SCCM

Integration version: 15.0

Configure SCCM to work with Google Security Operations SOAR

Connect SCCM to Linux

To run SCCM integration on the Centos server, first, install wmi:

rpm -Uvh http://www6.atomicorp.com/channels/atomic/centos/7/x86_64/RPMS/wmi-1.3.14-4.el7.art.x86_64.rpm
yum install wmi

After that, you can configure and use integration.

Configure SCCM integration in Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Integration parameters

Use the following parameters to configure the integration:

Parameter Display Name Type Default Value Is Mandatory Description
Instance Name String N/A No Name of the Instance you intend to configure integration for.
Description String N/A No Description of the Instance.
Server Address String x.x.x.x Yes The IP address or DNS name of Microsoft SCCM server to connect to.
Domain String domain Yes Microsoft SCCM server domain.
Username String N/A Yes The username to use to connect to Microsoft SCCM.
Password Password N/A Yes The password to use to connect to Microsoft SCCM.
Run Remotely Checkbox Unchecked No Check the field in order to run the configured integration remotely. Once checked, the option appears to select the remote user (agent).

Actions

Get Computer Properties

Description

Get computer properties from Microsoft SCCM instance and use obtained information to enrich the provided Google Security Operations SOAR Host entity.

Parameters

N/A

Use Cases

Get information about the host in the Google Security Operations SOAR playbook from Microsoft SCCM and use this data for enrichment.

Run On

This action runs on the Hostname entity.

