Skip to content

windows and linux management import #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jwalker107 merged 2 commits into from
Sep 17, 2026
Merged

windows and linux management import #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
22ac3b6
windows and linux management import
Sep 17, 2026
8648d7d
[bot] Apply pre-commit auto-fixes
github-actions[bot] Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
34 changes: 34 additions & 0 deletions Sites/Linux Management/Fixlets/Analyses/Apache Commons Text Scan Analysis.bes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
BigFix Analysis Export

Title : Apache Commons Text Scan Analysis
ID : 2998676
Author : JasonWalker
Domain : BESC
Imported : 2022-10-21T12:03:09
Source : bigfixm1_main @ BES-Root
-->
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
<Analysis>
<Title>Apache Commons Text Scan Analysis</Title>
<Description><![CDATA[<H3>This is Community Content. When you use these solutions, it is incumbent on your organization to test any solutions provided across the broadest available system base including various OS, storage solutions, and application inventory.</H3>
<P></P>
<P>Please see the <A href="https://forum.bigfix.com/t/log4j-vulnerability-identification-and-3rd-party-remediation-solution-testing-statement/40273"><FONT color=#0066cc>Community Solution Testing Statement</FONT></A></P>
<P>This&nbsp;Analysis retrieves results of&nbsp;a filesystem scan to attempt detecting Apache Commons Text versions that may be vulnerable to one of the following vulnerabilty CVE-2022-42889 reported in October 2022:</P>
<UL>
<LI><A href="https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om"><FONT color=#0066cc>https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om</FONT></A>
<LI><A href="https://nvd.nist.gov/vuln/detail/CVE-2022-42889"><FONT color=#0066cc>https://nvd.nist.gov/vuln/detail/CVE-2022-42889</FONT></A><BR></LI></UL>
<P><SPAN style="FONT-SIZE: 11pt">This Analysis attempts to detect the presence and versions of Apache Commons Text java library, without distinction between vulnerable or updated versions.&nbsp; These results should be considered only a starting point in determining whether a system is actually vulnerable, along with other information such as the version of Java Virtual Machine and specific application or code configurations as referenced in the security bulletins above.</SPAN></P>]]></Description>
<Relevance>if exists property &quot;in proxy agent context&quot; then not in proxy agent context else true</Relevance>
<Relevance><![CDATA[exists files "apache-commons-text.txt" of folders "Scans" of folders ((if (version of client >= "9" as version) then (pathname of parent folder of data folder of client) else (pathname of parent folder of parent folder of client folder of site "actionsite")))]]></Relevance>
<MIMEField>
<Name>x-fixlet-modification-time</Name>
<Value>Tue, 18 Oct 2022 16:15:23 +0000</Value>
</MIMEField>
<Domain>BESC</Domain>
<Property ID="1" Name="All Apache Commons Text Detections" EvaluationPeriod="PT30M">(if exists property &quot;locked lines&quot; then locked lines of it else lines of it) whose (it does not start with &quot;::&quot;) of files &quot;apache-commons-text.txt&quot; of folders &quot;Scans&quot; of folders ((if (version of client &gt;= &quot;9&quot; as version) then (pathname of parent folder of data folder of client) else (pathname of parent folder of parent folder of client folder of site &quot;actionsite&quot;))) </Property>
<Property ID="2" Name="Number of Apache Commons Text Detections" EvaluationPeriod="PT30M">number of (if exists property &quot;locked lines&quot; then locked lines of it else lines of it) whose (it does not start with &quot;::&quot;) of files &quot;apache-commons-text.txt&quot; of folders &quot;Scans&quot; of folders ((if (version of client &gt;= &quot;9&quot; as version) then (pathname of parent folder of data folder of client) else (pathname of parent folder of parent folder of client folder of site &quot;actionsite&quot;)))</Property>
<Property ID="4" Name="Unique Apache Commons Text Versions Found" EvaluationPeriod="PT30M">unique values of (unique value of following texts of lasts &quot;-&quot; of preceding texts of lasts &quot;.jar&quot; of (it as lowercase) | &quot;unknown&quot;) of lines whose (it does not start with &quot;::&quot;) of files &quot;apache-commons-text.txt&quot; of folders &quot;Scans&quot; of folders ((if (version of client &gt;= &quot;9&quot; as version) then (pathname of parent folder of data folder of client) else (pathname of parent folder of parent folder of client folder of site &quot;actionsite&quot;)))</Property>
</Analysis>
</BES>
33 changes: 33 additions & 0 deletions Sites/Linux Management/Fixlets/Analyses/ESET Installed (76).bes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
BigFix Analysis Export

