Retrieve last modified time of file, value of registry entry, etc. via K1000
For example, we have an enterprise-level, managed AV solution, but to double-check its accuracy, we would like to retrieve the last modified date of the virus definitions (DAT) file and have it brought into the K1000 interface somehow. Along those lines, we will probably encounter instances where we want to know whether a particular file exists on a workstations' file system or the content of a registry entry, etc. What is the best way to do this type of thing? Thanks.
0 Comments
[ + ] Show comments
Answers (2)
Please log in to answer
Posted by:
chucksteel
8 years ago
You can do this using custom inventory rule. In the administrator interface click Inventory, Software then Choose Action, New. Create a rule in the Custom Inventory Rule textbox appropriately. You can check the help documentation for more information about now the rules function.
Comments:
-
Okay, I think this makes sense, but where do the results end up? I went into Software, chose new, and made a new item called "TEST" with a custom inventory rule of FileInfoReturn(c:\x\x\x.xxx, ModifiedDate, DATE). As of now, under software, I have an item called TEST with blank columns except for a 0 under Devices. - k1knnja 8 years ago
-
If you force an update on a computer it should run the custom inventory rule (assuming that the OS matches what is selected in the rule). That data will then appear in the device inventory in the software section. The software title will also show which computers have run the rule. - chucksteel 8 years ago
Posted by:
SMal.tmcc
8 years ago
Like Chucksteel posted use a CIR.
This is from the built in help
This is from the built in help
FileExists(path)
FileVersionEquals(path, version)
FileVersionLessThan(path, version)
FileVersionGreaterThan(path, version)
FileInfoGreaterThan(fullpath, attribute, type, value)
FileInfoLessThan(fullpath, attribute, type, value)
FileInfoEquals(fullpath, attribute, type, value)
FileInfoReturn(path, attribute, type)
Type can be TEXT, NUMBER, or DATE
attribute across platforms can be: access_time, AccessedDate, creation_time, CreatedDate, modification_time, ModifiedDate, FileName, size, device_id, inode, mode, number_links, device_number
attribute on Windows (5.4+) can be: Comments, CompanyName, FileBuildPart, FileDescription, FileMajorPart, FileMinorPart, FilePrivatePart, FileVersion, LegalCopyright, LegalTrademarks, OriginalFilename, PrivateBuild, ProductBuildPart, ProductMajorPart, ProductMinorPart, ProductName, ProductPrivatePart, ProductVersion, SpecialBuild
Examples
FileExists(C:\WINDOWS\\notepad.exe)
ShellCommandTextReturn(cmd /c type c:\WINDOWS\win.ini)
FileVersionEquals(C:\Program Files\Internet Explorer\iexplore.exe,8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339))
RegistryValueEquals(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion,CSDVersion,Service Pack 2)
FileExists(/bin/cp)
FileInfoReturn(/etc/hosts, modification_time, DATE)
