Censusby Steward IT

Documentation › Using Steward IT Census

Alerts & email

Alerts tell you when something needs attention, and can email reports on a schedule. Every alert is recorded in the alert log (Configuration › Alerts & scheduled reports), and emailed if email is set up.

Email#

Configuration › Email. Choose how Census sends email:

  • Microsoft 365: through the Microsoft Graph API with an app registration, no mailbox password (below).
  • Gmail / Google Workspace: through the Gmail API with a service account, no mailbox password (below).
  • My mail server (SMTP): your own server or a relay (below).
  • Resend: a hosted email service with an HTTPS API, for sites without a mail server (below).

The same setting sends alerts, scheduled reports and help desk email.

Microsoft 365#

Microsoft is switching off password sign-in for SMTP (basic authentication) in Exchange Online. Census sends through Microsoft Graph instead, signed in as an app:

  1. Use the app registration of your Entra ID connection, or create one (Entra admin center › App registrations › New registration, then a client secret) and add it under Scanning › Active Directory & Entra ID as an Entra ID tenant. It can be just for email: leave its sync off.
  2. In the app registration: API permissions › Add a permission › Microsoft Graph › Application permissions › Mail.Send, then Grant admin consent.
  3. Mail.Send lets the app send as any mailbox of the tenant. Limit it to the mailbox Census sends from with an Exchange Online application access policy (New-ApplicationAccessPolicy -AccessRight RestrictAccess -AppId <client ID> -PolicyScopeGroupId <mail-enabled security group containing the mailbox>) or RBAC for Applications.
  4. In Census, Configuration › Email: choose Microsoft 365, the Entra ID tenant, and the From address: the mailbox that sends (a shared mailbox works, and needs no license). Save, then Send test.

The message keeps its headers (Reply-To and the help desk's message IDs), so replies still reach the right ticket. If sending fails, the error says what's missing: the permission, the mailbox, or a wrong client secret.

Gmail / Google Workspace#

Google is ending password sign-in for apps too. Census sends through the Gmail API with a service account that acts as the sending mailbox (Google Workspace accounts; personal gmail.com accounts can't be used this way):

  1. Use the Google Workspace (service account) credential of the Google Workspace sync, or create one: a Google Cloud project with the Gmail API enabled, a service account and its JSON key, added under Scanning › Credentials.
  2. In the Google Admin console: Security › Access and data control › API controls › Manage domain-wide delegation: add (or edit) the service account's client ID with the scope https://www.googleapis.com/auth/gmail.send.
  3. In Census, Configuration › Email: choose Gmail / Google Workspace, the credential, and the From address: a mailbox of your Google Workspace. Save, then Send test. Sent messages appear in that mailbox's Sent folder.

SMTP#

Field Example
SMTP server / port smtp.example.com / 587
Security STARTTLS (587), TLS/SSL (465) or None (internal relay on port 25)
From address census@example.com
Username / password Leave the username blank for relays without authentication

Use Send test to check delivery. The password is stored encrypted. For Microsoft 365 and Gmail, prefer the options above: both are ending password sign-in for SMTP.

Resend (no mail server needed)#

Resend sends email over an HTTPS API (outgoing port 443 only); its free tier covers the volume of alerts and reports.

  1. Create a Resend account.
  2. Domains › Add domain: add your domain (or a subdomain such as mail.example.com) and create the DNS records Resend shows (SPF/DKIM) at your DNS provider. Wait until the domain shows Verified.
  3. API Keys › Create API key with Sending access (optionally limited to that domain). Copy the key (re_…).
  4. In Census, Configuration › Email: choose Resend, paste the API key, and enter a From address on the verified domain, e.g. census@example.com. Save.
  5. Send test.

Before the domain is verified you can test with the from address onboarding@resend.dev; Resend then only delivers to the email address of your Resend account. Errors from Resend (for example domain is not verified) are shown when a test fails and in the alert log. The API key is stored encrypted.

Alert rules#

Configuration › Alerts & scheduled reports › New rule

Type When it fires
New asset discovered A device appears for the first time (checked every 5 minutes)
Software installed New software, optionally only names containing a word (a new version of a program already installed is an update, not a new install)
Unauthorized software installed Software marked Unauthorized appears on any computer
Hardware / OS / IP / new user changes Change events from inventory
Scan problems Login failures or the license limit during scans
Low disk space Digest of volumes below 10% free
Assets not seen for N days Digest
License usage above threshold e.g. 90% of licensed assets in use
Unauthorized administrators found Digest of administrators not on the authorized list
Asset not answering An asset of the chosen group has stopped answering for the chosen minutes (default 5), and again when it answers. Checked every minute. See Asset not answering.
Remote scanner offline A remote scanner hasn't reported for the chosen minutes (default 15); once per outage
Actively exploited vulnerability found (CISA list) A computer has a vulnerability on CISA's Known Exploited Vulnerabilities list (newly found, or newly added to the list). See Vulnerabilities. Accepted risks are not reported.
Low printer supplies Digest of printer toner, ink, drums and waste boxes at or below the chosen percent (default 10). See Printer supplies.
Certificate expiring A certificate comes within the chosen days of expiry (default 30); each certificate once. See Certificates.
Event log entry New event log entries matching event IDs, a source, message text and a level. See Event logs.
Server hardware fault A server's management controller reports a new fault (a component turned Warning or Critical) or a new critical log entry; each fault once. See Server hardware health.
Asset appears on a report An asset shows up on a built-in or custom report, checked every 15 minutes, hourly or daily. See Report alerts.
Email a report on a schedule Any built-in or custom report, hourly / daily / weekly / monthly, as a table in the email or (tick Send the report as a PDF attachment) as a PDF

Event alerts only report what happened after the rule was created (except Asset not answering, whose first check reports assets that are already down). Run now evaluates a rule immediately, which is handy for testing. Recipients are a comma-separated list.

Asset not answering#

For servers, switches, firewalls and other equipment you want to hear about within minutes, not in a daily digest. Put them in an asset group (a static group of your servers, or a dynamic one such as type = Server), then add a rule of type Asset not answering for that group.

Every minute Census checks each asset of the group, the same way as the online status on its page: a connected Census agent counts as answering; otherwise Census pings it and tries the usual ports and your custom ports. Assets at another site are checked by that site's remote scanner (when the scanner itself is offline, they show as not checked rather than down). An asset counts as not answering after two failed checks in a row, from the time of the first one, so a single lost packet doesn't count. The email goes out once the asset has not answered for the chosen minutes, once per outage, and a second email when it answers again (untick that with No email when it answers again). Outages shorter than the chosen minutes send nothing.

The asset's Summary tab shows Watched with its current state, and the report Watched assets and whether they answer lists every watched asset, those not answering first. Census watches up to 2,000 assets this way. The checks only need the asset to answer on the network: a computer whose agent has stopped but which still answers ping counts as answering.

Report alerts#

Turn any report into an alert: build a report of what you want to hear about (for example computers with an outdated Chrome, assets with unauthorized software, or any condition in the report builder), open it and click 🔔 Alert me, or choose Asset appears on a report as the rule type.

At each check the report runs again. The email lists the report's rows for each asset that is new on the report since the last check, so you hear about each asset once, not at every check. Tick Also when an asset drops off the report to hear when a problem was fixed too. An asset that drops off and comes back later is reported again. The first check sends the assets already on the report.

The report must list assets: built-in reports do, report-builder reports do, and a SQL report needs an asset_id column. To get the whole report at fixed times instead, use Email a report on a schedule.