Title : ESET Installed
ID : 76
Author : PaulB
Domain : BES
Imported : 2013-02-04T05:38:24
Source : bigfixm1_main @ BES-Root
-->
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
<Analysis>
<Title>ESET Installed</Title>
<Description><![CDATA[<P>This analysis will show Machines that have ESET installed </P>
<P>pulls back</P>
<OL>
<LI>signature of AV db</LI>
<LI>version of NOD32</LI>
<LI>Age of AV db</LI></OL>
<P>&nbsp;</P>]]></Description>
<Relevance>windows of operating system</Relevance>
<Relevance>exists key &quot;HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info&quot; of native registry</Relevance>
<MIMEField>
<Name>x-fixlet-modification-time</Name>
<Value>Mon, 04 Feb 2013 11:38:54 +0000</Value>
</MIMEField>
<Domain>BES </Domain>
<Property ID="1" Name="ESET Signature Number">value &quot;ScannerVersion&quot; of key &quot;HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info&quot; of native registry</Property>
<Property ID="3" Name="ESET Age">current date - date (( last 2 of (preceding text of first &quot;)&quot; of (following text of first &quot;(&quot; of (value &quot;ScannerVersion&quot; of key &quot;HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info&quot; of native registry as string))) &amp; &quot; &quot; &amp; first 3 of (month (last 2 of first 6 of (preceding text of first &quot;)&quot; of (following text of first &quot;(&quot; of (value &quot;ScannerVersion&quot; of key &quot;HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info&quot; of native registry as string))) as integer) as string) &amp; &quot; &quot; &amp; first 4 of (preceding text of first &quot;)&quot; of (following text of first &quot;(&quot; of (value &quot;ScannerVersion&quot; of key &quot;HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info&quot; of native registry as string)))))</Property>
<Property ID="4" Name="ESET Version">value &quot;ProductVersion&quot; of key &quot;HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info&quot; of native registry</Property>
</Analysis>
</BES>
27 changes: 27 additions & 0 deletions Sites/Linux Management/Fixlets/Analyses/Linux package info - RPM & DEB (2998050).bes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
BigFix Analysis Export

