string
Strings are typically core objects, but some string inspectors may be client-specific. Note: A string literal is written within double quotes. Special characters must be inserted by using the percent sign followed by 2 hex digits. Special characters include those characters with ASCII codes less than the 'space' character (hex 20) or greater than 'tilde' character (hex 7f) as well as the percent character itself (25 hex). For example, to create a string containing a null character and a percent character use "a null is %00, the percent itself is %25". Conversion to upper and lower case is also provided. String works in combination with the string position and substring data types. A string position is a point within a string. It can be compared to an integer, but it also acts as a pointer within a string so that the preceding and following text can be extracted. A substring is a part of a larger string. All operations allowed on a string can be performed on a substring. There are two substrings "be" in the string "To be or not to be". The substrings only differ in their positions within the string.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Creation
The architecture represents the CPU type that the RPM Package was designed to be used on. Typical values are i386, i686, or x86_64, but packages can be created with archtectures like 'noarch' or have no architecture specified at all.Example: architecture of package "BESAgent" of rpm - On a SuSE Linux Enterprise Server 9.0, 64 bit, this will return x86_64, while on a Fedora Core 3, 32 bit, it will return i386.
Version | Platforms |
---|---|
8.0.584.0 | Red Hat, SUSE |
8.2.1078.0 | AIX |
9.2.6.94 | CentOS |
9.5.0.311 | Oracle Enterprise Linux |
10.0.0.133 | Amazon Linux 2 |
Returns the base distinguished name of the Identity Provider Directory as a string. It exists only for LDAP identity providers.
- Q: base distinguished name of bes idp directory whose( id of it = 65 )
- A: dc=bigfix,dc=com
Version | Platforms |
---|---|
11.0.2.0 | Session |
As of version 7.2, the BES Console can be branded by third parties who want to use the engine to deliver specific content. This inspector returns a string that identifies any branding associated with the BES Console. The unbranded Console returns 'bigfix', but other third-party brands may result.
Version | Platforms |
---|---|
8.0.584.0 | Session |
Returns a string corresponding to the build number of the OS.
- Q: (build of it, name of it) of operating system
- A: Darwin Kernel Version 14.1.0: Thu Feb 26 19:26:47 PST 2015; root:xnu-2782.10.73~1/RELEASE_X86_64, Mac OS X
- Q: (build of it, name of it) of operating system
- A: #58-Ubuntu SMP Tue Jul 29 16:45:05 UTC 2014, Linux Ubuntu 14.04.1 LTS
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris |
8.1.535.0 | Debian, Ubuntu |
9.0.586.0 | Windows |
9.5.13.130 | Raspbian |
A cidr string (see CIDR_notation at Wikipedia) is a string representation of a cidr address. It looks like an ip address followed by a slash and then the number of leading non-zero bits of the routing prefix. For example, 192.168.0.0/16 for IPv4, and 2001:db8::/32 for IPv6.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the client id of the specified Identity Provider Directory as a string. It exists only for Microsoft Entra ID identity providers.
- Q: client id of bes idp directory whose( id of it = 65 )
- A: 64g6d777-8934-6d52-2gt3-hvch83829hf87
Version | Platforms |
---|---|
11.0.2.0 | Session |
Returns the client product name for a specific agent interface, for example:
- Q: client product of agent interface "EDR" of client
- A: EDR
If that specific agent interface does not exist, the inspector returns "Singular expression refers to nonexistent object".
The plural returns client product names for all the agent interfaces:
- Q: client products of agent interfaces of client
- A: EDR
- A: DEV
Version | Platforms |
---|---|
9.5.5.193 | Windows |
9.5.7.90 | Mac |
Returns a string that corresponds to the codename of the given release. For example, Ubuntu 8.04 has the codename of 'hardy'.
- Q: (codename of it, name of it) of operating system
- A: trusty, Linux Ubuntu 14.04.1 LTS
Version | Platforms |
---|---|
8.1.535.0 | AIX, Debian, HP-UX, Red Hat, SUSE, Solaris, Ubuntu |
9.5.5.193 | Mac |
9.5.13.130 | Raspbian |
A string representation of the codepage portion of the id of this version block. See notes for known codepage strings. For example, 'Unicode'.Example: codepage of only version block of regapp "bigfix.exe" is "Unicode" - Returns True
if the version block codepage for the specified file is unicode.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
This inspector returns a string formatted using the ConvertSidToStringSid function.
- Q: component string of owner of security descriptor of windows folder
- A: S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464
Version | Platforms |
---|---|
8.0.584.0 | Windows |
8.1.535.0 | Mac |
Returns the Corrective Service Disk version of the operating system. This is the szCSDVersion
as returned by the GetVersionEx function. The format varies depending on the installed service packs. For WinNT it contains a string such as 'Service Pack 3', for Win95 it can contain a string such as 'B'.
- Q: (csd version of it, name of it) of operating system
- A: , Win8.1
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Get, from a dictionary, the string keyed by the specified string. Works for objects in a dictionary of type String or Data. If the type is Data, any null terminator will be stripped.Example: string "device_type" of dictionary of node "cpus/CPU0@0" of devicetree plane of iokit registry - Returns a null terminated string from the specified data field, such as 'processor%00'.Example: cstring "device_type" of dictionary of node "cpus/CPU0@0" of devicetree plane of iokit registry - Returns 'processor', stripping off the final null from the specified data field.
Version | Platforms |
---|---|
8.0.584.0 | Mac |
Returns the type of the device (desktop, laptop or server, in case of VMWare virtual systems). The evaluation is determined by the hardware installed, not by the operating system definitions. The result is returned by the WMI, if it is active on the device, otherwise it is determined by the type of battery installed on the device.
Version | Platforms |
---|---|
9.5.2.56 | Windows |
Returns the OS name in a human readable format following different rules for each OS.
On Windows, it returns the value in the ProductName
key.
Example of QnA ran on Windows.
- Q: display name of operating system
- A: Windows Server 2022 Datacenter
On Unix systems, it returns the value of the PRETTY_NAME
key in the os-release file.
Example of QnA ran on Linux.
- Q: display name of operating system
- A: Oracle Linux Server 7.8
On Mac, it returns the macOS codename
.
