Search Results for: run the relevance script to capture successful or failed events

Results - 6734 Relevance Statements, 8122 Fixlets, 71 Analyses, 2 Dashboards, and 1 Signatures -- (23125.497 ms)
Page 596 of 598 << < Prev Next > >>
  * Session Relevance
Show indented relevance
(name of it | "UnknownName", concatenation ", " of unique values of tuple string items 2 of items 1 of (elements of item 0 of it, elements of item 1 of it) whose(item 0 of it as version >= tuple string item 0 of item 1 of it AND item 0 of it as version <= tuple string item 1 of item 1 of it) of ( it, sets of (concatenations ", " of (it as trimmed string) of substrings separated by "," of it) of ("10.10.0.0,10.10.10.255,SubnetTag1"; "192.168.7.1 ,192.168.7.255, SubnetTag2"; "192.168.0.0, 192.168.6.255,SubnetTag3"; "169.254.0.0,169.254.255.255,SelfAssigned") ) of sets of (it as string) of ip addresses of it) of bes computers
0 Votes
  * Results in a true/false
Show indented relevance
(if (it = "x86_64") then "PASS" else "FAIL - OS Architecture: " & it) of (architecture of operating system)
0 Votes
  * Results in a true/false
Show indented relevance
(if (it > 1000) then "PASS" else concatenation of "FAIL - Current processor speed in GHZ: " & (it as string)) of (significant digits 2 of (speed of main processor / mhz))
0 Votes
  * Results in a true/false
Show indented relevance
(if (it >= 2) then "PASS" else concatenation of "FAIL - Current core count: " & (it as string)) of (core of it * count of it) of cpupackage
0 Votes
  * Results in a true/false
Show indented relevance
(if (it >= 4096) then "PASS" else "FAIL - Current memory in MB: " & (it as string)) of (size of ram /1048576)
0 Votes
  * Results in a true/false
Show indented relevance
(if (it) then "PASS" else "FAIL - no 64GB fixed drive") of ( exists drive whose (type of it = "DRIVE_FIXED" and (total space of it/(1024*1024*1024)) >=64 ))
0 Votes
  * Results in a true/false
Show indented relevance
(if (number of elements of it = 0) then "PASS" else "FAIL - Issues: " & concatenation "," of elements of it ) of set of ( following texts whose (it does not contain "12" AND (it as integer < 12 ) of first 2 of (it as trimmed string) of following text of first "DirectX" of it) of first ": " of (it as string) of lines whose (it as trimmed string starts with "DirectX Version: ") of it; following texts whose ( (it as trimmed string as version < "2.0") of following text of first "WDDM" of it) of firsts ": " of (it as string) of lines whose (it as trimmed string starts with "Driver Model:" and it contains "WDDM") of it)of file "win11-eligibility\dxdiag.txt" of parent folder of client |"probe not run"
0 Votes
  * Results in a true/false
Show indented relevance
(if number of elements of it = 0 then "FAIL - TPM not visible in wmi" else (if (number of elements of it = 0) then "PASS" else "FAIL - TPM issues: " & concantenation "|" of elements of it) of set of elements whose ((it contains "_InitialValue" AND not (it as boolean) of first "=" of it) OR ((it as version < "2.0") of tuple string item 0 of following text of first "SpecVersion=" of it)) of it) of set of string values of selects "IsActivated_InitialValue, IsEnabled_InitialValue, IsOwned_InitialValue, SpecVersion from Win32_Tpm" of wmis "root\CIMv2\Security\MicrosoftTpm"
0 Votes
  * Results in a true/false
Show indented relevance
if (exists selects "* from Win32_DiskPartition Where Type = 'GPT: System'" of wmi) then "PASS" else "FAIL - BIOS boot mode"
0 Votes
  * Results in a true/false
Show indented relevance
if exists key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\State" whose (value "UEFISecureBootEnabled" of it = 1) of native registry then "PASS" else "FAIL - Secure Boot Disabled"
0 Votes
  * Results in a true/false
Show indented relevance
(if (it >=2004) then "PASS" else "FAIL - Current Version: " & (it as string)) of (it as integer) of value "ReleaseID" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" of native registry
0 Votes
  * Results in a true/false
Show indented relevance
(if number of elements of it = 0 then "FAIL - TPM not visible in wmi" else (if (number of elements of it = 0) then "PASS" else "FAIL - TPM issues: " & concantenation "|" of elements of it) of set of elements whose ((it contains "_InitialValue" AND not (it as boolean) of following text of first "=" of it) OR ((it as version < "2.0") of tuple string item 0 of following text of first "SpecVersion=" of it)) of it) of set of string values of selects "IsActivated_InitialValue, IsEnabled_InitialValue, IsOwned_InitialValue, SpecVersion from Win32_Tpm" of wmis "root\CIMv2\Security\MicrosoftTpm"
0 Votes
  * Results in a true/false
Show indented relevance
