Gradually compiling a list of services on our network(I can’t whitelist), but I don’t want to see workstations that have been eliminated by the ‘and it does not contain’ statements, I’ve got a TON of blanks where the only services they have are the ones I’ve eliminated(benign).
What I’m looking for is where to put the ‘if exists’ statement. In other words, if all the services on the computer match the ones I have listed in my ‘and it does not contain’ then I don’t care about that workstation and don’t need to see it listed. Does that make sense?
(name of it & " - " & concatenation “, " of (preceding texts of lasts " (” of it) of values whose
(it does not contain "ASP.NET State Service"
and it does not contain "Active Directory Domain Services"
and it does not contain "Active Directory Web Services"
and it does not contain "ActivIdentity Shared Store Service"
and it does not contain “Workstation”)
of results from (bes property “Services - Windows”) of it)
of bes computers whose (exists results from (bes property “Services - Windows”) of it)
I’m not in front of a presentation debugger now, but you might try filtering further on entire result, as in
(
(name of it & " - " & concatenation “, " of (preceding texts of lasts " (” of it) of values whose
(it does not contain "ASP.NET State Service"
and it does not contain "Active Directory Domain Services"
and it does not contain "Active Directory Web Services"
and it does not contain "ActivIdentity Shared Store Service"
and it does not contain “Workstation”)
of results from (bes property “Services - Windows”) of it)
of bes computers whose (exists results from (bes property “Services - Windows”) of it)
)
whose (following text of first " - " of it as trimmed string != “”)
Thanks for the response Jason, I tried below and it didn’t seem to want to work, expression could not be parsed.
<?Relevance ((name of it & " - " & concatenation ", " of (preceding texts of lasts " (" of it) of values whose
(it does not contain "ASP.NET State Service"
and it does not contain "Active Directory Domain Services"
and it does not contain "Active Directory Web Services"
and it does not contain "ZeroConfigService"
and it does not contain "ZCfgSvc")
of results from (bes property "Services - Windows") of it)
of bes computers whose (exists results from (bes property "Services - Windows") of it)
whose (following text of first " - " of it as trimmed string != "")?>
I tried my version and it seems to work in the Presentation Debugger. I see a parentheses problem in yours, assuming it’s not a copy / paste error. You’re missing the second close parenthesis after
of bes computers whose (exists results from (bes property “Services - Windows”) of it)
The whose (following text of first " - " of it as trimmed string != “”) refers to the entire result of what comes before, including the name of it & " - " & concatenation ", "