Example of QnA ran on macOS.
- Q: display name of operating system
- A: macOS Monterey
Version | Platforms |
---|---|
11.0.2.0 | AIX, Debian, Mac, Raspbian, Red Hat, Solaris, SUSE, Ubuntu, Windows |
Returns the Windows operating system version. This inspector returns valid information only on Windows 10 20H2 and later Windows 10 versions. Running this inspector on other Windows operating systems results in an error referring to a nonexistent object.
Running the inspector on Windows 10, OS Build 19042.928:
- Q: display version of operating system
- A: 20H2
Version | Platforms |
---|---|
10.0.3.0 | Windows |
Returns the unique elements of the specified <string set>, removing duplicates and sorting by value.Example: elements of set of ("beta";"beta";"alpha";"gamma";"beta") - Returns the strings alpha, beta, gamma.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the encoding of the database. This is determined using PRAGMA encoding.
The returned string can be either UTF-8
, UTF-16le
(little-endian UTF-16 encoding) or UTF-16be
(big-endian UTF-16 encoding).
- Q: encoding of sqlite database of file "test.db"
- A: UTF-8
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns a string of the encryption type of the WiFi connection. eg: "WEP", "WPA2-PSK"
- Q: (name of it, secured of it, encryption of it) of current networks of wifis of adapters of network
- A: awdl0, False, Unsecured
- T: 34570
Version | Platforms |
---|---|
9.0.586.0 | Windows |
9.5.3.211 | Mac |
Gets the value of the ExcludedInterfaces property from the specified firewall profile. This property contains the list of interfaces excluded from a the profile's firewall rules. For more information, see the MSDN Library entry for INetFwPolicy2.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Returns the name of the interface family. There are about 35 of these, but the most common is AF_INET, or normal IP interface. AF_LINK is used for wifi devices and AF_INET6 is for IP v6 addresses. There are specific inspectors for AF_INET (ip interface) and AF_LINK (link interface). The family name of inspector returns this type as a string corresponding to the #define value in the header file.
Version | Platforms |
---|---|
8.0.584.0 | Mac |
Returns the error message returned by the cryptographic library if the application (the client, console, or web reports, depending on the context) tried to enter FIPS 140-2 compliant mode and failed.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
This inspector returns one of the following hypervisors:
- "Google Cloud Engine"
- "Hyper-V"
- "KVM"
- "QEMU"
- "VIOS"
- "VMware"
- "VirtualBox"
- "Xen"
Running this inspector on an operating system with a different hypervisor or without an hypervisor results in an error referring to a nonexistent object.
Version | Platforms |
---|---|
9.5.3.211 | Windows |
9.5.7.90 | Debian, Red Hat, SUSE, Solaris, Ubuntu |
Retrieves the IcmpTypesAndCodes property for the specified firewall rule. The firewall rule inspectors are wrappers around the Windows Vista Firewall API. For more information, see the MSDN library for INetFwRule.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
A string representation containing both the language and codepage of this version block. The format is 8 hex digits, 4 of the codepage concatenated with 4 of the language. For example, '040904b0'. See notes for known values.Example: id of only version block of regapp "bigfix.exe" is "040904b0" - Returns True
if the given file's version block id is the specified string.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Returns the full path to the executable file that represents the instance of the specified application.
Note: On AIX systems this inspector always returns the error 'expression refers to nonexistent object' because the application path is not available on that platform.
Version | Platforms |
---|---|
9.5.5.193 | AIX, Debian, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the names of the indexes on the table. This is determined by using:
SELECT name FROM sqlite_master WHERE type = 'index' AND tbl_name = ?
For example:
- Q: indices of table "Album" of sqlite database of file "chinook.db"
- A: IPK_Album
- A: IFK_AlbumArtistId
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the name of the entity that signed and issued the certificate. The issuer contains a non-empty distinguished name (DN).
For example, "C=US, ST=California, O=John Doe".
Version | Platforms |
---|---|
9.5.7.90 | AIX, Debian, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns a key and its value from the given structured text file. It iterates over lines that start with the key name (as specified by <string>) followed by an = or : character. When searching, white space is ignored.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
The keys of a dictionary.Example: keys of global dictionary of bundle of folder "iTunes.app" of applications folder - Returns a list of the specified keys, for example: CFBundlePackageType, CFBundleVersion, CFBundleHelpBookName, CFBundleName, CSResourcesFileMapped, LSMulitpleInstancesProhibted, CFBundleDocumentTypes, etc....
Version | Platforms |
---|---|
8.0.584.0 | Mac |
Returns the label of the specified logical volume. If the logical volume contains a filesystem, then then this will be the full pathname of the mount point of the file system, eg. "/home".Example: label of logical volume "splat" of volume group "dave" of logical volume manager - Returns the label associated with the specified logical volume, such as "/splat_mount_point".
Version | Platforms |
---|---|
8.0.584.0 | AIX |
A string representation of the language portion of the id of this version block. For example, 'English (United States)'. See notes for known values.Example: language of version block 1 of regapp "bigfix.exe" = "English (United States)" - Returns True
if the given file's version block language is as specified.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Returns a <string> that can be embedded into an <A> tag that, when clicked, will open the given action's document (in the BES Console) or description page (in Web Reports). Note that link href returns a normal string, not an HTML string.
Version | Platforms |
---|---|
8.0.584.0 | Session |
The link href property does not return an <A> tag but rather returns the value of the href attribute of the <A> tag that would be constructed by the other link inspectors. This allows you to create more flexible linking formats. (See link of <bes computer>). Note that link href returns a string, not an HTML string.
Version | Platforms |
---|---|
8.0.584.0 | Session |
The link href property does not return an <A> tag but rather returns the value of the href attribute of the <A> tag that would be constructed by the other link inspectors. This allows you to create more flexible linking formats. (See link of <bes fixlet>). Note that link href returns a normal string, not an HTML string.
Version | Platforms |
---|---|
8.0.584.0 | Session |
The link href property does not return an <A> tag but rather returns the value of the href attribute of the <A> tag that would be constructed by the other link inspectors. This allows you to create more flexible linking formats. (See link of <bes unmanaged asset>). Note that link href returns a normal string, not an HTML string.
