Custom Actions in RdpGuard

• Custom Actions Overview
• Supported Custom Actions
• How to add Custom Action
• How to edit Custom Action
• How to delete Custom Actions
• Custom Action Event Settings

Custom actions let RdpGuard send email and Telegram notifications, call HTTP endpoints or run scripts when an event occurs. For example, send an email when an IP address is blocked or a user logs in.

Administrator privileges are required to configure or test custom actions because they can run programs with SYSTEM privileges. For details, see the Custom Actions security fix.

Events

The following Custom Action Events are supported:

IP Blocked and IP Unblocked actions apply to locally detected attempts. Blocking an address solely through IP Cloud does not trigger these events.

Custom Actions

The following Custom Actions are supported:

• Send E-mail
• Send HTTP POST
• Execute program
• Report to AbuseIPDB
• Send Telegram Message

Variables

You can use the following variables in E-mail Subject/Body, HTTP POST Endpoint/Body, Telegram messages or as arguments for program execution:

• %IP% - IP address
• %USER% - User name
• %DOMAIN% - Windows Domain
• %BLOCK_DATE% - Block date and time in the server's local time zone
• %UNBLOCK_DATE% - Unblock date and time in the server's local time zone
• %BLOCK_DATE_UTC% - Block date and time in UTC (ISO 8601)
• %UNBLOCK_DATE_UTC% - Unblock date and time in UTC (ISO 8601)
• %PROTOCOL% - Protocol (reason)
• %TOTAL_IP_BLOCKED% - Total IP addresses currently blocked
• %HOSTNAME% - The host name of the computer where RdpGuard installed
• %NEW_VERSION_NUMBER% - New version number
• %NEW_VERSION_LINK% - New version download link
• %MAINTENANCE_DAYS% - Maintenance days remaining

The UTC variables use the fixed ISO 8601 format yyyy-MM-ddTHH:mm:ssZ, for example 2026-09-14T09:30:00Z. The trailing Z means UTC. This format does not depend on the server's regional settings. The existing %BLOCK_DATE% and %UNBLOCK_DATE% variables keep their local time and regional date/time format.

Both unblock date variables represent the scheduled automatic unblock time.

Send E-mail

This custom action allows you to send an e-mail using pre-defined SMTP server

The following configuration fields are available:

SMTP Server - use this drop-down list to specify SMTP server to use for sending e-mails.

You can add/edit SMTP servers using the ... button next to the drop-down list.

From - specify the sender's email address

To - specify the recipient's email address

Subject - specify message subject, you can use variables described above.

Body - specify message body, you can use variables described above.

Send HTTP Post

This custom action performs HTTP POST request to user defined endpoint each time the event occur.

The following configuration fields are available:

Endpoint - specify the endpoint the request will be sent to, you can also specify the port after the server name using the colon symbol, for example https://server.com:443/page.aspx

Enable Basic HTTP Authentication - use this option to enable password protected access to the endpoint. Please note that username/password is transmitted in plain form for this kind of authentication, so TLS/SSL connection is recommended if you enable this option.

Username - user name for Basic HTTP Authentication

Password - password for Basic HTTP Authentication

POST Body - specify the HTTP POST body you would like to receive on the server side, you can use variables described above.

Execute program

Run a program or script when the selected event occurs.

The following configuration fields are available:

Program/script - Specify the program or script to execute

Arguments - Specify program arguments, you can use variables described above.

Timeout (seconds) - Set a timeout in seconds; 0 means no limit.

Terminate program on timeout - Enable this option to have RdpGuard attempt to stop the program when the timeout expires. Otherwise, RdpGuard logs the timeout and waits for the program to exit.

Up to 8 programs can run at once. Other custom actions use a separate queue, so slow programs do not hold up notifications.

Report to AbuseIPDB

Report blocked IP addresses to AbuseIPDB. This action is available only for the IP Blocked event.

The following configuration fields are available:

API key - enter your AbuseIPDB API key

Send Telegram Message

This custom action allows you to send a message to a Telegram chat or channel.

The following configuration fields are available:

• Bot Token - enter your Telegram Bot Token
• Chat - Select your Telegram Chat or Channel from the drop-down list
• Message - enter the message you would like to send, you can use variables.

Please follow the instructions to create a Telegram Bot and get the Bot Token.

To make a chat appear in the drop-down list, start a chat with the bot, then click Get chats.

1. Click Tools, Custom Actions/Notifications

   

   The Custom Actions dialog will open:

   

2. Click Add (or press Ins)

   The Add New Custom Action dialog will open:

   

3. Select the Event:

4. Select the Task.

5. Configure Custom Action

6. Click Add action, then click Save changes in the Custom Actions dialog.

1. Click Tools, Custom Actions/Notifications

   

   The Custom Actions dialog will open:

   

2. Select Custom Action you would like to edit and click Edit (or press F2)

   The Edit Custom Action dialog will open:

   

3. Edit Custom Action parameters

4. Click Save changes in the editor, then again in the Custom Actions dialog.

To temporarily disable an action, clear its checkbox in the table and click Save changes.

1. Click Tools, Custom Actions/Notifications

   

   The Custom Actions dialog will open:

   

2. Select custom actions you would like to delete and click Delete (or press Del)

3. Click Save changes in the Custom Actions dialog.

The Failed Login and User Logged In events have additional settings.

Failed Login

Use Failed Login to receive a notification or run a script when RdpGuard detects a failed login, without waiting for the IP address to reach the blocking threshold.

Add a custom action, choose Failed Login in the event list and click Configure... beside it.

The Event settings dialog opens:

Protocols: Choose All protocols (the default) or Selected protocols and select the protocols to include. Only enabled protection modules generate events; their detection exclusions still apply.

Include other detected threats - Enable this option to include HTTP scans, SMTP spam or relay attempts, SQL probes and other detections in addition to failed logins.

Ignore attempts from whitelisted IP addresses - Enable this option to skip attempts from addresses on your whitelist. It is off by default, so you can receive alerts for whitelisted addresses too.

Exclusion rules: Enter one exclusion rule per line. For example, TargetUserName=backup-service skips attempts for that account. Rules can use IpAddress, TargetUserName, TargetDomainName and Protocol. If any rule matches, this action is skipped; blocking rules are unchanged. See the exclusion rules syntax.

Limit repeated notifications - Enable this option and choose an interval in seconds or minutes. The first matching attempt triggers the action immediately; further attempts from the same IP address on the same protocol are suppressed for that interval. The limit applies separately to each action. With this option off, every matching attempt triggers the action.

Click Save changes, configure the notification or script, then save the action and the Custom Actions list. Messages can include %IP%, %USER%, %PROTOCOL% and %HOSTNAME%.

User Logged In

To configure successful-login notifications, add a custom action, choose User Logged In and click Configure... beside the event list.

The Exclusion rules for successful logins dialog will open:

Here exclusions for Successful Logins can be configured, please refer to the Exclusion Rules Syntax for more details about the rules syntax.