Is it possible to create Analyses to pull all content from a CSV file on a target endpoint?

Content Authoring
1

Hi,

Is it possible to create Analyses to pull all content from a CSV file stored locally on a target endpoint? Then report on it…
Similar to the relevance for ‘lines of file’.

Scenario
Our company looks after several external businesses. Monthly scheduled tasks run to create a report (csv) of all the privileged users that exist in their AD environments. This is then emailed outbound to a number of recipients. We want to find an alternative method as this is a little archaic plus insecure and a pain to keep having to open up SMTP etc

So, we tried using BigFix’s Upload Archive Manager to try and retrieve the CSV files from the customers Relay servers and bring them inbound to our central BigFix servers. This kinda worked although our app support guys didnt like these being stored on our root servers :frowning:

Thus, I was thinking, could it be possible to setup an Analyses for this and use relevance similar to ‘line of file’ that pulls data from the csv file so we can report on it. I am fairly new to BigFix and not familiar with writing relevance so would greatly appreciate any help.

Example of CSV contents attached

Group Name Display Name First Name Last Name Username Description Last logon date Enabled Password never expires Date created
Administrators NTAdmin NTAdmin Built-in account for administering the computer/domain 22/12/2021 8:05:01 a.m. TRUE TRUE 29/06/2003 11:22:24 a.m.
Administrators Translogix Translogix Translogix 16/06/2020 9:14:31 a.m. TRUE TRUE 8/08/2012 10:00:41 a.m.
Administrators SCOM_MSA SCOM SCOM_MSA SCOM gateway account 23/12/2021 12:07:22 p.m. TRUE TRUE 14/10/2014 8:14:26 a.m.
Administrators BackupExec BackupExec BackupExec TRUE TRUE 19/12/2009 8:34:46 a.m.
Administrators Joe Bloggs Joe Bloggs a-JoeB Project Consultant 30/11/2021 3:04:28 p.m. TRUE FALSE 24/11/2021 1:30:13 p.m.
Domain Admins NTAdmin NTAdmin Built-in account for administering the computer/domain 22/12/2021 8:05:01 a.m. TRUE TRUE 29/06/2003 11:22:24 a.m.
Domain Admins MTS package User account MTSUser TRUE TRUE 29/06/2003 11:22:24 a.m.
Schema Admins Jane Doe Jane Doe a-JaneD SMG 27/11/2021 7:11:02 p.m. TRUE FALSE 11/04/2013 10:56:28 a.m.
Schema Admins AdminTest AdminTest Projects Consultant 18/10/2018 12:32:41 p.m. FALSE TRUE 11/04/2013 10:45:56 a.m.
Enterprise Admins Alvin Chipmunk Alvin Chipmunk admalvin SMG 27/11/2021 7:11:02 p.m. TRUE FALSE 11/04/2013 10:56:28 a.m.
Enterprise Admins Exchange Service Exchange Service exservice Exchange 2003 Service Account TRUE TRUE 19/04/2006 3:32:30 p.m.
Account Operators actionline FALSE TRUE 29/06/2003 11:22:25 a.m.
Backup Operators BackupExec BackupExec BackupExec TRUE TRUE 19/12/2009 8:34:46 a.m.
Backup Operators NTAdmin NTAdmin Built-in account for administering the computer/domain 22/12/2021 8:05:01 a.m. TRUE TRUE 29/06/2003 11:22:24 a.m.

3

It would be a lot easier to pull the data from the CI into BigFix and use it within an analysis in honesty.

There’s an absolute heap of examples on https://bigfix.me

Get Administrators

if ((it contains "Win") of (name of operating system)) then ((concatenation of (it as string & ":") of members of local group "Administrators")) as string else (preceding text of first ":" of lines whose (it as string as lowercase contains "root") of file "/etc/group")

Get Power Users

if ((it contains "Win") of (name of operating system)) then (if (value "ProductType" of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions" of registry != "LanmanNT") then (members of local group "Power Users" as string) else nothing) else nothing

Detailed User Accounts

if ((it contains "Win") of (name of operating system)) then (if (value "ProductType" of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions" of registry != "LanmanNT") then ((name of it as string & "|" & admin privilege of it as string & "|" & account disabled flag of it as string & "|" & no password required flag of it as string & "|" & locked out flag of it as string & "|" & (last logon of it as string|"NA") & "|" & ((now - password age of it) as string|"NA")) of local users) as string else nothing) else if (name of operating system as lowercase does not contain "win") then (preceding texts of firsts ":" of lines whose (it as string as lowercase does not contain "nologin") of file "/etc/passwd") else nothing

There are probably more and way more modern ways of doing this but it works for us.

4

If I got your goal correct it is possible to read a .csv file and import the lines into properties and group this properties to an analyse.

You might need to separate your values like listed below or try to work with tuples. After you’ve the properties you can create reports in webreports.

    if name of operating system as lowercase contains "win" then 
if exists file "example.csv" then
if exists lines whose (it starts with "key1") of file "example.csv" then
concatenation "" of substrings separated by "," of following text of first "=" of lines whose (it starts with "key1") of file "example.csv"
else "<line in example file missing>"
else "<example file not found>" else "<not relevant>"
5

Thanks for the reply, much appreciated

6

Thanks for the reply, much appreciated. Not sure BigFix will help me in this situation so will look for alternatives.