Add custom Property to relevance query

Hi.

I’m new to this forum and new to using curl and the REST API. from searching this site I was able to find the following examples:

#1. /api/queryrelevance="(names+of+it,+ids+of+it,+last+report+time+of+it,+operating+systems+of+it,+ip+addresses+of+it,agent+versions+of+it)+of+bes+computers" - works for what I’m trying to accomplish

and

#2. number of computers of results whose (exists values whose (it contains “IBM”) of it) of BES Property “_SupportGroup” - I was able to get results in the presentation debugger but not exactly what I’m looking for. What I’m trying to do is combine a query of the value of this property for all bes computers and combine it with the query above query #1.

Also I am limited in what tools I can install and use in my environment because of stringent security polices. I have use of the presentation debugger but cannot install and use tools like the relevance tester. If someone can point me in the right direction on how and If I could use the presentation debugger or any other useful tools and documentation to eventually write my own relevance queries I would be eternally grateful!

Best Regards,

Tony

Hello!

If I’m understanding correctly, the following session relevance statement should return all the fields from query #1, and filter the results to those machines that contain ‘IBM’ within the _SupportGroup Property:

(names of it, ids of it, last report time of it, operating systems of it, ip addresses of it, agent versions of it) of bes computers whose (value of result from (BES Property "_SupportGroup") of it contains "IBM")

You can also add the value of another property to this query as an additional field that is returned (sample property called ‘test’):

(names of it, ids of it, last report time of it, operating systems of it, ip addresses of it, agent versions of it, values of results from (BES Property "test") of it) of bes computers whose (value of result from (BES Property "_SupportGroup") of it contains "IBM")

As to tools, I myself generally use the Console’s presentation debugger, or the QNA Page in Web Reports (https://developer.bigfix.com/tools/qna_wr.html) to build session relevance queries. I’m not sure if you’ll be able to install it, but the Excel Connector (https://developer.bigfix.com/tools/excel_connector.html) also comes in handy sometimes.

Regarding reference/documentation, I’d suggest the following link if you haven’t seen it already: https://developer.bigfix.com/relevance/guide/session/. There’s also good material on the Security Learning Academy under ‘BigFix Content Development’: https://www.securitylearningacademy.com/local/navigator/index.php?level=emcd01&roadmaps=true

2 Likes

I’d also reference this blog from @brolly33 on retrieving multiple computer properties in an efficient, repeatable way https://www.ibm.com/developerworks/community/blogs/e9d21113-aa93-467e-ac77-a0d20a21eaec/entry/Session_Relevance_Computer_Properties_query_Efficiency

1 Like

Hi Aram!

Thanks for the code and the learning links. The code example works as advertised in the presentation debugger but I’m at a loss when trying to wrap the code in quotes to be used with the curl command.
I’ve tried the following but it’s not working:

curl -X GET --insecure --user user:password https://bfhost.domain.com:56431/api/query?"relevance=(name of it, values of results (it, bes property “Computer Name”), values of results (it, bes property “IP Address”)" of bes computers

Regards,

Tony

Thank Jason, awesome work by brolly!

1 Like

Oh! Your problem then is that you have to URL-encode the query in order to pass it (as a browser would in the navigation bar).

I believe curl has an option to pull the query from a file rather than in the URL, so you could avoid URL-encoding. I don’t have that syntax handy but it’s worth looking into.

For once-in-a-while encodings you can use https://urlencoder.org . Pasting in just the query,
(names of it, ids of it, last report time of it, operating systems of it, ip addresses of it, agent versions of it, values of results from (BES Property "test") of it) of bes computers whose (value of result from (BES Property "64-bit CPU") of it contains "IBM")
we get the result
%28names%20of%20it%2C%20ids%20of%20it%2C%20last%20report%20time%20of%20it%2C%20operating%20systems%20of%20it%2C%20ip%20addresses%20of%20it%2C%20agent%20versions%20of%20it%2C%20values%20of%20results%20from%20%28BES%20Property%20%22test%22%29%20of%20it%29%20of%20bes%20computers%20whose%20%28value%20of%20result%20from%20%28BES%20Property%20%2264-bit%20CPU%22%29%20of%20it%20contains%20%22IBM%22%29

So you can paste that in to the curl command as
curl -X GET --insecure --user user:password https://bfhost.domain.com:56431/api/query?relevance=%28names%20of%20it%2C%20ids%20of%20it%2C%20last%20report%20time%20of%20it%2C%20operating%20systems%20of%20it%2C%20ip%20addresses%20of%20it%2C%20agent%20versions%20of%20it%2C%20values%20of%20results%20from%20%28BES%20Property%20%22test%22%29%20of%20it%29%20of%20bes%20computers%20whose%20%28value%20of%20result%20from%20%28BES%20Property%20%2264-bit%20CPU%22%29%20of%20it%20contains%20%22IBM%22%29

If you’re going to do this frequently, I suggest using a REST client IDE. Insomnia is one such that is GPL and available at https://insomnia.rest/

2 Likes

Thanks so much Jason, exactly what I was looking for!

Is there a way to modify the following query to run against a single computer by short name?
I have some computers in my environment that also have fqdn names.

Maybe something like this?

(names of it, ip addresses of it, root server of it, operating systems of it, last report time of it, agent versions of it, values of results from (BES Property “SupportGroup”) of it) of bes computer whose computer name starts with “Servername1”

This way if the actual computer name is Servername1.domain.com the query will still return the name.

Thanks,

Tony

Try

of bes computers whose ( name of it as lowercase starts with “servername1”)

(names of it, ip addresses of it, root server of it, operating systems of it, last report time of it, agent versions of it, values of results from (BES Property “_SupportGroup”) of it) of bes computers whose ( name of it as lowercase starts with “servername1”)

Getting the following error in the presentation debugger:

Error: This expression contained a character which is not allowed. I seems to not like the quotes around the server name.

Delete and retype the quotes. Sometimes on copy/paste the get replaced with a font-specific “pretty” quote.

Actually just figured it out. It works like this:

(names of it, ip addresses of it, root server of it, operating systems of it, last report time of it, agent versions of it, values of results from (BES Property “_SupportGroup”) of it) of bes computers whose ( name of it as lowercase starts with (“servername1”))

Cheers!

That did the trick, thanks Jason!

Glad I could help!
If you have a larger set of computers, or want to retrieve multiple properties, the query efficiency is going to be a lot more important and it’d definitely be worth visiting Brolly33’s blog I referenced earlier. He has constructs there that dramatically improve the performance on property value lookups.

Hi Jason,

Do you know from off the top of your head if when searching for computer names the computer name has to be in lower case of is there code to find the computer name regardless of case?

bes computers whose
( name of it as lowercase = “computer1”
)

Regards,

No, casting “computer name as lowercase” changes the original computer to lowercase. As long as your search term is also lowercase that ensures a match.

If you are taking user input from a form or want to be sure in case you forget to enter the search term correctly, you can cast that as well…
computer name as lowercase = "MyWeirDMixedCase" as lowercase should also match.

Thanks again for your help Jason.