Title : Linux package info - RPM & DEB
ID : 2998050
Author : jgstew
Domain : BESC
Imported : 2016-05-06T14:49:06
Source : bigfixm1_main @ BES-Root
-->
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
<Analysis>
<Title>Linux package info - RPM &amp; DEB</Title>
<Description>This analysis gathers data from both RPMs and Debianpackages </Description>
<Relevance>(if exists properties whose(it as string contains &quot;debianpackage:&quot;) then TRUE else if exists properties whose(it as string contains &quot;rpm:&quot;) then TRUE else ERROR &quot;The operators are not defined.&quot;)</Relevance>
<MIMEField>
<Name>x-fixlet-modification-time</Name>
<Value>Fri, 06 May 2016 21:46:52 +0000</Value>
</MIMEField>
<Domain>BESC</Domain>
<Property ID="2" Name="packages" EvaluationPeriod="P2D">packages whose(if exists properties whose(it as string contains &quot;currently installed of &quot;) then (currently installed of it) else TRUE) of (if exists properties whose(it as string contains &quot;debianpackage:&quot;) then debianpackages else if exists properties whose(it as string contains &quot;rpm:&quot;) then rpms else ERROR &quot;The operators are not defined.&quot;)</Property>
<Property ID="3" Name="yum version" EvaluationPeriod="PT6H">(it as string) of versions of packages whose(&quot;yum&quot; = name of it AND (if exists properties whose(it as string contains &quot;currently installed of &quot;) then (currently installed of it) else TRUE)) of (if exists properties whose(it as string contains &quot;debianpackage:&quot;) then debianpackages else if exists properties whose(it as string contains &quot;rpm:&quot;) then rpms else ERROR &quot;The operators are not defined.&quot;)</Property>
<Property ID="4" Name="apt version" EvaluationPeriod="PT6H">(it as string) of versions of packages whose(&quot;apt&quot; = name of it AND (if exists properties whose(it as string contains &quot;currently installed of &quot;) then (currently installed of it) else TRUE)) of (if exists properties whose(it as string contains &quot;debianpackage:&quot;) then debianpackages else if exists properties whose(it as string contains &quot;rpm:&quot;) then rpms else ERROR &quot;The operators are not defined.&quot;)</Property>
<Property ID="5" Name="Package Managers" EvaluationPeriod="PT12H">packages whose( (&quot;apt&quot; = name of it OR &quot;aptitude&quot; = name of it OR &quot;yum&quot; = name of it OR &quot;emerge&quot; = name of it OR &quot;pacman&quot; = name of it OR &quot;zypp&quot; = name of it OR &quot;dnf&quot; = name of it OR &quot;urpmi&quot; = name of it) AND (if exists properties whose(it as string contains &quot;currently installed of &quot;) then (currently installed of it) else TRUE)) of (if exists properties whose(it as string contains &quot;debianpackage:&quot;) then debianpackages else if exists properties whose(it as string contains &quot;rpm:&quot;) then rpms else ERROR &quot;The operators are not defined.&quot;)</Property>
</Analysis>
</BES>
24 changes: 24 additions & 0 deletions Sites/Linux Management/Fixlets/Analyses/SSH Public Keys (2998546).bes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
BigFix Analysis Export

Title : SSH Public Keys
ID : 2998546
Author : jgstew
Domain : BESC
Imported : 2017-04-18T16:10:12
Source : bigfixm1_main @ BES-Root
-->
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
<Analysis>
<Title>SSH Public Keys</Title>
<Description><![CDATA[&lt;enter a description of the analysis here&gt; ]]></Description>
<Relevance>exists files &quot;id_rsa.pub&quot; of folders &quot;.ssh&quot; of home directory folders of users</Relevance>
<MIMEField>
<Name>x-fixlet-modification-time</Name>
<Value>Tue, 18 Apr 2017 23:07:23 +0000</Value>
</MIMEField>
<Domain>BESC</Domain>
<Property ID="1" Name="SSH Public Keys" EvaluationPeriod="PT12H">unique values whose(it as trimmed string != &quot;&quot;) of lines of files &quot;id_rsa.pub&quot; of folders &quot;.ssh&quot; of home directory folders of users</Property>
</Analysis>
</BES>
25 changes: 25 additions & 0 deletions Sites/Linux Management/Fixlets/Analyses/Shellshock (2994719).bes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
BigFix Analysis Export

