This is just feedback in case others have seen this and is in regards to creating an Analysis that uses Relevance. In other words, the Analysis is targeting something specific. The example below is one, but we’ve seen this when doing this with other Analysis.
In this example, we have a single Property (evaluated every report) Analysis that returns the version of the Palo Alto GlobalProtect VPN service, PanGPS.
The relevance of the Analysis itself originally was simply:
exists service "PanGPS"
The Property was
version of service "PanGPS"
We found were a percentage of systems would return < error >, a sure sign that it was evaluating the Property before the Relevance of the Analysis itself. In addition, data would remain static, because it would no longer evaluate the Property, because the endpoint was no longer relevant to the Analysis.
This scenario should be easily reproduced. My thought is that the priority or order of relevance is not being honored.
I’ve since change the Relevace to a more general
name of operating system contains "Win" and the Property to
if exists service "PanGPS" then version of service "PanGPS" as string else "Not Installed"
After the change, the results started to correct themselves. This all being said, perhaps a “Best Practice” would not to be too restrictive on targeting with regards to an Analysis.