Version | Platforms |
---|---|
8.0.584.0 | Session |
The link href property does not return an <A> tag but rather returns the value of the href attribute of the <A> tag that would be constructed by the other link inspectors. This allows you to create more flexible linking formats. (See link of <bes user>). Note that link href returns a normal string, not an HTML string.
Version | Platforms |
---|---|
8.0.584.0 | Session |
The link href property does not return an <A> tag but rather returns the value of the href attribute of the <A> tag that would be constructed by the other link inspectors. This allows you to create more flexible linking formats. (See link of <bes wizard>). Notice that link href returns a normal string, not an HTML string.Note: This is a Console-only inspector.
Version | Platforms |
---|---|
8.0.584.0 | Session |
Returns a key and its value from the given structured text file that might be locked because it is concurrently opened for writing by another application. It iterates over lines that start with the key name (as specified by <string>) followed by an = or : character. When searching, white space is ignored.
You are supposed to use this inspector to access files that are only being appended to, such as log files, because the files can be changed while the inspector reads them. Otherwise the results can be unpredictable.
This inspector cannot read all kinds of locked files. It fails to open a file if another application has opened the file in an exclusive mode, that is, without allowing others to read the file.
The inspector does not override the access mode or the sharing flag specified to open the file by another application.
Version | Platforms |
---|---|
9.5.7.90 | AIX, Debian, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
The long name of the client process owner.Example: long name of process owner of client - OS X usernames typically have a long and a short form. For a properly installed Agent, long name of process owner of client should return the same as short name, namely 'root'.
Version | Platforms |
---|---|
8.0.584.0 | Mac |
Licensed Program Product(s) of the fileset.Example: (lpp_name of it & " ver = " & version of it as string) of filesets matching "lpp_name = 'bos.terminfo.rte'" of object repository - Returns a formatted list of filesets with the specified Licensed Program Product name.
Version | Platforms |
---|---|
8.0.584.0 | AIX |
Returns the MAC address (AKA hardware address) of the network ip interface object. The mac address is formatted as a string of lower case hex digits separated by '-'.Example: mac address whose (it = "00-61-b1-d1-7d-29") of ip interfaces of network - Returns the mac address of the specified network ip interface object.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the MAC address of the specified network link interface.Example: mac addresses of link interfaces of network - Returns a list of the MAC addresses of the network link interfaces, for example, 00-14-c8-3a-82-11, 00-16-bc-72-2c-57, 00-14-e4-26-fe-4c-14-37, etcetera.Example: mac address of link interface (whose name of it is "fw0") of network - Returns the MAC address of the specified network link interface.
Version | Platforms |
---|---|
8.0.584.0 | Mac |
Returns the name of a specific capability of a specific agent interface. For example:
- Q: name of capability "kill process" of agent interface "EDR" of client
- A: kill process
The plural returns the names of the capabilities for a specific agent interface:
- Q: names of capabilities of agent interface "EDR" of client
- A: quarantine
- A: delete registry value
- A: kill process
- A: quarantine file
- A: update registry value
Version | Platforms |
---|---|
9.5.5.193 | Windows |
9.5.7.90 | Mac |
Returns the name of the specified audit policy subcategory.Example: names of subcategories of category whose (name of it is "System") of audit policy - Returns the names of the subcategories of the 'System' audit policy category. These include Security State Change, Security System Extension, System Integrity, Ipsec Driver and Other System Events.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Returns the name of the operation performend by the binary operator.
- Q: names of binary operators whose (left operand type of it is type "time zone")
- A: concatenate
- A: concatenate
- A: plus
- A: minus
- A: minus
- A: equal
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns one of the following:
- The name of the provider, if there is a virtualization or cloud provider
- On Premises, if the machine is not a virtual one
- Unrecognized, if the machine is a virtual one but the provider is unknown or not supported
- Q: name of cloud provider
- A: Amazon Web Services
- Q: name of cloud provider
- A: Microsoft Azure
Version | Platforms |
---|---|
10.0.0.133 | AIX, Debian, Mac, Raspbian, Red Hat, SUSE, Solaris, Ubuntu, Windows |
Returns the mount point of the filesystem object.Example: names of filesystems - Returns the mount points of the file systems.Example: (name of it, type of it) of filesystems - Returns the names and types of all mounted file systems.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Red Hat, SUSE, Solaris |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
If Terminal Services is available and enabled under NT4/2000/2003/XP/Vista, this inspector returns the result of WTSQuerySessionInformation with WTSUserName. With Terminal Services disabled, it examines the ACLs on the security descriptor of the "winsta0" window station. Under Windows 9x, returns the "Current User" of "SYSTEM\CurrentControlSet\Control" if it exists. Otherwise returns No Such Object.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
8.2.1078.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu |
9.5.13.130 | Raspbian |
Returns the name of the operating system as a string.
- Q: name of operating system
- A: Win8.1
- Q: name of operating system
- A: Linux Ubuntu 14.04.1 LTS
- Q: name of operating system
- A: Mac OS X
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the name of a plugin store key.
- Q: name of key "NOsecureCustomKey1" of plugin store "AWSAssetDiscoveryPlugin"
- A: NOsecureCustomKey1
- Q: name of key "Base_Version" of plugin store "VMwareAssetDiscoveryPlugin"
- A: Base_Version
Version | Platforms |
---|---|
10.0.0.133 | Red Hat, Windows |
Returns a string that uniquely identifies a service pack in the format "base-tl-sp-date". For example, AIX 5.3 at technology level 6 and service pack 3, which was released on the 32nd week of 2007, would be "5300-06-03-0732". Note: older service packs may not have a date portion, and the final service pack at a particular technology level has a SP value of 'CSP'.
Version | Platforms |
---|---|
8.2.1078.0 | AIX |
Returns the name of the setting.Example: names of settings of site "actionsite" - Returns the names of all the settings of the site named "actionsite".
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns a string containing the name of the specified smbios structure as derived from the 'Type' entry in the SMBIOS specification. To create a valid Relevance keyword, some rules are applied to the name: Spaces are replaced with underscoresParenthesized sections are deletedLeading and trailing whitespace is removedUppercase is transformed to lowercaseKeywords beginning with a number have a 'b' prepended.
