BFI console application not displaying

Reporting
1

Hi,

I am using BFI v9.2.15 and here some of the application is not displaying properly, but the same information is showing in Bigfix Console “Installed Application” analysis/property (BFI site v9),

What could be the issue for this case and waiting for some response from all,

Thanks,
Nagaraj,

2

Please provide examples of reports, and screenshots, to illustrate the issue you are having.

3

I have added 2 snip for referance.

  1. BFI snip (Bigfix console I am able to see the application tripwire in “Installed application” property)
  2. BFI web consle snip (BFI web console is not showing the tripwire application and other some apps also)

bfi
bfi714×391 53 KB
BFI web console
BFI web console894×396 90.8 KB

4

That implies the product is not included in the BFI catalog. You can open a support ticket or RFE to ask the team to add it, but the quickest solution would be to create a custom catalog entry for it in BFI.

You should see be able to create a signature in the “Packages” area.

1 Like
5

Thanks @Nagaraj. This type of post makes it much easier for others in the community to help you out.

@JasonWalker is correct. Just because you can see it installed on a machine, doesn’t mean it is part of the Software Catalog from HCL.

A cursory search of the Software Catalog shows 50 entries for Tripwire Enterprise. Looking into the Software Products & Metric report finds three versions of the Tripwire Enterprise Agent, with version 8 being the newest.

There are 10 signatures for this version or it’s descendants, 6 of these are for UNIX - version 8.0 to 8.5.

I cannot see what version you have in the computer report, but a reasonable possibility is that you are running a version newer than 8.5.

The signature for version 8.5 on UNIX is:

<MultipleInstance><Iterator name="INSTALL_PATH" export="true"><Vector filter="*agent?bin?" ignoreCase="true"><FindFilePathEx name="twdaemon"/></Vector></Iterator><Instance><Variable name="IS_INSTALLED"><PackageInfoMatch vendor="Tripwire*" name="TWeagent" version="8.5*"/></Variable><Condition withVariable="IS_INSTALLED"><Action onValue="false" do="SKIP"/></Condition></Instance></MultipleInstance>

The scanner is looking for the presence of twdaemon and an RPM package from vendor whose name starts with Tripwire, called TWeagent, with a version that starts with 8.5.

Having found the signature, you can go to the machine to investigate how it was installed and see where the disconnect comes from.

6

I can see the application version (tripwire) is 7.1 in the endpoint analysis, even the same version available in our catalog signature in BFI,

But the same application is showing in “package date” reports in BFI web console,

BFI TW
BFI TW1252×508 121 KB
BFI TW2
BFI TW21266×391 39.2 KB

7

I suggest that you open a case with HCL. It appears that the catalog should at minimum be detecting the Windows version 7.1 of the Tripwire Enterprise agent in your environment.

8

any link or process to open the case with HCL please help me here

9

https://hclpnpsupport.service-now.com/csm/?id=bigfix_support

1 Like
10

This is what the signature for 7.1 for Windows looks for. You should be having a package named TWeagent and file named wrapper.exe for detection to happen.

<MultipleInstance><Iterator name="INSTALL_PATH" export="true" ><Vector filter="*bin?"><FindFilePathEx name="wrapper.exe"/></Vector></Iterator><Instance><Variable name="IS_INSTALLED"><PackageInfoMatch vendor="Tripwire*" name="TWeagent" version="7.1*" /></Variable><Condition withVariable="IS_INSTALLED"><Action onValue="false" do="SKIP"/></Condition></Instance></MultipleInstance>
1 Like