Title : Shellshock
ID : 2994719
Author : sinucus
Domain : BESC
Imported : 2014-09-28T17:46:26
Source : bigfixm1_main @ BES-Root
-->
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
<Analysis>
<Title>Shellshock</Title>
<Description>This will look for the vulnerable version of bash in RHEL 5/6/7 x64 systems. This is fairly simple to modify if you are testing for a different distro or architecture. </Description>
<Relevance>exists file &quot;/etc/redhat-release&quot;</Relevance>
<MIMEField>
<Name>x-fixlet-modification-time</Name>
<Value>Mon, 29 Sep 2014 00:41:37 +0000</Value>
</MIMEField>
<Domain>BESC</Domain>
<Property ID="1" Name="Bash version">rpm version record of package &quot;bash&quot; of rpm</Property>
<Property ID="2" Name="Vulnerable">((exists package &quot;bash&quot; whose (rpm version record of it &lt; rpm package version record &quot;4.1.2-15.el6_5.2&quot; AND rpm version record of it &gt; rpm package version record &quot;4.1.0-0.el1_0.0&quot; AND architecture of it = &quot;x86_64&quot;) of it AND (not exists package &quot;bash&quot; whose (rpm version record of it &gt;= rpm package version record &quot;4.1.2-15.el6_5.2&quot; AND architecture of it = &quot;x86_64&quot;) of it)) OR (exists package &quot;bash&quot; whose (rpm version record of it &lt; rpm package version record &quot;3.2-33.el5_11.4&quot; AND rpm version record of it &gt; rpm package version record &quot;3.2-0.el1_0.0&quot; AND architecture of it = &quot;x86_64&quot;) of it AND (not exists package &quot;bash&quot; whose (rpm version record of it &gt;= rpm package version record &quot;3.2-33.el5_11.4&quot; AND architecture of it = &quot;x86_64&quot;) of it)) OR (exists package &quot;bash&quot; whose (rpm version record of it &lt; rpm package version record &quot;4.2.45-5.el7_0.4&quot; AND rpm version record of it &gt; rpm package version record &quot;4.2.0-0.el1_0.1&quot; AND architecture of it = &quot;x86_64&quot;) of it AND (not exists package &quot;bash&quot; whose (rpm version record of it &gt;= rpm package version record &quot;4.2.45-5.el7_0.4&quot; AND architecture of it = &quot;x86_64&quot;) of it))) of rpm</Property>
</Analysis>
</BES>
26 changes: 26 additions & 0 deletions Sites/Linux Management/Fixlets/Analyses/Ubuntu Available and Installed Packages (95).bes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
BigFix Analysis Export

Title : Ubuntu Available and Installed Packages
ID : 95
Author : danielheth
Domain : BESC
Imported : 2013-05-01T21:13:48
Source : bigfixm1_main @ BES-Root
-->
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
<Analysis>
<Title>Ubuntu Available and Installed Packages</Title>
<Description>Using our package inventoring task... this analysis will pull in results making them available via WebReports </Description>
<Relevance>name of operating system contains &quot;Ubuntu&quot;</Relevance>
<Relevance>exists file &quot;availableApps.txt&quot; of parent folder of client OR exists file &quot;installedApps.txt&quot; of parent folder of client</Relevance>
<MIMEField>
<Name>x-fixlet-modification-time</Name>
<Value>Wed, 01 May 2013 02:48:02 +0000</Value>
</MIMEField>
<Domain>BESC</Domain>
<Property ID="1" Name="Installed Packages" EvaluationPeriod="PT1H">if exists file &quot;installedApps.txt&quot; of parent folder of client then lines of file &quot;installedApps.txt&quot; of parent folder of client else &quot;&lt;missing file&gt;&quot;</Property>
<Property ID="2" Name="Available Packages" EvaluationPeriod="PT1H">if exists file &quot;availableApps.txt&quot; of parent folder of client then lines of file &quot;availableApps.txt&quot; of parent folder of client else &quot;&lt;missing file&gt;&quot;</Property>
</Analysis>
</BES>
27 changes: 27 additions & 0 deletions ... Management/Fixlets/Analyses/AV Antivirus Audit - Security Center - Windows (2996952).bes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
BigFix Analysis Export

