How to add a new object to a Real-Time Monitoring Rule (4294883)

If you have  configured a Real-Time Monitoring Rule already, then drill into the Rule, right click and select Properties. Click the matching tab and then the Edit button.  Add the new object to the list of objects to be monitored. Click Ok twice.

If you have not pre-configured a Real-Time Monitoring Rule for this type of monitoring then as all of the required elements are predefined in InTrust, all you need to do is to make the copies of these objects and associate them with one another as follows:
1. Double-click Quest InTrust Manager | Configuration | Sites | Microsoft Windows Network, and check that the appropriate predefined sites exist:
Populate your predefined sites with objects you need and confirm that the sites span objects reside in the right domain. (You can enumerate site objects by clicking Refresh on the site’s Enumeration pane.)
2. Double-click Quest InTrust Manager| Real–Time Monitoring | Rules | .... and right click the the rule that applies to your desired alert.
3. Select Properties from the rule’s shortcut menu. Click the matching tab | the Edit button and add the new object (that you wish to be alerted about events involving that object) to the list of objects to be monitored. Click Ok twice. Click the Notifications tab and check that an email message is listed. Edit the message if necessary, as described in the Message Templates section of this guide.
4. Select the Response Actions tab, and clear the check boxes next to the response actions listed–response actions are disabled.
5. Click the General tab and select the Enabled option to enable rule execution. Click Apply and OK. After you close rule properties, commit the changes.
6. Double-click Quest InTrust Manager | Real–Time Monitoring | Policies, right–click the Monitoring policy that corresponds to the rule modified in steps 2 & 3 and select Properties.
7. Click the Rules tab. The Administrative activity rule group is specified in the list by default. This group includes the required rule. If you want to select just this rule rather than the entire group, open the group and select the rule.
8. Select the E-mail tab, and click Add to specify who will receive the messages. For detailed instructions, see the Notification Groups section of this guide.
9. Select the General tab and select the Activate option. After you close the properties dialog box, commit the changes. The configuration is now finished; InTrust agents will be installed automatically to the site computers to execute the monitoring tasks.
You can modify such settings as alerting, response actions, rule activity time, or others at any time as necessary.
To create your own InTrust object (site, rule, policy, etc), copy the corresponding InTrust predefined object and edit this object according to your specific needs. In this case, InTrust will treat all sites, rules and policies the same whether they are predefined or user-defined.

The Agent configuration is updated every 3 hours but restarting the InTrust Server services will send the updated configuration to the agents.