Can the BigFix REST API retrieve the "Time of Last Scan Attempt"?

[marktagiw]

Hi there

I’m writing an internal tool and need to check the “Time of Last Scan Attempt” field for all computers that are monitored by BigFix however the API does not appear to expose this field.

Sending a GET request to <BigFix host & port>/api/computer/?fields=Property<Name=Computer%20Name> works fine.

However, this request does not work: <BigFix host & port>/api/computer/?fields=Property<Name=Time%20of%20Last%20Scan%20Attempt>.

Is this field actually exposed by the API? What am I missing?

Thanks in advance

[Aram]

Hello!

If you are looking to return a field/property value across all computers (or even a large number of them), it is more efficient to leverage the /api/query method, and pass it some session relevance. Here is a sample session relevance query to return the Computer ID, Name, and Time of Last Scan Attempt across all computers/endpoints in one API call:

(id of it, name of it, value of result from (bes property "Time of Last Scan Attempt") of it | "n/a") of bes computers

Passing this as a url-encoded parameter named ‘relevance’ here is a sample GET request (which will return XML):

https://<BigFix host:port>/api/query?relevance=%28id%20of%20it%2C%20name%20of%20it%2C%20value%20of%20result%20from%20%28bes%20property%20%22Time%20of%20Last%20Scan%20Attempt%22%29%20of%20it%20%7C%20%22n%2Fa%22%29%20of%20bes%20computers

We can also specify output=json if you prefer a JSON result:

https://<BigFix host:port>/api/query?output=json&relevance=%28id%20of%20it%2C%20name%20of%20it%2C%20value%20of%20result%20from%20%28bes%20property%20%22Time%20of%20Last%20Scan%20Attempt%22%29%20of%20it%20%7C%20%22n%2Fa%22%29%20of%20bes%20computers

[marktagiw]

Hi Aram

Thank you very much for that informative reply! I just tried your sample GET request and it has provided exactly the data I need.

[marktagiw]

Hi Aram

Is it possible to add some additional metadata so query so that response is easier to parse programmatically?

ie this is not a very useful response structure unless the order is guaranteed and doesn’t change between BigFix versions.

<Answer type="string">9.2.21.0000</Answer>
<Answer type="string">10.0.1.41</Answer>

A response structure that looks like either of these would be what I’m looking for:

<Tuple>
<Answer type="Scanner Version">9.2.21.0000</Answer>
<Answer type="string" foo="Agent Version>10.0.1.41</Answer>
</Tuple>

<Tuple>
<ScannerVersion>9.2.21.0000</ScannerVersion>
<AgentVersion>10.0.1.41</AgentVersion>
</Tuple>

[Aram]

So, actually, the order of the response here is in fact guaranteed, and should not change between versions of BigFix. The order of the fields is based on the session relevance query itself, and the fact that it returns a tuple.

That said, you can adjust the output of the query to for instance include field names and concatenate the results into a single row (with definable delimiters) with something like:

(item 0 of it as string & "||" & item 1 of it as string & "||" & item 2 of it as string) of (id of it, name of it, value of result from (bes property "Time of Last Scan Attempt") of it | "n/a") of bes computers

or

("ID:" & item 0 of it as string & "||" & "Name:" & item 1 of it as string & "||" & "LastScanAttempt:" & item 2 of it as string) of (id of it, name of it, value of result from (bes property "Time of Last Scan Attempt") of it | "n/a") of bes computers

[marktagiw]

Awesome, thanks for the help!