Title : AV Antivirus Audit - Security Center - Windows
ID : 2996952
Author : jgstew
Domain : BESC
Imported : 2016-04-19T22:21:03
Source : bigfixm1_main @ BES-Root
-->
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
<Analysis>
<Title>AV Antivirus Audit - Security Center - Windows</Title>
<Description><![CDATA[<P>This analysis should identify all AV products registered with the Windows Security Center APIs.</P>
<P>The `ProductState` should be a bit set of some sort that contains info about the state of the AV products detected. </P>]]></Description>
<Relevance>windows of operating system</Relevance>
<MIMEField>
<Name>x-fixlet-modification-time</Name>
<Value>Wed, 20 Apr 2016 05:20:26 +0000</Value>
</MIMEField>
<Domain>BESC</Domain>
<Property ID="1" Name="AV DisplayName" EvaluationPeriod="PT1H">unique values of string values of selects &quot;displayname from AntiVirusProduct&quot; of (if exists (wmis &quot;root\SecurityCenter2&quot;) then (wmis &quot;root\SecurityCenter2&quot;) else (wmis &quot;root\SecurityCenter&quot;))</Property>
<Property ID="2" Name="AV ProductState" EvaluationPeriod="PT1H">unique values of (string value of property &quot;displayName&quot; of it &amp; &quot;: state=&quot; &amp; string value of property &quot;productState&quot; of it) of select objects &quot;displayName,productState from AntiVirusProduct&quot; of wmis &quot;root\SecurityCenter2&quot;</Property>
<Property ID="3" Name="AV RawData" EvaluationPeriod="PT12H">( concatenations &quot;, &quot; of following texts of firsts &quot;True, &quot; of (it as string) of (true, (it) ) of properties whose(it as string does not start with &quot;__&quot;) of it) of select objects &quot;* from AntiVirusProduct&quot; of (wmis &quot;root\SecurityCenter&quot;;wmis &quot;root\SecurityCenter2&quot;)</Property>
</Analysis>
</BES>
34 changes: 34 additions & 0 deletions Sites/Windows Management/Fixlets/Analyses/Adobe Update Server - Windows (2994671).bes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
BigFix Analysis Export

Title : Adobe Update Server - Windows
ID : 2994671
Author : jgstew
Domain : BESC
Imported : 2014-07-16T15:13:27
Source : bigfixm1_main @ BES-Root
-->
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
<Analysis>
<Title>Adobe Update Server - Windows</Title>
<Description><![CDATA[<P>This analysis reports on the information&nbsp;about the configured Adobe Update Server</P>
<P><FONT size=2>&nbsp;</P></FONT>
<P><STRONG>References:</STRONG></P>
<P><A href="http://helpx.adobe.com/creative-cloud/packager/update-server-setup-tool.html">http://helpx.adobe.com/creative-cloud/packager/update-server-setup-tool.html</A></P>
<P><A href="http://helpx.adobe.com/creative-cloud/packager/provisioning-toolkit-enterprise.html">http://helpx.adobe.com/creative-cloud/packager/provisioning-toolkit-enterprise.html</A></P>
<P><A href="http://helpx.adobe.com/creative-cloud/packager/preparing-deploy.html">http://helpx.adobe.com/creative-cloud/packager/preparing-deploy.html</A></P>
<P><A href="http://helpx.adobe.com/creative-cloud/packager/creative-cloud-packager.html">http://helpx.adobe.com/creative-cloud/packager/creative-cloud-packager.html</A></P>
<P><A href="http://www.regexr.com/395i4">http://www.regexr.com/395i4</A></P>
<P><A href="http://www.regexr.com/395de">http://www.regexr.com/395de</A></P>
<P>&nbsp;</P>]]></Description>
<Relevance>windows of operating system</Relevance>
<Relevance>exists lines of files &quot;AdobeUpdater.Overrides&quot; of folders of (folders &quot;ProgramData\Adobe\AAMUpdater&quot; of it;folders &quot;Documents and Settings\All Users\Application Data\Adobe\AAMUpdater&quot; of it) of root folders of drives of system folders</Relevance>
<MIMEField>
<Name>x-fixlet-modification-time</Name>
<Value>Wed, 16 Jul 2014 22:12:15 +0000</Value>
</MIMEField>
<Domain>BESC</Domain>
<Property ID="2" Name="AdobeUpdater.Overrides" EvaluationPeriod="P7D">lines of files &quot;AdobeUpdater.Overrides&quot; of folders of (folders &quot;ProgramData\Adobe\AAMUpdater&quot; of it;folders &quot;Documents and Settings\All Users\Application Data\Adobe\AAMUpdater&quot; of it) of root folders of drives of system folders</Property>
</Analysis>
</BES>
Loading