Version | Platforms |
---|---|
8.0.584.0 | Red Hat, SUSE, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.7.90 | Solaris |
Returns the column name.
- Q: names of columns 0 of rows of statement "select ArtistId, Name from Artist limit 5" of sqlite database of file "chinook.db"
- A: ArtistId
- A: ArtistId
- A: ArtistId
- A: ArtistId
- A: ArtistId
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the name of the table.
- Q: names of tables of sqlite database of file "chinook.db"
- A: Album
- A: Artist
- A: Customer
- A: Employee
- A: Genre
- A: Invoice
- A: InvoiceLine
- A: MediaType
- A: Playlist
- A: PlaylistTrack
- A: Track
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the name of the type.
- Q: names of types whose (it as string starts with "b")
- A: bes product
- A: binary operator
- A: bios
- A: bit set
- A: boolean
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the name of the specified XML DOM node as a string.Example: node names of child nodes of xml document of file "C:\WINDOWS\system32\icsxml\cmnicfg.xml" - Returns a list of the names of each node in the specified XML document.
Version | Platforms |
---|---|
8.0.584.0 | Session, Windows |
9.2.7.53 | Debian, Red Hat, SUSE, Ubuntu |
9.5.13.130 | Raspbian |
Returns the node value, which varies depending on the node type. If the standard interface produces a null type, the inspector throws NoSuchObject.Example: node value of first child of xml document of file "icsxml\cmnicfg.xml" of system folder - Returns the value of the first node in the specified file. If the first statement of the file is <xml version="1.0">, for instance, the name would be "xml" and the value would be version="1.0".
Version | Platforms |
---|---|
8.0.584.0 | Session, Windows |
9.2.7.53 | Debian, Red Hat, SUSE, Ubuntu |
9.5.13.130 | Raspbian |
Returns a string with the bit set padded to 64-bits.
- Q: padded string of bit set "10101"
- A: 0000000000000000000000000000000000000000000000000000000000010101
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the value of parameter <string> for the active Action. Parameters only live as long as the action is active. Among the inspectable parameters is the 'action issue date' that is added to each Action by the BigFix Console at issue time.Example: parameter "action issue date" of action - This inspector returns the date the action was issued, a parameter added to each action by the BigFix Console.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Some Fixlets allow the Console Operator to customize the Action. When they are triggered, the BES Console displays a dialog prompting the user for certain Action parameters. For a given Action, this inspector returns value of the parameter specified by <string>.
Version | Platforms |
---|---|
8.0.584.0 | Session |
Returns the specified patch id string from the package database. Typically used for existence tests.Example: exists patch id "123456-01 345678-23" of pkgdb - Returns True
if these patch ids exist in the package database.Example: exists patch id whose (it contains "123456-01") of pkgdb - Returns True
if the specified patch id exists in the package database.
Version | Platforms |
---|---|
8.0.584.0 | Solaris |
Returns the specified patch id string from the specified pkginfo of the package database. Typically used for existence tests.Example: exists patch id "123456-01" of pkginfo "SUNWrdm" of pkgdb - Returns True
if the designated patch ID exists in the specified pkginfo of the package database.
Version | Platforms |
---|---|
8.0.584.0 | Solaris |
Returns the plural name of the property.
- Q: (singular name of it, plural name of it) of properties of type "boolean"
- A: conjunction, conjunctions
- A: disjunction, disjunctions
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
Returns a string describing the privileges assigned to the specified security account. For more information, see the MSDN article on LsaEnumerateAccountRights. For a description of the possible constants that can be returned, see the articles on Account Rights Constants and Privilege Constants.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Returns a string derived from the GetProductInfo function. Some example values are 'Business', 'Cluster Server', 'Enterprise', 'Home', etc.
- Q: (product info string of it, name of it) of operating system
- A: Business, Win8.1
Version | Platforms |
---|---|
8.0.584.0 | Windows |
8.2.1078.0 | Mac |
9.0.586.0 | AIX, Debian, HP-UX, Red Hat, SUSE, Solaris, Ubuntu |
9.5.13.130 | Raspbian |
Returns the algorithm identifier used to generate the public key. Signature algorithm descriptions can be found in RFC5758 and RFC5480 (which update RFC3279).
Version | Platforms |
---|---|
9.5.7.90 | AIX, Debian, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
This inspector returns the MAC address that the specified BigFix client registered with.Example: registration mac address of client - Returns a MAC address such as 00-1e-c9-4d-ce-5c.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the "ReleaseId" of the Windows operating system which indicates the update level. This is also included in the base string representation of the <operating system> inspector. A value is returned only if the "ReleaseId" is defined on the operating system.
Version | Platforms |
---|---|
9.5.0.311 | Windows |
9.5.3.211 | Mac |
Tries to transcode binary data in binary_string
from the specified encoding to UTF-8. If the conversion succeeds, returns the converted data, if the conversion does not succeed, tries next encodings.
- Q: representations in "UTF-8;euc_jp;Shift_JIS" of (binary_string "e3838fe383ad")
- A: "ハロ"
Version | Platforms |
---|---|
9.5.7.90 | AIX, Debian, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the specified revision string from the given patch. Typically used for existence tests.Example: exists revision "02" of patch "123456" of pkginfo "SUNWrdm" of pkgdb - Returns True
if the specified revision of the given patch in the given pkginfo exists in the package database.Example: exists patch whose (revision of it < "3") of pkgdb - Returns True
if there is a patch in the package database with a revision number less than 3.
Version | Platforms |
---|---|
8.0.584.0 | Solaris |
PPC64 processors only. Returns a string representing what mode the specified processor is running in. If you specifically want to know whether the processor is running in "architected" mode or in "raw" mode, check the "architected" processor property also.
- Q: run mode of main processor
- A: power8
Version | Platforms |
---|---|
9.1.1141.0 | Red Hat |
9.2.0.363 | SUSE |
9.5.0.311 | Ubuntu |
Returns the list of runlevels for which the service is active.
Note: On RedHat 7, this also lists the targets of systemd services.
