Patch details report

(imported topic written by chass91)

I need a report that show the list of patches that is sent out to the computers, also stating the result whether is the patch successful.

result to be :

Computer Name Name Source Category Source Release Date Action Status Result Description

Comp 1 MS06-036: Vulnerability Microsoft Security Hotfix Wed, 23 Jul 2003 Patched/Not Patch Reason of why

in DHCP Client Service or Passed/Failed the process of

Could Allow Remote Code the patched is

Execution - Windows XP failed or not complete

SP1/SP2

How should i go about doing it? :confused:

Thanks

(imported comment written by chass91)

i’m looking at this. pls help me if i’m going on the right track. else what are the right object should i use?

how can i relate it to other object to get the rest of the values? like linking it to bes fixlet?

(trs of

(

td of (id of action of it as string) &

td of (name of action of it as string) &

td of name of computer of it &

td of (status of it as string ) ) )

of results

of bes actions

thanks if anyone can help.

i’m really loss and stuck…

(imported comment written by BenKus)

Hi chass,

You came very close. Good work. Try this:

<?relevance (trs of ( td of name of computer of it & td of (name of action of it as string) & td of (if (exists source of source fixlet of action of it) then source of source fixlet of action of it else "n/a") & td of (if (exists category of source fixlet of action of it) then category of source fixlet of action of it else "n/a" ) & td of (if (exists source release date of source fixlet of action of it) then source release date of source fixlet of action of it as string else "n/a") & td of (id of action of it as string) & td of (status of it as string ) ) ) of results of bes actions whose (exist source fixlet of it) ?>

Note that the last column isn’t stored in the Web Reports “session” so it isn’t possible to get this information in this report. Also, only actions with a “Source Fixlet” will show up in this report.

Note that this isn’t a small report either… Depending on how many actions/computers you have, it will be quite a huge report. You might want to filter it before running it.

Ben

Computer Name Action Name Source Category Source Release Date Action ID Status

(imported comment written by chass91)

Hi Ben,

Thanks for the Help =)

I want to also add the patches that is recommended to the computer but not implement yet and filter the patch to

microsoft

source only.

I also trying if i can write a new statement

Using bes fixlet for this instate, but i get errors. i am not sure how can i write it correctly.

(trs of(

td of (name of it) )) of bes fixlets (fixlet flag of it = true) AND whose (exist results (bes property “first became relevant”, it) whose (value of it > now - 6*month))

thanks if you can help. i just cant solve it. =(

(imported comment written by BenKus)

Hey Chass,

The easiest thing to do will be to use the built-in Web Reports filter. (Top left corner of Web Reports).

Ben

(imported comment written by chass91)

Hi Ben,

I have tried the filter. but it is not what i want.

is it possible to have a simple report in a glance to show the computer name, patched patches and the recommended patches that is not patched.

only show microsoft source and for the past 6 months.

Pls… help. Thanks a million…

(imported comment written by BenKus)

Alright chass… Sorry I misread your requirements before…

How about this:

<?relevance (trs of ( td of name of computer of it & td of (name of fixlet of it as string) & td of (if (exists source of fixlet of it) then source of fixlet of it else "n/a") & td of (if (exists category of fixlet of it) then category of fixlet of it else "n/a" ) & td of (if (exists source release date of fixlet of it) then source release date of fixlet of it as string else "n/a") & td of (id of fixlet of it as string) & td of (relevant flag of it as string ) & td of (if (exists first became relevant of it) then first became relevant of it as string else "n/a") & td of (if (exists last became nonrelevant of it) then last became nonrelevant of it as string else "n/a") ) ) of results of bes fixlets whose (exists source of it AND source of it as lowercase = "microsoft" AND exists source release date of it AND source release date of it > (current date - 6 * 30 * day)) ?>
Computer Name Fixlet Name Source Category Source Release Date Fixlet ID Relevant? First became relevant Fixed time

That seems to meet your requirements… What do you think?

Ben

(imported comment written by npeters91)

I’d like to pull out something similar to the above posts.

Can I pull out just the unique fixlet name that was remediated in the last 30 days?

