We’ve done some work with one of our clients around PCI compliance type work.
In their case they created TPL patterns to test specific conditions and set a custom attribute on the Host node in question. This allowed them to automatically report on these hosts as they were discovered.
As an example the following trigger will fire a pattern for all unix hosts
// Trigger on the Host node being created (first scan) or confirmed (subsequent scans)
triggers
on host := Host created, confirmed where os_class matches 'UNIX';
end triggers;
We could then get a configuration file with a discovery command:
switch_conf := discovery.fileGet(host, '/etc/switch.conf');
And we can then set a custom attribute on the Host node:
if switch_conf then
// Extract the lines of interest and directly set attributes on the Host node
// We assume that there is a single valid line for each match and use
// multiline (?m) to ensure that the string we are matching is not
// preceeded by a comment character
// We then use text.strip() to remove leading and trailing whitespace rather than doing it the hard way in regex
// Note that these attributes on the Host node will be set to empty string if there is no match
// so are self maintaining
host.switch_services := text.strip(regex.extract(switch_conf.content, regex '(?m)^\s*services:(.+)', raw '\1'));
end if;
We could then report on these hosts with the query:
SEARCH Host WHERE switch_services
SHOW SUMMARY, switch_services AS 'Switch Services'
For writing TPL there is the documentation on Configipedia here; for examples of patterns and queries look at the Pattern Ideas and Power Tips
RSS
Atom