Adjusting the frequency of restricted software alert emails

[elliotjordan]

Hello JAMF Nation,

Does anybody know of a way to receive restricted software alerts only once every X minutes?

Currently we're receiving multiple alerts per minute. We have no desire yet to kill the process or delete the restricted apps; we're just using email as a way of monitoring what's out there.

Thanks!

Elliot

[chriscollins]

I don't think there is a way. It's even worse for us because there is a verified bug in the JSS for 9.22 where even if you don't have the box to receive those restricted software emails, you still get sent them.

[mm2270]

Best you can do is set up a rule in your mail client (best if it can be done as a server side rule) that will put any emails with the restricted software subject into a different mailbox, which you can then sort through later at your convenience. Of course that means you can potentially miss important notices, so its not ideal, but at least you don't get spammed all day long.

[elliot-p]

[duplicate post]

[elliotjordan]

@chriscollins][/url Yes, I also noticed that bug. Hopefully they're working on fixing it.

@mm2270][/url Server side filtering is what I've been relying on so far. Works fine, but required everyone on the Casper notifications list to set up rules individually. Not ideal.

Will update the thread if I find a way to do this better. Thanks!

Elliot

[chriscollins]

Yep @mm2270, we are using server side as well to get around it.

@elliotjordan, unfortunately I was told that its not a high priority fix right now for that bug.

[The_Lapin]

Bringing this back from the dead...

I'd like to set up a restricted software policy that checks for and reports back via email when a certain third party application is running. Right now we don't want it to interfere with the active process on the client end. So basically set the policy to find the application, then send an email to notify our IT team.

This works but ends up sending emails every few seconds as long as the application is running, so not an ideal solution.

Is this still expected behavior or should there be a way to adjust the frequency to once an hour, once per infringement, etc?