Action Results

Entity Enrichment
Enrichment Field Name Logic - When to apply
ClientEdition Returns if it exists in JSON result
SMSInstalledSites Returns if it exists in JSON result
MDMDeviceCategoryID Returns if it exists in JSON result
ManagementAuthority Returns if it exists in JSON result
IPAddresses Returns if it exists in JSON result
EASDeviceID Returns if it exists in JSON result
ResourceType Returns if it exists in JSON result
SID Returns if it exists in JSON result
DeviceOwner Returns if it exists in JSON result
IsWriteFilterCapable Returns if it exists in JSON result
HardwareID Returns if it exists in JSON result
IsMachineChangesPersisted Returns if it exists in JSON result
SMBIOSGUID Returns if it exists in JSON result
NetbiosName Returns if it exists in JSON result
Build Returns if it exists in JSON result
AgentSite Returns if it exists in JSON result
IPv6Addresses Returns if it exists in JSON result
ResourceNames Returns if it exists in JSON result
PrimaryGroupID Returns if it exists in JSON result
ClientVersion Returns if it exists in JSON result
ClientType Returns if it exists in JSON result
PreviousSMSUUID Returns if it exists in JSON result
ResourceId Returns if it exists in JSON result
IPv6Prefixes Returns if it exists in JSON result
ObjectGUID Returns if it exists in JSON result
SMSAssignedSites Returns if it exists in JSON result
SMSResidentSites Returns if it exists in JSON result
IsPortableOperatingSystem Returns if it exists in JSON result
MDMComplianceStatus Returns if it exists in JSON result
WTGUniqueKey Returns if it exists in JSON result
AMTStatus Returns if it exists in JSON result
SystemGroupName Returns if it exists in JSON result
AgentName Returns if it exists in JSON result
Active Returns if it exists in JSON result
SNMPCommunityName Returns if it exists in JSON result
ADSiteName Returns if it exists in JSON result
IsClientAMT30Compatible Returns if it exists in JSON result
IsVirtualMachine Returns if it exists in JSON result
AlwaysInternet Returns if it exists in JSON result
Decommissioned Returns if it exists in JSON result
Name Returns if it exists in JSON result
SystemOUName Returns if it exists in JSON result
SuppressAutoProvision Returns if it exists in JSON result
SMSUniqueIdentifier Returns if it exists in JSON result
ResourceDomainORWorkgroup Returns if it exists in JSON result
UserAccountControl Returns if it exists in JSON result
LastLogonTimestamp Returns if it exists in JSON result
AMTFullVersion Returns if it exists in JSON result
OperatingSystemNameandVersion Returns if it exists in JSON result
PublisherDeviceID Returns if it exists in JSON result
SystemContainerName Returns if it exists in JSON result
LastLogonUserName Returns if it exists in JSON result
InternetEnabled Returns if it exists in JSON result
SMSUUIDChangeDate Returns if it exists in JSON result
AgentTime Returns if it exists in JSON result
IsAssignedToUser Returns if it exists in JSON result
WipeStatus Returns if it exists in JSON result
SecurityGroupName Returns if it exists in JSON result
DistinguishedName Returns if it exists in JSON result
SystemRoles Returns if it exists in JSON result
Obsolete Returns if it exists in JSON result
SerialNumber Returns if it exists in JSON result
FullDomainName Returns if it exists in JSON result
IsAOACCapable Returns if it exists in JSON result
MACAddresses Returns if it exists in JSON result
IPSubnets Returns if it exists in JSON result
VirtualMachineType Returns if it exists in JSON result
CPUType Returns if it exists in JSON result
CreationDate Returns if it exists in JSON result
VirtualMachineHostName Returns if it exists in JSON result
OSBranch Returns if it exists in JSON result
LastLogonUserDomain Returns if it exists in JSON result
Script Result
Script Result Name Value Options Example
is_enriched True/False is_enriched:False
JSON Result
[
    {
        "EntityResult": {
            "ClientEdition": "None",
            "SMSInstalledSites": "()",
            "MDMDeviceCategoryID": "None",
            "ManagementAuthority": "None",
            "IPAddresses": "(u'1.1.1.1', u'1.1.1.1')",
            "EASDeviceID": "None",
            "ResourceType": "5",
            "Unknown": "None",
            "SID": "S-1-5-21-2485274276-3947876705-1900992244-1487",
            "DeviceOwner": "None",
            "IsWriteFilterCapable": "None",
            "HardwareID": "None",
            "IsMachineChangesPersisted": "None",
            "SMBIOSGUID": "None",
            "NetbiosName": "PC_01",
            "Build": "None",
            "AgentSite": "(u'001',)",
            "IPv6Addresses": "()",
            "Client": "None",
            "ResourceNames": "(u'PC-01.DOMAIN.COM',)",
            "PrimaryGroupID": "515",
            "ClientVersion": "None",
            "ClientType": "None",
            "PreviousSMSUUID": "None",
            "ResourceId": "2097152157",
            "IPv6Prefixes": "()",
            "ObjectGUID": "(189, 112, 106, 52, 65, 87, 150, 71, 166, 96, 209, 16, 161, 133, 38, 242)",
            "SMSAssignedSites": "(u'001',)",
            "SMSResidentSites": "(u'001',)",
            "IsPortableOperatingSystem": "None",
            "MDMComplianceStatus": "None",
            "WTGUniqueKey": "None",
            "AMTStatus": "None",
            "SystemGroupName": "()",
            "AgentName": "(u'SMS_AD_SYSTEM_DISCOVERY_AGENT',)",
            "Active": "None",
            "SNMPCommunityName": "None",
            "ADSiteName": "Default-First-Site-Name",
            "IsClientAMT30Compatible": "None",
            "IsVirtualMachine": "None",
            "AlwaysInternet": "None",
            "Decommissioned": "0",
            "Name": "PC-01",
            "SystemOUName": "()",
            "SuppressAutoProvision": "None",
            "SMSUniqueIdentifier": "None",
            "ResourceDomainORWorkgroup": "DOMAIN",
            "UserAccountControl": "4096",
            "LastLogonTimestamp": "20190203084427.000000+***",
            "AMTFullVersion": "None",
            "OperatingSystemNameandVersion": "Microsoft Windows NT Workstation 10.0", "PublisherDeviceID": "None",
            "SystemContainerName": "(u'DOMAIN\\\\\\\\COMPUTERS',)",
            "LastLogonUserName": "None",
            "InternetEnabled": "None",
            "SMSUUIDChangeDate": "None",
            "AgentTime": "(u'20190207115148.000000+***',)",
            "IsAssignedToUser": "None",
            "WipeStatus": "None",
            "SecurityGroupName": "()",
            "SystemRoles": "()",
            "DistinguishedName": "CN=PC-01,CN=Computers,DC=DOMAIN,DC=COM",
            "Obsolete": "None",
            "SerialNumber": "None",
            "FullDomainName": "DOMAIN.COM",
            "IsAOACCapable": "None",
            "MACAddresses": "()",
            "IPSubnets": "()",
            "VirtualMachineType": "None",
            "CPUType": "None",
            "CreationDate": "20190128134818.000000+***",
            "VirtualMachineHostName": "None",
            "OSBranch": "None",
            "LastLogonUserDomain": "None"
        },
        "Entity": "PC_01"
    }
]
Case Wall
Result Type Value / Description Type
Output message*

