Is there a way to make an analysis only evaluate once?
When creating an analysis, the evaluation cycle can only be set to a max of 30 days.
We have a fixlet that creates a file on the client device containing the bitlocker encryption key, we read this key with an analysis.
Due to security audits, this file cannot be kept on the client. We want to read this key once with an analysis and delete the file afterwards while the key remains in the analysis results.
Throwing this one out for consideration & comment from the community:
Have the analysis be relevant when the key file is present on the system and not-relevant when the file is not there.
The reported value would remain in the database but the computer will no longer report because the analysis is not-relevant.
What about generating the file, archiving it to the BigFix server, and then after that deleting on the system?
You’ll have a copy of it somewhere other than the client.
I think it may be possible to store the bitlocker encryption key on the endpoints encrypted in such a way that only the root can decrypt it.
It would definitely be possible to encrypt the bitlocker encryption key with a public key in which the private key is not stored anywhere in the BigFix system, grab the data using an analysis, and then decrypt that value only when needed using the private key.