Report Available: Fixlet Compliance by Content

Reporting
21

(imported comment written by mbp911)

Can you explain how to create custom relevance for selecting content?

Example: All Microsoft Critical Patches From Release Date of Dec 2010.

22

(imported comment written by Lee Wei)

mbp911

Can you explain how to create custom relevance for selecting content?
Example: All Microsoft Critical Patches From Release Date of Dec 2010.

This would be the statement that you want to paste into the Custom Relevance text box.

bes fixlets whose (
display name of site of it = “Patches for Windows (English)” and
source severity of it as lowercase = “critical” and
name of it as lowercase does not contain “corrupt patch” and
name of it as lowercase does not contain “superseded” and
source release date of it >= “Wed, 01 Dec 2010” as date
)

Note that I have added the filters for corrupt and superseded patches. Please take them out if you want to see them.

Feel free to post any other content that you need. A few examples are always easier.

Lee Wei

23

(imported comment written by mbp911)

Can you explain how to create custom relevance for selecting content?

Example: All Microsoft Critical Patches From Release Date of Dec 2010.

24

(imported comment written by mbp911)

Thanks again for your quick response. This is exactly what I needed.

25

(imported comment written by Lee Wei)

S.Dave

I’m also quite confused about the way to create custom relevance for selecting content? Does anyone help me ? thanks in advance

Stephen,

You will have to write a Session Relevance statement that returns one or many Fixlets.

Here is our site location for writing Relevance. This is not trivial, so it will take some time to learn the language. For now, some examples might help.

https://www.ibm.com/developerworks/mydeveloperworks/wikis/home?lang=en#/wiki/Tivoli%20Endpoint%20Manager/page/Fixlet%20Authoring

All Fixlets from the “Updates for Windows Applications” site that has the name “acrobat”:

bes fixlets whose (name of site of it = “Updates for Windows Applications” and fixlet flag of it = true and name of it as lowercase contains “acrobat”)

All Fixlets starting with “MS11-052”:

bes fixlets whose (name of it starts with “MS11-052”)

If you have something specific, we can help write an example statement for you.

Lee Wei

26

(imported comment written by JA-CTI91)

This is a fantastic report! I’m trying to tweak it for a particular use, and was wondering what would be the most straightforward way to modify this report so that the Outstanding Fixlets grid displays a list of the installed fixlets by computer, as opposed to the outstanding fixlets? Is there some obvious way to accomplish this that I’ve been missing? Thank you!

27

(imported comment written by Lee Wei)

JA-CTI,

I think you are referring to the other report at http://forum.bigfix.com/viewtopic.php?id=4307?

Unfortunately, there is no easy way to switch to Installed Fixlets.

The “BES Fixlet” object comes with an easy property to show all the “Applicable Computers”. Meaning the computers where the Fixlet is relevant. So the report has been setup to take advantage of that.

The flip side to show all installed Fixlets will probably better serve rewriting rather than repurposing.

Lee Wei

28

(imported comment written by Gman8291)

Fantastic Report.

Anyone else having issues exporting to Excel?? Ive downloaded firefox 3.6 and whenever try to open the file i get: Problems During Load - Workbook Settings.

Seems to point to an issue with Header length:

XML Spreadsheet Warning in Worksheet Setting

REASON: String too long

ACTION: Truncating string

FILE: P:\filename\filename.xml

GROUP: PageSetup

TAG: Header

ATTRIB: Data

VALUE: very very long long header too long for Excel to handle

If i open with OpenOffice all the text is along the top row and it leaves off many values.

Thanks

Gordon

29

(imported comment written by Lee Wei)

Hi Gordon,

The export to Excel function actually produces an XML file that Excel knows how to open. This is the reason we get the first error “The file is in a different format than specified by the file extension”. The error is benign in that I specified extension XLS, but it is actually an XML file.

So save the file first, then open it with a text editor to edit the XML element(s) causing the problem.

In your case, search for “very very long long header too long for Excel to handle” and change that.

I don’t remember a header with this name in the report though. :slight_smile:

Lee Wei

30

(imported comment written by Gman8291)

Hi Lee,

You are correct. Thank you. When i open this with an XML editor I can see all the details of the report. However everything is in one single across line 1. Really Odd. No line about the “Really really long line” either, however the report is just one really long line… :frowning:

I have attached the report i am trying to export. Unfortunately my XML scripting is not up to much. You wouldnt be able to point me in the right direction of what i need to do to have this formatted as expected?