Action should not fail and not stop playbook execution:

If some or all of the provided entities were enriched:

print "Following entities were enriched with SCCM data:\n {0}".format([entity list])

If some of the provided entities were not enriched:

print "SCCM data for the following entities was not found:\n {0}".format([entity list])

If all of the provided entities were not enriched:

print "No entities were enriched"

Action should fail and stop playbook execution:

If critical error, like wrong credentials or network connectivity issues:

print "Failed to connect to the Microsoft SCCM instance! Error is {0}".format(exception.stacktrace).

General
Table

Table name: Microsoft SCCM query results for {0}.entity.Identifier

Table content: content is dynamic, based on query results.

Entity

Get Login History

Description

Retrieve user login history from Microsoft SCCM instance based on the provided Google Security Operations SOAR user entity.

Parameters

Parameter Display Name Type Default Value Is Mandatory Description
Number of Records to Return Integer 100 Yes Maximum number of records to return in the action.

Use Cases

Get user login info from SCCM in the playbook.

Run On

This action runs on the User entity.

Action Results

Entity Enrichment
Enrichment Field Name Logic - When to apply
Username Returns if it exists in JSON result
LoginCount Returns if it exists in JSON result
LastLoggedIn Returns if it exists in JSON result
Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON Result
[
    {
        "EntityResult": [
            {
                "Username": "pc-01\\\\local_users",
                "LoginCount": 22,
                "LastLoggedIn": "20170815103710.000000+***"
            }
        ],
        "Entity": "pc-01"
    }
]
Case Wall
Result Type Value / Description Type
Output message*

Action should not fail and not stop playbook execution:

If got data for some or all of the provided entities:

print "Found SCCM information on the following entities;:\n {0}".format([entity list])

If some of the provided entities were not found in SCCM:

print "SCCM data for the following entities was not found:\n {0}".format([entity list])

If fail to find data for all of the provided entities:

print "No results were found."

Action should fail and stop playbook execution:

If critical error, like wrong credentials or network connectivity issues:

print "Failed to connect to the Microsoft SCCM instance! Error is {0}".format(exception.stacktrace).

General
Table

Table name: Microsoft SCCM login history for {0}.format(entity.Identifier)

Table content: content is dynamic, based on query results.

Entity

Enrich Entities

Description

Enrich Google Security Operations SOAR Host, IP or User entities based on the information from the Microsoft SCCM.

Parameters

N/A

Run On

This action runs on the following entities:

  • User
  • Host
  • IP Address

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON Result

Example return for Host entity, the request was made in Powershell:

