I am trying to write the relevence for an analysis with the below criteria, and could use assistance:
The reg key for both returns is the same, however the report will kick back different strings based of 1 of 2 possile values. If the key doesnt exist, then N/A should appear.
What I have so far:
exists (key “HKLM\SYSTEM\CurrentControlSet\Services\iaStor\Enum” of registry AND (exists value “0” whose (it as string = “PCI\VEN_8086&DEV_”)) of it) then “AHCI” OR (exists value “0” whose (it as string = “Root\LEGACY_IASTOR\0000”) of it then “Compatibility” as string) else “N/A”
Still very green at this, so be gentle with the comments of my relevance language so far.
I don’t have that value in my registry but I used a similar one to demonstrate. I will build portions of the relevance statement a piece at a time and then put them together at the end.
q: exists key “HKLM\SYSTEM\CurrentControlSet\Services\i8042prt\Enum” of registry
A: True
I: singular boolean
q: exists value “0” of key “HKLM\SYSTEM\CurrentControlSet\Services\i8042prt\Enum” of registry
A: True
I: singular boolean
q: exists key “HKLM\SYSTEM\CurrentControlSet\Services\i8042prt\Enum” whose (exists value “0” of it) of registry
A: True
I: singular boolean
q: if (exists key “HKLM\SYSTEM\CurrentControlSet\Services\i8042prt\Enum” whose (exists value “0” of it) of registry) then ((value “0” of key “HKLM\SYSTEM\CurrentControlSet\Services\i8042prt\Enum” of registry) as string) else “N/A”
A: ACPI\PNP0303\4&371c94b&0
I: singular string
Does this get you closer to what you are looking for? You can go further in your comparsions and nest if-then statements to get more specific or more friendly results.
That didnt get me there yet, but it helped, this is where I am at so far…
if (exists value “0” whose (it as string starts with “PCI\VEN_8086&DEV_”) of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStor\Enum” of registry) then “AHCI” else if (exists value “0” whose (it as string starts with “Root\LEGACY_IASTOR\0000”) of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStor\Enum” of registry) then “Compatibility” else if (exists no key “HKLM\SYSTEM\CurrentControlSet\Services\iaStor\Enum”) then “N/A” as string
I have to be close. Futher tailoring and I am here
q: if (exists key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStor\Enum” whose (exists value “0” of it) of registry) then (if (value “0” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStor\Enum” of registry as string starts with “PCI\VEN_8086&DEV_”) then (“AHCI”) else (if (value of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStor\Enum” of registry as string starts with “Root\LEGACY_IASTOR\0000”) then (“COMPATIBILITY”))) else (“N/A”)
You are getting closer. I made a couple of changes…
if (exists key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStor\Enum” whose (exists value “0” of it) of registry) then (if (value “0” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStor\Enum” of registry as string starts with “PCI\VEN_8086&DEV_”) then (“AHCI”) else (if (value “0” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStor\Enum” of registry as string starts with “Root\LEGACY_IASTOR\0000”) then (“COMPATIBILITY”) else (“N/A”))) else “No Key”