(if number of elements of it = 0 then "FAIL - TPM not visible in wmi" else (if (number of elements of it = 0) then "PASS" else "FAIL - TPM issues: " & concantenation "|" of elements of it) of set of elements whose ((it contains "_InitialValue" AND not (it as boolean) of following text of first "=" of it) OR ((it as version < "2.0") of tuple string item 0 of following text of first "SpecVersion=" of it)) of it) of set of ((it as string) of selects "IsActivated_InitialValue, IsEnabled_InitialValue, IsOwned_InitialValue, SpecVersion from Win32_Tpm" of wmis "root\CIMv2\Security\MicrosoftTpm")
0 Votes
  * Results in a true/false
Show indented relevance
(if number of elements of it = 0 then "FAIL - TPM not visible in wmi" else (if (number of elements of it = 0) then "PASS" else "FAIL - TPM issues: " & concatenation "|" of elements of it) of set of elements whose ((it contains "_InitialValue" AND not (it as boolean) of following text of first "=" of it) OR ((it as version < "2.0") of tuple string item 0 of following text of first "SpecVersion=" of it)) of it) of set of ((it as string) of selects "IsActivated_InitialValue, IsEnabled_InitialValue, IsOwned_InitialValue, SpecVersion from Win32_Tpm" of wmis "root\CIMv2\Security\MicrosoftTpm")
0 Votes
  * Results in a true/false
Show indented relevance
(if (it >= 4096) then "PASS" else "FAIL - Current memory in MB: " & (it as string)) of (if (it > 128) then ( ((it / 32) * 32) + (if (it mod 32 > 16) then 32 else 0) ) else it) of (size of ram /1048576)
0 Votes
  * Results in a true/false
Show indented relevance
computer name, ((month of it as two digits & "/" & day_of_month of it as two digits & "/" & year of it as string) of dates (local time zone) of times generated of it, (time of times (local time zone) of times generated of it), concatenation of substrings separated by "%0d%0a" of (preceding text of first "%0d%0a" of following text of last "Account Name:%09%09" of it) of (descriptions of it)) of records whose (event id of it = 4740 and now - time generated of it < 1*day) of (security event log)
0 Votes
Used in 1 analsis   * Results in a true/false
Show indented relevance
exists records whose (source of it = "Microsoft-Windows-WUSA" and event id of it = 3) of event log "Setup"
0 Votes
  * Results in a true/false
Show indented relevance
(time generated of it, "Record ID:" & record number of it as string, "Event ID:" & event id of it as string, description of it) of records whose (source of it = "Microsoft-Windows-WUSA" and event id of it = 3) of event log "Setup"
0 Votes
  * Session Relevance
Show indented relevance
number of bes fixlets whose(not custom flag of it AND download size of it != 0 AND now - modification time of it < 90 * day AND exists applicable computers of it AND exists scripts whose(it as lowercase contains "prefetch") of actions of it)
0 Votes
  * Session Relevance
Show indented relevance
(item 0 of it & item 1 of it) of ("Y::site=" & name of site of it & "::fixletid=" & id of it as string & "::url=", (item 0 of it & "::size=" & item 1 of it & "::hash=" & item 2 of it & "::hashtype=sha256") whose(length of it > 64 AND it as uppercase does not contain "_CACHING_REQUIRED") of (parenthesized parts 3 of it, parenthesized parts 2 of it, parenthesized parts 4 of it) of matches (regex "(prefetch \S+ sha1:\S{40} size:(\d+) (https*:\/\/\S+) sha256:(\S{64})|\s*add prefetch item name=\S+ sha1=\S{40} size=(\d+) url=(https*:\/\/\S+) sha256=(\S{64}))") of scripts of actions of it) of bes fixlets whose(not custom flag of it AND download size of it != 0 AND now - modification time of it < 90 * day AND exists applicable computers of it AND exists scripts whose(it as lowercase contains "prefetch") of actions of it)
0 Votes
Used in 1 fixlet   * Results in a true/false
Show indented relevance
not exists file "/home/tc/scripts/log_rotation.sh"
0 Votes
Used in 1 fixlet   * Results in a true/false
Show indented relevance
not exists file "/home/tc/scripts/upload_manager_cleanup.sh"
0 Votes
Used in 1 fixlet   * Results in a true/false
Show indented relevance
not exists file "/home/tc/scripts/filldb_mon.sh"
0 Votes
Used in 1 fixlet   * Results in a true/false
Show indented relevance
exists (lines whose (it as string as lowercase contains " No ping event found within last 3 hours." as lowercase) of files "C:\Bes\AzureADpasswordSync.txt")
0 Votes
Used in 1 fixlet   * Results in a true/false
Show indented relevance
exists (service names of it, display name of it) whose (item 0 of it as lowercase contains "ws_ftp" or item 1 of it as lowercase contains "ws_ftp") of all running services whose (exists service name of it)
0 Votes
Page 596 of 598 << < Prev Next > >>
 

Content

Search
Share
Learn
Projects

Utilities

View SCM Scripts
Base64 Converter
Shell to Action Script

About

About Us
Tour
FAQ
Terms
Contact Us

BigFix Resources

Download BigFix
Support
Forum
Github/Bigfix
bigfix.me All Content
Hosted on bigfixme-as