    __GENUS                       : 2
    __CLASS                       : SMS_R_System
    __SUPERCLASS                  : SMS_Resource
    __DYNASTY                     : SMS_BaseClass
    __RELPATH                     : SMS_R_System.ResourceId=16777219
    __PROPERTY_COUNT              : 77
    __DERIVATION                  : {SMS_Resource, SMS_BaseClass}
    __SERVER                      : SCCM-SCCM
    __NAMESPACE                   : ROOT\SMS\site_SCM
    __PATH                        : \\SCCM-SCCM\ROOT\SMS\site_SCM:SMS_R_System.ResourceId=16777219
    AADDeviceID                   : 00000000-0000-0000-0000-000000000000
    AADTenantID                   : 00000000-0000-0000-0000-000000000000
    Active                        : 1
    ADSiteName                    : Default-First-Site-Name
    AgentName                     : {SMS_AD_SYSTEM_DISCOVERY_AGENT, SMS_AD_SECURITY_GROUP_DISCOVERY_AGENT, MP_ClientRegistration, Heartbeat Discovery}
    AgentSite                     : {SCM, SCM, SCM, SCM}
    AgentTime                     : {20200730230502.000000+***, 20200415051330.000000+***, 20200415055902.000000+***, 20200730231034.000000+***}
    AlwaysInternet                : 0
    AMTFullVersion                :
    AMTStatus                     :
    Build                         : 10.0.18363
    BuildExt                      : 10.0.18363.900
    Client                        : 1
    ClientEdition                 : 0
    ClientType                    : 1
    ClientVersion                 : 5.00.8790.1007
    CPUType                       : Intel64 Family 6 Model 63 Stepping 2
    CreationDate                  : 20200415121334.000000+***
    Decommissioned                : 0
    DeviceOwner                   : 1
    DistinguishedName             : CN=SCCM-W10,OU=Workstations,OU=SCCM,DC=sccm-lab,DC=local
    EASDeviceID                   :
    FullDomainName                : SCCM-LAB.LOCAL
    HardwareID                    : 2:39AC2A8E6794B559B4F8D5677EFE804D834DE6FF
    InternetEnabled               : 0
    IPAddresses                   : {172.30.202.92, fe80::4cca:c991:272d:24c3}
    IPSubnets                     : {172.30.202.0}
    IPv6Addresses                 : {}
    IPv6Prefixes                  : {}
    IsAOACCapable                 : False
    IsAssignedToUser              : False
    IsClientAMT30Compatible       :
    IsMachineChangesPersisted     : True
    IsPortableOperatingSystem     : False
    IsVirtualMachine              : True
    IsWriteFilterCapable          : False
    LastLogonTimestamp            : 20200731060204.000000+***
    LastLogonUserDomain           : SCCM-LAB
    LastLogonUserName             : Administrator
    MACAddresses                  : {00:50:56:A2:D7:A8}
    ManagementAuthority           : 0
    MDMComplianceStatus           :
    MDMDeviceCategoryID           :
    Name                          : SCCM-W10
    NetbiosName                   : SCCM-W10
    ObjectGUID                    : {230, 152, 150, 13...}
    Obsolete                      : 0
    OperatingSystemNameandVersion : Microsoft Windows NT Workstation 10.0
    OSBranch                      : 0
    PreviousSMSUUID               : Unknown
    PrimaryGroupID                : 515
    PublisherDeviceID             :
    ResourceDomainORWorkgroup     : SCCM-LAB
    ResourceId                    : 16777219
    ResourceNames                 : {SCCM-W10.sccm-lab.local}
    ResourceType                  : 5
    SecurityGroupName             : {SCCM-LAB\Domain Computers}
    SerialNumber                  :
    SID                           : S-1-5-21-3004247314-75612377-2250890222-1104
    SMBIOSGUID                    : 8ABD2242-1FEF-CCCE-12F5-77021D40BE0E
    SMSAssignedSites              : {SCM}
    SMSInstalledSites             : {SCM}
    SMSResidentSites              : {SCM}
    SMSUniqueIdentifier           : GUID:778CB685-B19A-40CD-9257-E9883A0E4AD3
    SMSUUIDChangeDate             : 20200701090912.000000+***
    SNMPCommunityName             :
    SuppressAutoProvision         :
    SystemContainerName           : {}
    SystemGroupName               : {SCCM-LAB\Domain Computers}
    SystemOUName                  : {SCCM-LAB.LOCAL/SCCM, SCCM-LAB.LOCAL/SCCM/WORKSTATIONS}
    SystemRoles                   : {}
    Unknown                       :
    UserAccountControl            : 4096
    VirtualMachineHostName        :
    VirtualMachineType            : 0
    WipeStatus                    :
    WTGUniqueKey                  :
    PSComputerName                : SCCM-SCCM

Case Wall
Result Type Value / Description Type
Output message*

Action should not fail and not stop playbook execution:

If some or all of the provided entities were enriched: "Following entities were enriched with SCCM data:\n {0}".format([entity list])

If some of the provided entities were not enriched: "SCCM data for the following entities were not found:\n {0}".format([entity list])

If all of the provided entities were not enriched: "No entities were enriched"

Action should fail and stop playbook execution:

If critical error, like wrong credentials or network connectivity issues: "Failed to connect to the Microsoft SCCM instance! Error is {0}".format(exception.stacktrace).

General
Table

Table name: Microsoft SCCM enrichment results for {0}.format(entity.Identifier)

Table content: content is dynamic, based on query results.