- Q: (it as string, runlevels of it) of services whose (it as string contains "ssh")
- A: "sshd.service" "sshd" "Stopped", multi-user.target
Version | Platforms |
---|---|
9.2.0.363 | Red Hat, SUSE |
Returns the schema of the table. This is determined by using:
SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?
For example:
- Q: schema of table "Album" of sqlite database of file "chinook.db"
- A: CREATE TABLE Album NOT NULL, [ArtistId] INTEGER NOT NULL, CONSTRAINT [PK_Album] PRIMARY KEY ([AlbumId]), FOREIGN KEY ([ArtistId]) REFERENCES [Artist] ([ArtistId]) ON DELETE NO ACTION ON UPDATE NO ACTION)
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the unique identifying number assigned by the CA. Normally, it is a positive integer no longer than 20 octets long (2160).
Non-conforming CAs may issue certificates with serial numbers that are zero, negative integers, or longer than the specified maximum, however.
Version | Platforms |
---|---|
9.5.7.90 | AIX, Debian, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the bios's serial number.
- Q: serial of hardware
- A: VMware-42 22 c3 6e a0 bb 16 73-86 a8 e4 26 55 c0 3b 96
For AIX
This is the serial number for the physical hardware. Virtualized LPARs running on the same host hardware all return the same serial number.
For Solaris Sparc
Only Solaris 10 8/11 (U10) and later are supported.
If Logical Domains are enabled, this returns a string with the chassis serial number as reported by the Solaris command virtinfo -a
with appropriate permissions.
If Logical Domains aren't enabled, this returns a string with the hostid.
For Solaris x86
The UUID is from the global zone of the running operating system.
If zones are configured, this can only return its value if the zone has access to /dev/smbios. The global zone always returns a value.
Version | Platforms |
---|---|
9.5.7.90 | AIX, Debian, Red Hat, SUSE, Solaris, Ubuntu, Windows |
Returns the session id, which uniquely identifies a logged on user session. A logged-on user is a subclass of a user, and adding the session id uniquely identifies the session.
Version | Platforms |
---|---|
8.0.584.0 | Mac |
Returns the sha2-384 of the file.
- Q: sha2_384 of file "/etc/passwd"
- A: 8bdadbaff533a5b10d2da7929783a76cc9d9ad9a53825aade38776dba07821996c96db90d20e7b6fb502ddd2462701d4
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the sha2-512 of the file.
- Q: sha2_512 of file "/etc/passwd"
- A: ed80a58904b3e73b4b70a11d387f5c18df016fe9c42c36c3f7b265a4e9304d7cd5f040900df25db971846167ba06cfc82c210dc2305c98dab76b09b08f7d6f1f
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the sha2-384 of the file.
- Q: sha384 of file "/etc/passwd"
- A: 8bdadbaff533a5b10d2da7929783a76cc9d9ad9a53825aade38776dba07821996c96db90d20e7b6fb502ddd2462701d4
Version | Platforms |
---|---|
9.1.1065.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the sha2-512 of the file.
- Q: sha512 of file "/etc/passwd"
- A: ed80a58904b3e73b4b70a11d387f5c18df016fe9c42c36c3f7b265a4e9304d7cd5f040900df25db971846167ba06cfc82c210dc2305c98dab76b09b08f7d6f1f
Version | Platforms |
---|---|
9.1.1065.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
The short name of the client process owner.Example: short name of process owner of client - OS X usernames typically have a long and a short form. For a properly installed Agent, short name of process owner of client should return the same as long name, namely 'root'.
Version | Platforms |
---|---|
8.0.584.0 | Mac |
Returns the algorithm identifier used by the CA to sign the certificate. Signature algorithm descriptions can be found in RFC5758 and RFC5480 (which update RFC3279), and RFC4055.
Version | Platforms |
---|---|
9.5.7.90 | AIX, Debian, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the singular name of the property.
- Q: (singular name of it, plural name of it) of properties of type "boolean"
- A: conjunction, conjunctions
- A: disjunction, disjunctions
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
Returns a string that represents the service startup configuration. It describes when the driver is loaded, which can be one of:boot: started by OS loader (usually these are needed to launch the OS).system: started during OS initialization (used by PnP drivers that do device detection after the loader is finished).auto: started by the Service Control Manager (SCM).demand: started on demand, either by PnP manager when a device is enumerated or by the SCM in response to user demand.disabled: can't be started (used to temporarily disable driver services).
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Returns the state of a specific capability of a specific agent interface. For example:
- Q: state of capability "quarantine" of agent interface "EDR" of client
- A: Off
If the capability specified does not exist, the inspector returns "Singular expression refers to nonexistent object".
The plural returns the states of the capabilities supported by a specific agent interface:
- Q: states of capabilities of agent interface "EDR" of client
- A: Off
- A:
- A:
- A:
- A:
The capability "quarantine" is stateful, the possible states are "Off" and "Bigfix"; the remaining four remediation capabilities, instead, are stateless.
Version | Platforms |
---|---|
9.5.5.193 | Windows |
9.5.7.90 | Mac |
Returns, as a string, the state of a fileset on AIX systems. Possible values returned by this inspector are: APPLYING, APPLIED, COMMITTING, COMMITTED, REJECTING, BROKEN, DEINSTALLING, APPLY-HOLD, COMMIT-HOLD, OBSOLETE, EFIXLOCKED, UNKNOWN.
If the state doesn’t match the state of any other <fileset part>, the state of <fileset> property is CONFLICTING.
Version | Platforms |
---|---|
9.5.7.90 | AIX |
Returns, as a string, the state of a fileset on AIX systems. The state is the same as the one displayed in the output of the AIX command "lslpp". Possible values returned by this inspector are: APPLYING, APPLIED, COMMITTING, COMMITTED, CONFLICTING, REJECTING, BROKEN, DEINSTALLING, APPLY-HOLD, COMMIT-HOLD, OBSOLETE, EFIXLOCKED, UNKNOWN.
CONFLICTING indicates a state mismatch of the string returned for any <fileset part>.
