Question on best way to filter out unwanted results in an Analyses

Content Authoring
1

(imported topic written by nicklasd)

Good Evening, I am brand new to the BigFix world and I am trying to modify an analysis that already exists so that it will spit out more useful data.

Here is what I have:

q: if(exists key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR” of registry) then ((if exists value “FriendlyName” of it then (value “FriendlyName” of it as string) else “”)) of keys of keys of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR” of registry else “None”

A: HL-DT-ST DVDRAM GP08LU11 USB Device

A: HL-DT-ST DVDRAM GP08LU11 USB Device

A: HL-DT-ST DVDRAM GP08LU11 USB Device

A: HL-DT-ST DVDRAM GP08LU11 USB Device

A: SAMSUNG UMS CD-ROM USB Device

A: SAMSUNG UMS CD-ROM USB Device

A: WD Virtual CD 070A USB Device

A: Generic STORAGE DEVICE USB Device

A: PINGTEC Flash Disk USB Device

A: SAMSUNG SCH-I800 Card USB Device

A: SAMSUNG SCH-I800 Card USB Device

A: SAMSUNG SPH-P100 Card USB Device

A: USB DISK 2.0 USB Device

A: WD My Passport 070A USB Device

A:

T: 0.885 ms

What I would like to see instead would be the above results minus any result that contained “PINGTEC”

I have attempted to setup filters in WebReports but I don’t get the results I want when I try to filter out computers with USB Last Write name that does not contain pintec because then it will filter out computers that have pintec in addition to results I actually want reported.

Any help would be greatly appreciated!

2

(imported comment written by Zakkus)

You can use the relevance “whose” clause, which acts as a filter on each item of the list:

Q: (if(exists key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR” of registry) then ((if exists value “FriendlyName” of it then (value “FriendlyName” of it as string) else “”)) of keys of keys of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR” of registry else “None”) whose(it does not contain “PINGTEC”)

A:

A: Kingston DT 101 II USB Device

A: SanDisk Cruzer Blade USB Device

A:

A: SanDisk U3 Cruzer Micro USB Device

3

(imported comment written by nicklasd)

Thank you very much for your help!