Entity

Run WQL Query

Description

Run arbitrary Windows Management Instrumentation Query Language (WQL) query against Microsoft SCCM Instance.

Parameters

Parameter Display Name Type Default Value Is Mandatory Description
Query to run String SELECT UniqueUserName,LastLoginTime,LoginCount,ResourceName from SMS_UserMachineIntelligence JOIN SMS_R_User ON SMS_UserMachineIntelligence.UniqueUserName = SMS_R_User.UniqueUserName WHERE SMS_R_User.UserPrincipalName = "sccm_user@sccm-domain.com" Yes Specify WQL query to run. Consider the default example request for reference.
Number of records to return Integer 100 Yes Maximum number of records to return in action.

Use Cases

Run arbitrary queries against Microsoft SCCM instances to get needed data based on alert analysis in Google Security Operations SOAR.

Run On

This action doesn't run on entities.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
JSON Result

Example return for Host entity, the request was made in Powershell:

    __GENUS                       : 2
    __CLASS                       : SMS_R_System
    __SUPERCLASS                  : SMS_Resource
    __DYNASTY                     : SMS_BaseClass
    __RELPATH                     : SMS_R_System.ResourceId=16777219
    __PROPERTY_COUNT              : 77
    __DERIVATION                  : {SMS_Resource, SMS_BaseClass}
    __SERVER                      : SCCM-SCCM
    __NAMESPACE                   : ROOT\SMS\site_SCM
    __PATH                        : \\SCCM-SCCM\ROOT\SMS\site_SCM:SMS_R_System.ResourceId=16777219
    AADDeviceID                   : 00000000-0000-0000-0000-000000000000
    AADTenantID                   : 00000000-0000-0000-0000-000000000000
    Active                        : 1
    ADSiteName                    : Default-First-Site-Name
    AgentName                     : {SMS_AD_SYSTEM_DISCOVERY_AGENT, SMS_AD_SECURITY_GROUP_DISCOVERY_AGENT, MP_ClientRegistration, Heartbeat Discovery}
    AgentSite                     : {SCM, SCM, SCM, SCM}
    AgentTime                     : {20200730230502.000000+***, 20200415051330.000000+***, 20200415055902.000000+***, 20200730231034.000000+***}
    AlwaysInternet                : 0
    AMTFullVersion                :
    AMTStatus                     :
    Build                         : 10.0.18363
    BuildExt                      : 10.0.18363.900
    Client                        : 1
    ClientEdition                 : 0
    ClientType                    : 1
    ClientVersion                 : 5.00.8790.1007
    CPUType                       : Intel64 Family 6 Model 63 Stepping 2
    CreationDate                  : 20200415121334.000000+***
    Decommissioned                : 0
    DeviceOwner                   : 1
    DistinguishedName             : CN=SCCM-W10,OU=Workstations,OU=SCCM,DC=sccm-lab,DC=local
    EASDeviceID                   :
    FullDomainName                : SCCM-LAB.LOCAL
    HardwareID                    : 2:39AC2A8E6794B559B4F8D5677EFE804D834DE6FF
    InternetEnabled               : 0
    IPAddresses                   : {172.30.202.92, fe80::4cca:c991:272d:24c3}
    IPSubnets                     : {172.30.202.0}
    IPv6Addresses                 : {}
    IPv6Prefixes                  : {}
    IsAOACCapable                 : False
    IsAssignedToUser              : False
    IsClientAMT30Compatible       :
    IsMachineChangesPersisted     : True
    IsPortableOperatingSystem     : False
    IsVirtualMachine              : True
    IsWriteFilterCapable          : False
    LastLogonTimestamp            : 20200731060204.000000+***
    LastLogonUserDomain           : SCCM-LAB
    LastLogonUserName             : Administrator
    MACAddresses                  : {00:50:56:A2:D7:A8}
    ManagementAuthority           : 0
    MDMComplianceStatus           :
    MDMDeviceCategoryID           :
    Name                          : SCCM-W10
    NetbiosName                   : SCCM-W10
    ObjectGUID                    : {230, 152, 150, 13...}
    Obsolete                      : 0
    OperatingSystemNameandVersion : Microsoft Windows NT Workstation 10.0
    OSBranch                      : 0
    PreviousSMSUUID               : Unknown
    PrimaryGroupID                : 515
    PublisherDeviceID             :
    ResourceDomainORWorkgroup     : SCCM-LAB
    ResourceId                    : 16777219
    ResourceNames                 : {SCCM-W10.sccm-lab.local}
    ResourceType                  : 5
    SecurityGroupName             : {SCCM-LAB\Domain Computers}
    SerialNumber                  :
    SID                           : S-1-5-21-3004247314-75612377-2250890222-1104
    SMBIOSGUID                    : 8ABD2242-1FEF-CCCE-12F5-77021D40BE0E
    SMSAssignedSites              : {SCM}
    SMSInstalledSites             : {SCM}
    SMSResidentSites              : {SCM}
    SMSUniqueIdentifier           : GUID:778CB685-B19A-40CD-9257-E9883A0E4AD3
    SMSUUIDChangeDate             : 20200701090912.000000+***
    SNMPCommunityName             :
    SuppressAutoProvision         :
    SystemContainerName           : {}
    SystemGroupName               : {SCCM-LAB\Domain Computers}
    SystemOUName                  : {SCCM-LAB.LOCAL/SCCM, SCCM-LAB.LOCAL/SCCM/WORKSTATIONS}
    SystemRoles                   : {}
    Unknown                       :
    UserAccountControl            : 4096
    VirtualMachineHostName        :
    VirtualMachineType            : 0
    WipeStatus                    :
    WTGUniqueKey                  :
    PSComputerName                : SCCM-SCCM

