SXI Forum

SeanR

Administrator

Registered: 20-11-2018

Posts: 148

Set the ResolutionState on an Alert in SCOM from PowerShell

To Change the ResolutionState of an Alerts in SCOM create a PowerShell script (e.g. ChangeResolutionState.ps1) with the following code:

$scomHeaders = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$scomHeaders.Add('Content-Type','application/json; charset=utf-8')
$bodyraw = "AuthenticationMode:<DOMAIN>\<USERNAME>:<PASSWORD>"
$Bytes = [System.Text.Encoding]::UTF8.GetBytes($bodyraw)
$EncodedText =[Convert]::ToBase64String($Bytes)
$jsonbody = $EncodedText | ConvertTo-Json

$uriBase = 'http://<SCOM_SERVER>/OperationsManager/authenticate'
$auth = Invoke-RestMethod -Method POST -Uri $uriBase -Headers $scomheaders -body $jsonbody -UseDefaultCredentials -SessionVariable websession

$query = @{
    "alertids" = @("<UUID>");
    "comment" = "<USEFUL_COMMENT>";
    "resolutionState" = <RESOLUTION_STATE>;
}


$jsonquery = $query | ConvertTo-Json
$Response = Invoke-WebRequest -Uri "http://<SCOM_SERVER>/OperationsManager/data/alertResolutionStates" -Method Post -Body $jsonquery -ContentType "application/json" -UseDefaultCredentials -WebSession $websession

NOTES:
1. Replace the <DOMAIN>\<USERNAME>:<PASSWORD> fields with the relevant user with access to query SCOM
2. Replace <SCOM_SERVER> with the hostname/IP Address of the SCOM server.
3. Change the <USEFUL_COMMENT> that means something for your administrators.
4. Replace <RESOLUTION_STATE> with the integer from the table below.

ResolutionState

Acknowledged            = 249
Assigned to Engineering = 248
Awaiting Evidence       = 247
Closed                  = 255
New                     = 0
Resolved                = 254
Scheduled               = 250