Here is what I have so far, but I can’t get it to work.

trs of (

td of (name of fixlet of it)

)

unique values of results whose (exists last became nonrelevant of it AND last became nonrelevant of it > now-30*day)

of bes fixlets whose (source severity of it = “Critical” OR source severity of it = “High”)

Thanks!

(imported comment written by SystemAdmin)

Hey nPeters,

Try this:

(trs of

(

td of (unique values of name of fixlet of it as string)

) )

of results

of bes fixlets whose (exists source of it AND source of it as lowercase = “microsoft” AND exists source release date of it AND source release date of it > (current date - 6 * 30 * day))

(imported comment written by npeters91)

Thanks for the suggestion.

What I’m looking for is a unique list of fixlet names fixed in the past 30 days.

The above outputs a row for each occurance it finds.

For example, an output like this:

MS07-006: Vulnerability in Windows Shell Could Allow Elevation of Privilege - Windows XP SP2

MS07-006: CORRUPT PATCH - Windows XP SP2

MS07-006: Vulnerability in Windows Shell Could Allow Elevation of Privilege - Windows Server 2003

Thanks for the help.

(imported comment written by SystemAdmin)

(trs of

(

td of (it as string)

) )

of unique values of names of fixlets of results

of bes fixlets whose (exists source of it AND source of it as lowercase = “microsoft” AND exists source release date of it AND source release date of it > (current date - 6 * 30 * day))

Try this. It’s more in the spirit of your origninal code.

(imported comment written by npeters91)

That’s great…I has some time to get back to this and it worked perfectly.

Thanks for the help!!!

(imported comment written by npeters91)

Ok, I’m looking at it again, and I realized that it returns the results based on fixlets released in the last 30 days.

What I’m looking for is, fixlets remediated in the last 30 days.

Ideas?

Thanks for the help.

(imported comment written by BenKus)

How about this? (only works in web reports and not in the console):

(trs of
(
td of (it as string)
) )
of unique values of names of fixlets of results whose (last became nonrelevant of it > (now-30*day))
of bes fixlets whose (exists source of it AND source of it as lowercase = “microsoft” )

(imported comment written by khanand91)

hi ben

regarding the following you posted …

i think this is something that i’ve been looking for in another thread… however when i paste into the colnsole I get what seesm to be no results and it doesn’t like the syntax in the webreports QNA page …

<?relevance (trs of ( td of name of computer of it & td of (name of fixlet of it as string) & td of (if (exists source of fixlet of it) then source of fixlet of it else "n/a") & td of (if (exists category of fixlet of it) then category of fixlet of it else "n/a" ) & td of (if (exists source release date of fixlet of it) then source release date of fixlet of it as string else "n/a") & td of (id of fixlet of it as string) & td of (relevant flag of it as string ) & td of (if (exists first became relevant of it) then first became relevant of it as string else "n/a") & td of (if (exists last became nonrelevant of it) then last became nonrelevant of it as string else "n/a") ) ) of results of bes fixlets whose (exists source of it AND source of it as lowercase = "microsoft" AND exists source release date of it AND source release date of it > (current date - 6 * 30 * day)) ?>
Computer Name Fixlet Name Source Category Source Release Date Fixlet ID Relevant? First became relevant Fixed time

(imported comment written by BenKus)

Hi khanand,

Create a “blank report” in web reports and paste in your custom report code and it should work… The Web Reports QnA will only accept the session relevance (the part between the <?Relevance ... ?> block).

Ben

(imported comment written by khanand91)

hi folks … its been a while … can you help me getting the logic correct to add this logic into a format for web reports… works fine in the debugger … but carn’t get the web logic rights …

name of computer of it, values of it) of results (bes property “Windows Server block size”,bes computers) whose (value of it != “OK”)

many thanks

(imported comment written by BenKus)

You probably will want to do something like this:

<?Relevance trs of (td of name of computer of it & td of (concatenation ";" of values of it)) of results (bes property "Windows Server block size",bes computers) whose (value of it != "OK") ?>

I didn’t test this so hopefully I got the syntax right… Note that you can also use a “Computer Properties” report built into web reports to show the same data without having to write custom reports code.

Ben