I am working with the airgap tool in order to update the fixlet metadata in our bigfix console, and download relevant updates to import into my airgapped bigfix server.
The issue I am running into is gathering contents and downloading the associated files from all of those patch URL’s is about 500GB for just one site, enterprise security, and that’s only going back 200 days.
I would love to hear your thoughts on filtering down only relevant patch urls so that the update files are easier to manage and less storage required.
My thoughts are to import the generated airgap response file, then figure out only which fixlets are actually relevant to any clients in my console, throw those URL’s into a text file in order to download them with the airgap tool.
This would be a nice enhancement to the airgap tool (to support this scenario more easily/natively), but as you note, the Airgap tool can take as input a file containing a list of download URLs. One way to generate such a file is to take the output of a session relevance query such as the one below (which can of course be adjusted for your specific requirements):
unique values whose (it as lowercase does not contain "manual_bes_caching_required") of ((matches (case insensitive regex "(http|https|ftp|protocol)://\S*") of matches (case insensitive regex "^(download|prefetch).*$") of scripts whose (it contains "download" or it contains "prefetch") of it ) of actions of it) of bes fixlets whose (display name of site of it = ("Patches for Windows") AND exists applicable computers of it and (Fixlet flag of it or baseline flag of it or task flag of it) AND exists actions whose ( exists script of it) of it)
This particular example returns download urls for applicable content in the ‘Patches for Windows’ site.