Case Wall
Result Type Value / Description Type
Output message*

Action should not fail and not stop playbook execution:

If query is successful and got data:

print "Query executed successfully and returned results".

If nothing found:

print "Query executed successfully, but did not return any results.".

If error:

print "Query didn't complete due to error: {0}".format(exception.stacktrace).

If query results were truncated:

print "Query results exceeded limits and were truncated!".

Action should fail and stop playbook execution:

If critical error, like wrong credentials or network connectivity issues:

print "Failed to connect to the Microsoft SCCM instance! Error is {0}".format(exception.stacktrace).

General
Table

Table name: WQL Query results

Columns: dynamically generate columns based on the query results

General
Attachments Run_WQL_query_response.json - contains returned by the action technical JSON data. General
JSON Viewer Show the JSON viewer for the query result. General

Create Scan Endpoint Task

Description

Create a scan endpoint task on Microsoft SCCM server for endpoint. Two types of scans are available - Full or Quick. The action works with either Host or IP Google Security Operations SOAR entities.

Parameters

Parameter Display Name Type Default Value Is Mandatory Description
Scan Type DDL Quick Scan Yes Specify whether to run Full scan or Quick scan.

Run On

This action doesn't run on entities.

Action Results

Script Result
Script Result Name Value Options Example
is_success True/False is_success:False
Case Wall
Result Type Value / Description Type
Output message\*

Action should not fail and not stop playbook execution:

If task was created successfully for some or all of the provided entities: "Scan endpoint task was created for the following entities:\n {0}".format([entity list])

If failed to create scan endpoint task for some of the provided entities were not enriched: "Failed to create scan endpoint task for the following entities:\n {0}".format([entity list])

If fail to create a task for all of the provided entities: "Endpoint scan tasks were not created, check the action log for details"

Action should fail and stop playbook execution:

If critical error, like wrong credentials or network connectivity issues: "Failed to connect to the Microsoft SCCM instance! Error is {0}".format(exception.stacktrace).

General

Ping

Description

Test connectivity to Microsoft SCCM instance with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.

Parameters

N/A

Use Cases

The action is used to test connectivity at the integration configuration page in the Google Security Operations Marketplace tab, and can be executed as manual action, which is not a part of playbooks.

Run On

This action doesn't run on entities.

Action Results

Script Result
Script Result Name Value Options Example
is_succeed True/False is_succeed:False

Case Wall

Result Type Value / Description Type
Output message*

Action should not fail and not stop playbook execution:

If successful: "Successfully connected to the Microsoft SCCM instance with the provided connection parameters!".

Action should fail and stop playbook execution:

If not successful: "Failed to connect to the Microsoft SCCM instance! Error is {0}".format(exception.stacktrace).

General