I would be forever in your Debt! :slight_smile:

Gordon

31

(imported comment written by Lee Wei)

Gordon,

The attachment is missing from the post.

I think this forum has problems with attachments some times.

Please send it to me via private message.

Lee Wei

32

(imported comment written by Lee Wei)

Opening an Excel export and getting an error during load with “Workbook Setting” is a bug in my Excel exporting code.

Until I fix it, here is the workaround.

Open the export which is an XML file.

Search for “ss:Worksheet ss:Name” and change the value to something short and simple.

I am using the name of the grid as the name of the worksheet, which is often too long for Excel.

Lee Wei

33

(imported comment written by Lee Wei)

“Is this report compatible with version 8.2.x?”

Yes and no. Yes the report will run, but no, it is not usable because it has become very slow.

Engineering changed Web Reports to reduce memory footprint.

Unfortunately in the process, some needed data is not cached and requires retrieval from the backend database.

Engineering is considering reverting to the old behavior for use cases such as this one.

Lee Wei

34

(imported comment written by GregSa)

Hello,

Is there any plan to have a new version to this report soon? We were using it and it was very valuable to our company. If not is there another report like it that will work in 8.2.x?

Thanks!

35

(imported comment written by Lee Wei)

Greg,

I assume you are referring to this report currently running very slow in TEM 8.2.x.

Engineering has confirmed the fix which is due out end of February to middle of March 2012.

The fix will be in the form of a new TEM version 8.2.x greater than the latest 8.2.1093.

Lee Wei

36

(imported comment written by GregSa)

Yes you assumed correct. So I will now assume with the new TEM version 8.2.x greater than the latest 8.2.1093 all agents and relays will need to to be upgraded?

37

(imported comment written by Lee Wei)

This would be a server side fix, so the Agents and Relays do not have to be upgraded for this particular problem.

You might want to upgrade the Agents/Relays for other reasons.

The TEM Server will always support Agents/Relays from earlier releases.

Lee Wei

38

(imported comment written by ChaddC)

I am trying to use this report to get some insight as to the number of relevant MS Security hotfix fixlets. Sounds pretty simple. However I am either confused as to the proper way to do this, or I have found an interesting bug.

I use a following filters.

  1. “content” “site” “is” “patches for windows”

  2. “content” “category” “is” “security hotfix”

Within the report for the “Content” selection I select

  1. “All microsoft critical fixlets”

  2. “all microsoft important fixlets”

  3. “all microsfot moderate fixlets”

  4. “all microsoft low fixlets”

  5. “all microsoft none fixlets”

  6. “all microsoft unspecifiex fixlets”

Compliance for all microsoft fixlets is then reported as a number. This should be all of the currently relevant windows security hotfix fixlets.

My problem is that if I run the same report, but each time I only select one of the fixlet severities within the “Content” list i.e. “All microsoft critical fixlets” and I record each of the totals for all six fixlet criticalities, the totals do not match.

As an example, If I run the report including all 6 criticalities, I may get a total of 580.

However if I run the report 6 times, each time choosing a single fixlet criticality, they total up to 690.

Am I using this report incorectly? Is there a proper way to do it? Is this a known bug?

Any help would be greatly appreciated!

39

(imported comment written by Lee Wei)

Hi Chadd,

Thanks for asking - actually this showcases a neat feature of this report (sorry if I might say so myself…), which is its ability to group MS Security Bulletins together.

As an example, the following security bulletin is actually made up for different fixes for different platforms, and there are 19 Fixlets provided.

http://technet.microsoft.com/en-us/security/bulletin/MS12-043

Microsoft Security Bulletin MS12-043 - Critical

Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (2722479)

Note that the bulletin is classified as “Critical”, even though there are components within the bulletin that are of “Moderate” severity.

Back to the Compliance Report, there is a checkbox for “Group MS Patches”, which will combine the above 19 Fixlets into 1 row. It will show “Critical” as the severity, which is the highest severity of the group of Fixlets.

So when we check “Group MS Patches”, many Fixlets of different severity levels are grouped together, causing your total number to be different. If you uncheck “Group MS Patches”, then the numbers will add up correctly.

Lee Wei

40

(imported comment written by SystemAdmin)

Hi Lee Wei,

May I check with you that if I want to make the following modifications of the current report to better cater to our needs:

  1. Remove Fixlet ID, Category, Release Date, Applicable, Installed and Outstanding

  2. Add Description of Fixlet and Error Message

What are the codes I should insert/remove?

Really appreciate your help and many thanks!

Zhang Meng