Unable to get the status of Component in Baseline in the API Query.

1

Hello Everyone,

I am unable to get the status of different component present in the baseline. It is providing me the overall status of the Baseline. It is showing fixed for Not Relevant also.

Basically I want the action status of the member action.

API Query

https://HOSTNAME:52311/api/query?relevance=(IDs
of Actions of it , Names of Issuers of Actions of it , Names of Actions of it , States of Actions of it , Times Issued of Actions of it , Names of Computers of it , Operating Systems of Computers of it , IP Addresses of Computers of it , Last Report Times of Computers of it , Detailed Status of it , Status of it as string , Names of member actions of actions of it) of results whose ((Name of Action of it contains “BASELINE_NAME”)) of bes actions whose ((start date of it >=(“25 Apr 2024”) as date) and (end date of it <=(“25 Apr 2024”) as date)) ; (IDs of item 1 of it , Names of Issuers of item 1 of it , Names of item 1 of it , States of item 1 of it , Times Issued of item 1 of it , Names of item 0 of it , Operating Systems of item 0 of it , IP Addresses of item 0 of it , Last Report Times of item 0 of it , “Not Reported” , “Not Reported”, Names of member actions of item 1 of it) of (elements of (set of targeted computers of it - set of computers of results of it) , it) of bes actions whose (Name of it contains “BASELINE_NAME” and (start date of it >=(“25 Apr 2024”) as date) and (end date of it <=(“25 Apr 2024”) as date))

2

Welcome to the Forum!

…and you’re starting with a difficult one.

Basically at this point
…Names of member actions of actions of it) of results ...
you are dealing with the ‘results of bes action’, so the State, Status, etc. all come from the main action. You’re also retrieving the names of the member actions beneath it, but that’s all you’re retrieving - just the names (not the State, Status, etc. of the member actions)

You’d have to refactor this query significantly - and it’s going to be an expensive query to retrieve all these properties from all the child actions.

The main issue here is to first find the bes actions you want (with the Baseline Name), and then retrieve both that action, and the member actions of it; and after retrieving both of these, then retrieve the results. Something like

results of (it; member actions of it) of bes actions whose ((Name of it contains "BASEILINE_NAME") and (start date of it >=("25 Apr 2024") as date) and (end date of it <=("25 Apr 2024") as date))

For the first part where your retrieve only the reported computers this should work (not that instead of the results descending into ‘names of member actions of it’, instead the member actions reports ‘name of parent group of it’

(IDs of Actions of it , Names of Issuers of Actions of it , Names of Actions of it , States of Actions of it , Times Issued of Actions of it , Names of Computers of it , Operating Systems of Computers of it , IP Addresses of Computers of it , Last Report Times of Computers of it , Detailed Status of it , Status of it as string , (if exists parent group of it then name of parent group of it else "") of action of it) of results of (it; member actions of it) of bes actions whose ((Name of it contains "BASELINE_NAME") and (start date of it >=("25 Apr 2024") as date) and (end date of it <=("25 Apr 2024") as date))

You should then be able to repeat basically the same logic for the targeted-but-not-reported computers on the second half of the query

3

Hi Jason, Thank you so much for the Response. Now it is generating the response. But for some server there are multiple Ip Address and due to this it is generating the same result twice with same Server name and Action name with only change in IP Address.

Please suggest any way to take take both Ip Address in single output.

4

Try following, updated ip address logic:

(IDs of Actions of it , Names of Issuers of Actions of it , Names of Actions of it , States of Actions of it , Times Issued of Actions of it , Names of Computers of it , Operating Systems of Computers of it , (concatenation ", " of (values of results from (bes property "IP Address") of computer of it as string)), Last Report Times of Computers of it , Detailed Status of it , Status of it as string , (if exists parent group of it then name of parent group of it else "") of action of it) of results of (it; member actions of it) of bes actions whose ((Name of it contains "BASELINE_NAME") and (start date of it >=("25 Apr 2024") as date) and (end date of it <=("25 Apr 2024") as date))

1 Like