Anyone have or can think of a clever way to detect duplication when it comes to analysis variables?
Interesting problem. I just came up with something, see whether this Session Relevance helps
unique values /* 'unique values' is used here to sort the string results */
of (
/* build list of 'propertyname : analysisname : sitename' for the duplicate properties */
name of item 0 of it
& " : " & (name of source analysis of item 0 of it | "Global")
& " : " & (name of site of source analysis of item 0 of it | "Global")
) of
( elements of item 0 of it /* bes property */
, item 1 of it /* set of duplicated property names */
) whose (name of item 0 of it is contained by item 1 of it) /* filter to properties with names contained by duplicated names */
of
(
it /* set of all properties */
, set of (unique values whose (multiplicity of it > 1) of names of elements of it) /* set of duplicated property names*/
) of
set of bes properties
Sample results:
26190899-1602-49e8-8b27-eb1d0a1ce869 : Measured values - (L1) Ensure 'Configure Attack Surface Reduction rules: Set the state for each ASR rule' is configured : CIS Checklist for Windows 10
26190899-1602-49e8-8b27-eb1d0a1ce869 : Measured values - (L1) Ensure 'Configure Attack Surface Reduction rules: Set the state for each ASR rule' is configured : CIS Checklist for Windows 11
26190899-1602-49e8-8b27-eb1d0a1ce869 : Measured values - (L1) Ensure 'Configure Attack Surface Reduction rules: Set the state for each ASR rule' is configured : CIS Checklist for Windows 2022 DC
26190899-1602-49e8-8b27-eb1d0a1ce869 : Measured values - (L1) Ensure 'Configure Attack Surface Reduction rules: Set the state for each ASR rule' is configured : CIS Checklist for Windows 2022 MS
26190899-1602-49e8-8b27-eb1d0a1ce869 : Measured values - (L1) Ensure 'Configure Attack Surface Reduction rules: Set the state for each ASR rule' is configured : CIS Checklist for Windows Server 2019 DC
26190899-1602-49e8-8b27-eb1d0a1ce869 : Measured values - (L1) Ensure 'Configure Attack Surface Reduction rules: Set the state for each ASR rule' is configured : CIS Checklist for Windows Server 2019 MS
26190899-1602-49e8-8b27-eb1d0a1ce869 : Measured values - (L1) Ensure 'Configure Attack Surface Reduction rules: Set the state for each ASR rule' is configured : CIS_Win2022_MS
3b576869-a4ec-4529-8536-b80a7769e899 : Measured values - (L1) Ensure 'Configure Attack Surface Reduction rules: Set the state for each ASR rule' is configured : CIS Checklist for Windows 10
3b576869-a4ec-4529-8536-b80a7769e899 : Measured values - (L1) Ensure 'Configure Attack Surface Reduction rules: Set the state for each ASR rule' is configured : CIS Checklist for Windows 11
It’s normal to have duplicated property names, so don’t assume that every duplicate property name is a bad thing. For instance I use the Compliance checklist content heavily, and all of my custom checklists have analysis properties that duplicate the names of the source checklist analysis properties.
One way that may be useful in filtering is finding only the custom properties that are duplicated. We can do this by using
unique values /* 'unique values' is used here to sort the string results */
of (
/* build list of 'propertyname : analysisname : sitename' for the duplicate properties */
name of item 0 of it
& " : " & (name of source analysis of item 0 of it | "Global")
& " : " & (name of site of source analysis of item 0 of it | "Global")
) of
( elements whose (custom flag of it) of item 0 of it /* only the custom bes properties */
, item 1 of it /* set of duplicated property names */
) whose (name of item 0 of it is contained by item 1 of it) /* filter to properties with names contained by duplicated names */
of
(
it /* set of all properties */
, set of (unique values whose (multiplicity of it > 1) of names of elements of it) /* set of duplicated property names*/
) of
set of bes properties
Sample result:
In Maintenance Window : Global : Global
In this case, we see only the ‘custom’ properties that have duplicate names, but we may not see an out-of-box property that it duplicates; for instance I get just the one result for my global/custom ‘In Maintenance Window’ property, but I don’t see that the thing it duplicates is the out-of-box Maintenance Window Analysis from BES Support.
1 Like
The property name can be duped (not sure why you would this) and point to different things, it’s grabbing the same values with relevance that is potential for removal.
Ah, ok, that’s a little bit trickier but still doable. I pull the ‘definition of bes property’ to retrieve the relevance and then check for duplicate relevance statements.
In the end I still sort by property name, but if you export this to a spreadsheet or rearrange the columns you can sort by whatever fields are needed.
unique values /* 'unique values' is used here to sort the string results */
of (
/* build list of 'propertyname : analysisname : sitename' for the duplicate properties */
name of item 0 of it
& " | " & (name of source analysis of item 0 of it | "Global")
& " | " & (name of site of source analysis of item 0 of it | "Global")
& " | " & definition of item 0 of it /* relevance of the property */
) of
( elements of item 0 of it /* bes property */
, item 1 of it /* set of duplicated relevance definitions */
) whose (definition of item 0 of it is contained by item 1 of it) /* filter to properties with names contained by duplicated definition/relevance */
of
(
it /* set of all properties */
, set of (unique values whose (multiplicity of it > 1) of definitions of elements of it) /* set of duplicated property relevance definitions */
) of
set of bes propertiesYou are a BF rock star. Small issue, if the query contains a vertical bar, you get extra columns in Excel when you ask Excel to do a data to columns based on a character. Just need to change the separator to some off the wall thing right?
Yes,.just change the separator to any value you need.
The tab character is “probably” safe, represent it as "%09"
Weird, I used percent zero nine and didn’t get any tabs.
<?Relevance unique values /* 'unique values' is used here to sort the string results */ of ( /* build list of 'propertyname : analysisname : sitename' for the duplicate properties */ name of item 0 of it & "%09" & (name of source analysis of item 0 of it | "Global") & "%09" & (name of site of source analysis of item 0 of it | "Global") & "%09" & definition of item 0 of it /* relevance of the property */ ) of ( elements of item 0 of it /* bes property */ , item 1 of it /* set of duplicated relevance definitions */ ) whose (definition of item 0 of it is contained by item 1 of it) /* filter to properties with names contained by duplicated definition/relevance */ of ( it /* set of all properties */ , set of (unique values whose (multiplicity of it > 1) of definitions of elements of it) /* set of duplicated property relevance definitions */ ) of set of bes properties ?>Any clues?
If this is in a Web Report, tabs will just render as spaces (since it’s HTML output). Copying & pasting that into a text file should preserve the tabs…I think?
Otherwise you could make that relevance the ‘value’ of a <textarea> field, or use some other printable (in HTML) character as the delimiter
I ended up using a back tick character and yes, I was using WR.
1 Like