SCOM – Add additional informations to alert custom fields and notifications from extended class


You have built extended classes in SCOM and fill the extended classes with data from your own built attributes? Now you want to use this data in custom fields from alerts und notifications?

Here is a method with powershell and SCORCH to add data from extended classes to custom fields in SCOM and use this data for custom notifications and other cool stuff.


The script running in my scenario trough a SCORCH runbook. With small changes, the script will also run without SCORCH on a command channel notification.

First you musst declare some variables and values to understand and use the following powershell script.

  • Alert ID (script line 11) $alertID (In my scenario, the SCORCH runbook run only when a specific alert are come up in SCOM.)
  • SCOM management server (script line 14) $hostname (The hostname in FQDN from any of your SCOM management server)
  • Property name of your extended class (script line 60) $className (The display name of your extended class)
  • Value names from your extended class (script lines 61 – 63) $classAttr1, $classAttr2, $classAttr3 (How you can find the value names of your extended class with powershell, is explained in this post.)

The SCORCH runbook


The SCORCH runbook are pretty easy to create.

 Create a “Monitor Alert” pattern, with following settings.

Set the filter for “Monitor Alert” to the SCOM (Source) attribute “MonitorObjectDisplayName” or something else that you like to filter from the alert.

Create a “Run .Net Script” pattern and paste the powershell script.

Link the string from the variable $alertID to the published data filed “ID” from the pattern “Monitor Alert”.

Add following string data to the “Published Data” section, to pass the values in to the linked runbook pattern.

Create an “Update SCOM Alert” pattern with the following data.

Link the property “Alert ID” to the published data filed “ID” from the pattern “Monitor Alert”.

Add fields to the properties area that you want to fill with the runbook. In my scenario I fill the custom fields 1-3.

Link the selected fields to the passed variables from the “Run .Net Script” pattern.

Link the created patterns and voilà, the runbook are complete.

The powershell script

The script collect the values from your extended class and write the values in the custom fields to the original alert. (How you can find the value names of your extended class with powershell, is explained in this post.)

EventLog entry
The powershell script  create on line 26 an Event Log entry on the SCOM management server, to check whether the runbook was started. When you dont need this, comment it out.


When the triggered alert shows up in SCOM the created runbook will run and add the values in the custom fields.

Important to know: When you have a lot of data in your extended class, the powershell script take a little bit longer then thought. If the values in notifications are needed, configure the delay for sending the notification to 1 minute.

If the runbook has updated the alert, the “Last Modified By” data switch from System to the SCORCH service account.

Now the custom fields are filled up with the values from your extended class.

SCOM – Get values from your own built extended class with powershell


You want show or use values from your own extended classes in SCOM with powershell?

Yes you can, this is possible with the following powershell commands.


First you must declare your extended class. In my scenario I take the SCOM class “Windows Computer”. The new extended class are named “Windows Computer Extended Attributes”. Now, I filled up the extended class with a lot of data from monitored Windows and Linux computers.  As example; Server function, server type, server team membership and a lot of other important data from registry and WMI. You can now filter, sort and group the monitored objects dynamically in SCOM with the data from the extended class.

Also, you can get the values with powershell and create some other great scripts.

The powershell commands

To get the SCOM class instance (extended class) you must declare first the extended SCOM class.

Now you can get the SCOM class instance (extended class). The command “Get-SCOMClassInstance” shows a large amount of data. I restrict the result with a monitored object, in this case I take a monitored Windows server. The Displayname must match exactly the Displayname from the monitored object, in my case the FQDN “”.

To figure out the value names to be used, you can export the SCOM class instance to a text file or something else.

In the exported List, you can find the values that you need. You can see default values from the base class that you extended and the own values (imported attributes).

The following value names are relevant to continue with the powershell script. The value names in your own extended class have for all monitored objects the same UID.

  • Server function:
  • Server type:
  • Active Directory Site:

To get the values use the subsequent powershell command


The script displays the following output. You can use this output to fill the custom fields from SCOM alerts and create some custom notifications.