Version | Platforms |
---|---|
9.5.3.211 | AIX |
Returns one of Continuing, Pausing, Paused, Running, Starting, Stopping, Stopped, Unknown. The service name must be passed between double quotes (e.g. "BESClient"). On Debian, Raspbian, Ubuntu, AIX, HP-UX and Solaris, the inspector only works for BigFix services. The BigFix service names are: BESClient, BESExplorer, BESFillDB, BESGatherDB, BESPluginPortal, BESRelay, BESRootServer, BESWebReportsServer and BESWebUI.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns one of the following strings: Running = when the action is currently active. Executed = no longer relevant and action has completed. Not Relevant = action was not relevant. Waiting = action is relevant, but waiting to run. Not Executed = action is relevant, unconstrained, but has not yet started. Failed = action is relevant, unconstrained, has completed, but is still relevant.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the status of the activation. This will return one of the following strings:
Activated Locally
- The analysis was activated by a non-master operator.Activated Globally
- The analysis was activated by a master operator.Not Activated
- The analysis is not activated
Version | Platforms |
---|---|
9.2.5.130 | Session |
Get, from a dictionary, the string keyed by the specified string. Works for objects in a dictionary of type String or Data. If the type is Data, any null terminator will be returned as part of the string. Use cstring if you expect a Data object containing a null terminated string.Example: string "FXSearchFieldTarget" of dictionary of file "com.apple.finder.plist" of preferences folder - Returns a string, such as Spcf.
Version | Platforms |
---|---|
8.0.584.0 | Mac |
Returns the entity associated with the public key. The subject contains a non-empty distinguished name (DN).
For example, "C=US, ST=California, O=John Doe".
Version | Platforms |
---|---|
9.5.7.90 | AIX, Debian, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the subscription mode for custom sites and external sites. The subscription mode is one of the following:All: all computers are subscribedNone: no computers are subscribedAdHoc: computers are subscribed via ad-hoc custom site subscription actionsCustom: computers are subscribed via a list of conditions.
Version | Platforms |
---|---|
8.0.584.0 | Session |
Returns the phrase or punctuation mark used to invoke the operator.
- Q: unique values of symbols of binary operators
- A: %
- A: &
- A: *
- A: +
- A: -
- A: /
- A: <
- A: <=
- A: =
- A: contains
- A: ends with
- A: starts with
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the language of the system as a string.
On Windows, this is identified using the GetSystemDefaultLangID function and corresponds to the default locale of the system.
- Q: system language
- A: English (United States)
On Unix, this is identified using:
- The setlocale function.
- The
LANG
environment variable. - The
LC_CTYPE
environment variable.
- Q: system language
- A: English
See also system ui language and user ui language.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Short identifying name of installed software product. Tag is used as identifier in named product accessor.Example: tag of product whose (vendor of it = "BigFix") of software depot - Returns a string such as "BESAgent 4.0.3.7".
Version | Platforms |
---|---|
8.0.584.0 | HP-UX |
If the specified action is targeted by list, then this returns the relevant BES computer names, concatenated into a single string.
Note: Starting from BigFix version 9.0, this inspector returns no value because, due to an internal code change, actions targeted by computer name became targeted by computer ID.
Version | Platforms |
---|---|
8.0.584.0 | Session |
Returns the tenant id of the specified Identity Provider Directory as a string. It exists only for Microsoft Entra ID identity providers.
- Q: tenant id of bes idp directory whose( id of it = 65 )
- A: 83g5d677-3936-6h54-2jk3-hbnh63821hf23
Version | Platforms |
---|---|
11.0.2.0 | Session |
Returns tracking statistics of fixlets with the longest evaluation time. Number of fixlets tracked depends on Tracking settings. Default is top 10 fixlets.
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns a string representing the type of the property group. Each property group has a type corresponding to its purpose. The core property group types are method, dependency, application, and framework. Additional property group types can be introduced, provided they conform to the extended naming convention in smf(5).
Version | Platforms |
---|---|
8.2.1078.0 | Solaris |
Returns a string identifying the type of an smf property. These types can have values of SCF_TYPE_INVALID, SCF_TYPE_BOOLEAN, SCF_TYPE_COUNT, SCF_TYPE_INTEGER, SCF_TYPE_TIME, SCF_TYPE_ASTRING, SCF_TYPE_OPAQUE, SCF_TYPE_USTRING, SCF_TYPE_URI, SCF_TYPE_FMRI, SCF_TYPE_HOST, SCF_TYPE_HOSTNAME, SCF_TYPE_NET_ADDR_V4, SCF_TYPE_NET_ADDR_V6.
Version | Platforms |
---|---|
8.2.1078.0 | Solaris |
Returns a string representation of the type of an smf value. These types can have values of SCF_TYPE_INVALID, SCF_TYPE_BOOLEAN, SCF_TYPE_COUNT, SCF_TYPE_INTEGER, SCF_TYPE_TIME, SCF_TYPE_ASTRING, SCF_TYPE_OPAQUE, SCF_TYPE_USTRING, SCF_TYPE_URI, SCF_TYPE_FMRI, SCF_TYPE_HOST, SCF_TYPE_HOSTNAME, SCF_TYPE_NET_ADDR_V4, SCF_TYPE_NET_ADDR_V6.
Version | Platforms |
---|---|
8.2.1078.0 | Solaris |
Returns the data-type of the column.
- Q: types of column types of table "Album" of sqlite database of file "chinook.db"
- A: SQLITE_INTEGER
- A: SQLITE_TEXT
- A: SQLITE_INTEGER
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the unique instance ID of the virtual machine, or an empty string if the client machine is not a VM, or if it is a VM hosted on an unrecognized cloud provider.
Version | Platforms |
---|---|
10.0.0.133 | AIX, Debian, Mac, Raspbian, Red Hat, SUSE, Solaris, Ubuntu, Windows |
Returns a status message string indicating No Progress, Errors or a string like the following to indicate the upload progress:<filename>: x of <filesize> bytes in <number> seconds.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the gather URL for a given BES site. For example, the gather URL for BES Support is http://sync.bigfix.com/cgi-bin/bfgather/bessupport.
