Locate fixtets with "string" in Actions

[IanDM]

I have some team members now looking to learn and contribute to the content creation and I would like to provide this to them in order to find existing code in the actions for reference or re-use.

Similar to the query in this post, Windows event viewer id 1035, to find strings in relevance clauses, I am trying to create a query to locate fixlets, custom or otherwise, with a given string in the actions.

I’ve not been able to find the bit of code I need, is this covered in another post I can’t find or in some documentation?

[brolly33]

@IanDM welcome.

I am not 100% sure what you are trying to query. Perhaps you are looking to query all BES Fixlet objects for their relevance, to look for a specific string inside of the relevances?

https://developer.bigfix.com/relevance/reference/bes-fixlet.html#relevance-of-bes-fixlet-string

[IanDM]

The query below will find fixlets with “wmi” in the relevance clauses.

Q: (id of it, name of it, name of site of it) of fixlets whose (exists relevance clauses whose (it as lowercase contains "wmi") of it) of all bes sites

How can I find fixlets with “wmi” in the action. Replacing relevance clauses with action, or actions or actions of it does not do it.

Q: (id of it, name of it, name of site of it) of fixlets whose (exists actions whose (it as lowercase contains "wmi") of it) of all bes sites
E: The operator "lowercase" is not defined.

Session Relevance and Query are something I need more time and work with to get a handle on!

[brolly33]

@IanDM Thanks for sharing your working query. It helped me to understand what you were after.

You need to drill down from the Fixlet to the Fixlet Action and then to the Script.
https://developer.bigfix.com/relevance/reference/bes-fixlet-action.html

Try this:

(id of it, name of it, name of site of it) of fixlets whose (exists scripts whose (it as lowercase contains "wmi") of actions of it) of all bes sites

You could see the full action scripts as well by adding that into your front clause, but your result is very long then.

(id of it, name of it, name of site of it, scripts of actions of it) of fixlets whose (exists scripts whose (it as lowercase contains "wmi") of actions of it) of all bes sites

[IanDM]

(id of it, name of it, name of site of it, scripts of actions of it) of fixlets whose (exists scripts whose (it as lowercase contains “wmi”) of actions of it) of all bes sites

Thank you very much for the help. That is exactly what I was looking for.
Sometimes the layers to drill into go deeper than expected and somehow I wasn’t catching scripts were inside actions.