the last property.
        $currentOutput = [PSCustomObject][ordered]@{
            ComputerName = $env:COMPUTERNAME
            CapacityGB   = Convert-BytesToGB -Bytes $drive.Size
            FreeSpaceGB  = Convert-BytesToGB -Bytes $drive.FreeSpace
            DriveLetter  = $drive.DeviceID
            ErrorMessage = ""
            A1_Key       = $drive.DeviceID
        }


        [void]$result.Add($currentOutput)
    }
}
catch {
    # Return an error row if disk information cannot be collected.
    # A1_Key remains unique for this error object.
    $errorOutput = [PSCustomObject][ordered]@{
        ComputerName = $env:COMPUTERNAME
        CapacityGB   = $null
        FreeSpaceGB  = $null
        DriveLetter  = "Unknown"
        ErrorMessage = $_.Exception.Message
        A1_Key       = "$($env:COMPUTERNAME)_DiskCollectionError"
    }


    [void]$result.Add($errorOutput)
}


# ----- Output (required by Action1) -----


$result

A Created alert is triggered when an object appears in the current snapshot but was not present in the previous snapshot. 

Suppose a new drive with the drive letter R: is added to the endpoint. The next snapshot contains a new disk drive object whose A1_Key value is R:. 

Because no object with this key existed in the previous snapshot, Action1 triggers a Created alert.