Version | Platforms |
---|---|
8.0.584.0 | Session |
Returns the Locator found in the masthead. A site locator is used to synchronize with the site. It normally contains the URL of a remote file system folder, or the URL of a cgi-bin program that provides a remote directory listing of the site.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the default locale of the SYSTEM
user as a string. It is identified by using the GetUserDefaultLangID function.
- Q: user language
- A: English (United States)
See also system ui language and user ui language.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
If the property can return multiple values, this is the plural name of the property. Otherwise it is the singular name.
- Q: usual names of properties of type "bit set"
- A: padded string
- A: least significant one bit
- A: most significant one bit
- A: right shift
- A: left shift
- A: bit
- A: one bits
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
Returns a string corresponding to the name provided. Values have names such as 'CompanyName', 'FileDescription', 'FileVersion'.Example: value "FileVersion" of version block 1 of regapp "bigfix.exe" as version - When casting a string value to a version, the parser skips through the string until it identifies something that can be interpreted as a version. This is convenient for extracting version numbers from strings containing added text.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Headers are name:value pairs, separated by a colon. This inspector returns the value on the right hand side of the pair.Example: number of relevant fixlets whose (value of header "x-fixlet-source-severity" of it as lowercase = "critical") of site "enterprise security". - Returns the number of critical fixlets in the Enterprise Security site.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the current runlevel. It evaluates to a platform-dependent string indicating the current runlevel. For instance, on Linux the value '3' indicates runlevel 3 and 'S' indicates single user mode.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Red Hat, SUSE, Solaris |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
On Windows, it returns the first string of the multi-string version stored in the BIOS. On macOS, it returns the string version stored in the BIOS. The format depends on your BIOS manufacturer.
Running the inspector on Windows:
- Q: version of bios
- A: INTEL - 6040000
Running the inspector on macOS on an Intel CPU:
- Q: version of bios
- A: 426.0.0.0.0
Running the inspector on an unsupported OS and/or hardware:
- Q: version of bios
- E: Singular expression refers to nonexistent object.
Version | Platforms |
---|---|
8.0.584.0 | Mac, Windows |
Returns a version number for the specified pkginfo object. Not to be confused with revision numbers of patches. This is the same as the VERSION parameter of the pkginfo.Example: version of pkginfo "SPROhtws" of pkgdb - Returns a version string like "8.0,REV=2003.04.02".
Version | Platforms |
---|---|
8.0.584.0 | Solaris |
This inspector returns the version string stored in the BIOS.
Running the inspector on Windows:
- Q: version string of bios
- A: INTEL - 6040000
- Q: version strings of bios
- A: INTEL - 6040000
- A: PhoenixBIOS 4.0 Release 6.0
- A: 6.00
- A: None
Version | Platforms |
---|---|
8.2.1078.0 | Windows |
Returns the subnet the client is in for Wake on Lan (WoL) purposes. The client sends information to the relay during registration that is used to decide which subnet the client is in. The relay returns the subnet to the client, which is the value this inspector exposes. This value is used to send WoL commands to forwarders. To wake a machine by computer ID, the server looks up the mac address and subnet of that machine. It then tries to identify clients that have been configured as WoL forwarders within the same subnet and routes WoL commands to those forwarders, sending them the mac address of the machine that needs to be awoken.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns a short description of the operator.
- Q: binary operators whose (it as string contains "regular")
- A: <string> contains <regular expression>: boolean
- A: <string> = <regular expression>: boolean
- A: <regular expression> = <string>: boolean
- A: <string> starts with <regular expression>: boolean
- A: <string> ends with <regular expression>: boolean
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Interprets binary data in binary_string as UTF-16 and converts to string on Windows systems. Interprets binary data in binary_string as UTF-8 and converts to string on non-Windows systems.
Version | Platforms |
---|---|
9.5.3.211 | AIX, Debian, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
This inspector returns the BIOS version for macOS and the BIOS date for Windows platforms. Running this inspector on other operating systems results in an error referring to a nonexistent object.
Running the inspector on Windows:
- Q: bios as string
- A: 12/12/2018
Running the inspector on macOS on an Intel CPU:
- Q: bios as string
- A: 426.0.0.0.0
Running the inspector on an unsupported OS and/or hardware:
- Q: bios as string
- E: Singular expression refers to nonexistent object.
Version | Platforms |
---|---|
8.0.584.0 | Mac, Windows |
Decodes the <html> per the numerical reference in markup rules (https://en.wikipedia.org/wiki/Numeric_character_reference).
Version | Platforms |
---|---|
9.5.0.311 | AIX, Debian, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Compresses the IP address, using double colons to stand in for repeated zeroes in the address.Example: ("0:0:0:0:0:ffff:c0a8:16a" as ipv4or6 address) as compressed string - Returns "::ffff:c0a8:16a", a compressed string with a double colon standing in for leading zeroes.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Similar to casting to a string, but with both colon-compression and standard IPv4 representation for the low 32-bits.Example: ("0:0:0:0:0:ffff:c0a8:16a" as ipv4or6 address) as compressed string with ipv4 - Returns "::ffff:192.168.1.106", a compressed string (leading zeroes collapsed to ::) with a four-byte IPv4 address as the lower 32 bits.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Creates a compressed string (replacing multiple zeroes with double colons) with the lower 32 bits in IPv4 format. It includes the zone index (on Windows, typically a number) following a percent sign (%).
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Creates a compressed string (replacing multiple zeroes with double colons) and includes the zone index (on Windows, typically a number) following a percent sign (%).
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns a string representation of the IPv6 address in the form x:x:x:x:x:x:x:x, where each x represents one to four hexadecimal digits of the eight 16-bit address fields. Leading zeros in an individual field are omitted. See RFC 4291 section 2.2, item 1.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Creates a string containing the package's name, version and release.Example: package "apache" of rpm as string - Returns a string with information about the package, such as "apache-1.3.23-88".
Version | Platforms |
---|---|
8.0.584.0 | Red Hat, SUSE |
8.2.1078.0 | AIX |
9.2.6.94 | CentOS |
9.5.0.311 | Oracle Enterprise Linux |
10.0.0.133 | Amazon Linux 2 |
Returns the type of value as a string. One of REG_SZ, REG_NONE, REG_DWORD, REG_LINK, REG_BINARY, REG_MULTI_SZ, REG_EXPAND_SZ, REG_RESOURCE_LIST, REG_DWORD_LITTLE_ENDIAN, REG_DWORD_BIG_ENDIAN, REG_FULL_RESOURCE_DESCRIPTOR, REG_RESOURCE_REQUIREMENTS_LIST.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Returns a string that uniquely identifies a service pack in the format "base-tl-sp-date". For example, AIX 5.3 at technology level 6 and service pack 3, which was released on the 32nd week of 2007, would be "5300-06-03-0732". Note: older service packs may not have a date portion, and the final service pack at a particular technology level has a SP value of 'CSP'.
Version | Platforms |
---|---|
8.2.1078.0 | AIX |
Returns a string representation of the smf fmri object. The string has the general form 'svc:<service name>:<service instance>'. For example 'svc:/network/login:rlogin', where 'svc' signifies an SMF service, '/network/login' is the service name, and 'rlogin' is the service instance.
Version | Platforms |
---|---|
8.2.1078.0 | Solaris |
A string representation of an smf property group. An smf property group is a group of name/value pairs that represent configuration settings. Thus, there are some configuration settings that are applicable in general to a particular type of service, and others that are applicable only to a particular instance of a service.
Version | Platforms |
---|---|
8.2.1078.0 | Solaris |
Returns the column as name: type
.
- Q: column types of table "Album" of sqlite database of file "chinook.db" as string
- A: AlbumId: SQLITE_INTEGER
- A: Title: SQLITE_TEXT
- A: ArtistId: SQLITE_INTEGER
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the value of the column as a string.
- Q: columns 0 of rows of statement "select ArtistId, Name from Artist limit 5" of sqlite database of file "chinook.db" as string
- A: 1
- A: 2
- A: 3
- A: 4
- A: 5
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Write the columns in the row as a CSV string.
- Q: rows of statement "select * from Artist limit 5" of sqlite database of file "chinook.db" as string
- A: 1,AC/DC
- A: 2,Accept
- A: 3,Aerosmith
- A: 4,Alanis Morissette
- A: 5,Alice In Chains
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the name of the table.
- Q: tables of sqlite database of file "chinook.db"
- A: Album
- A: Artist
- A: Customer
- A: Employee
- A: Genre
- A: Invoice
- A: InvoiceLine
- A: MediaType
- A: Playlist
- A: PlaylistTrack
- A: Track
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
A Macintosh version is of the form: Major.Minor.ReleaseStageBuild. The stage directly precedes the final (Build) number. Most versioning schemes use a period, but the Mac allows for d, a, b and f standing for Development , Alpha, Beta and Final. The period has a higher value than Final. The stage is used in version comparisons and is ranked higher than the build number. For instance, 7.1.2a43 is less than 7.1.2f42 because a is lower than f, even though the final number is bigger.Example: stage of version "7.1.2b70" - Returns b.
Version | Platforms |
---|---|
8.0.584.0 | Mac |
Returns a string in MIME format of the given time object. The format is: ddd, DD mmm YYYY HH:MM:SS sZZZZ. The string is formatted using the local time zone.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns a string in MIME format of the given time object. The format is:ddd, DD mmm YYYY HH:MM:SS +0000The string is formatted using the universal time zone.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns a list of user attributes. These can be inspected for value and key, but this inspector concatenates them so the cast yields a string of the form "key: value". These attributes are gathered from the LocalHost node of Apple's OpenDirectory system (much like ActiveDirectory). For more information, see the Apple developer site.
Version | Platforms |
---|---|
8.0.584.0 | Mac |
Turns a version type into a string of the form "1.2.3.4".Example: version of regapp "bigfix.exe" as string = "1.0.45.0" - Returns True
if the BigFix application has the specified version.Example: version of package "BESAgent" of rpm as string = "3.1.0.19-1" - TRUE if the BESAgent program has the given version.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Properties
Returns an HTML snippet with the specified string enclosed in an <abbr> tag modified by the first given string.
- Q: abbr "title=%22BigFix%22" of "bf"
- A: <abbr title="BigFix">bf</abbr>
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the various possible binary inspectors that use the specified operators.
- Q: binary operators "starts with"
- A: <string> starts with <regular expression>: boolean
- A: <string> starts with <string>: boolean
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Converts a string to a capability object for rpm dependency version comparisons. Strings with version information take the form capability relation version, where relation is one of {<,>,>=,<=,=}. If a relation and version are not specified, then comparisons will assume a capability at any version number.
Version | Platforms |
---|---|
8.0.584.0 | Red Hat, SUSE |
8.2.1078.0 | AIX |
Returns a case-insensitive Perl regular expression from the supplied string. This inspector is available on Solaris but only on x86 and x64 architectures.
Version | Platforms |
---|---|
10.0.8 | Windows |
11.0.0 | Debian, Mac, Raspbian, Red Hat, SUSE, Solaris, Ubuntu |
11.0.3 | AIX |
Returns an object representing a POSIX compliant, case-insensitive, regular expression corresponding to the supplied string. This inspector is available on Solaris but only on x86 and x64 architectures.
Version | Platforms |
---|---|
11.0.3 | AIX, Debian, Mac, Raspbian, Red Hat, SUSE, Solaris, Ubuntu, Windows |
Returns a string of length 1 made by taking the character identified by <integer> from the string. Numbering begins at zero.
- Q: character 1 of "hello"
- A: e
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
This inspector concatenates the string items in the second argument with a separator defined by the string argument.
- Q: concatenation ", " of ("foo"; "bar"; "baz")
- A: foo, bar, baz
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the date the custom site (specified by <string>) was last subscribed or unsubscribed. It is used internally by BES to manage custom site subscriptions.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Converts the given string into a date. The string should be of the form 'Day Month Year' and the returned date will be of the form 'Day of week, Day Month Year'.
- Q: date "11 Mar 1984"
- A: Sun, 11 Mar 1984
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the Debian package version object created parsing the specified version string.
- Q: debian package version "1.10.1"
- A: 1.10.1
- Q: debian package version "1:9.10.3.dfsg.P4-12.3+deb9u4"
- A: 1:9.10.3.dfsg.P4-12.3+deb9u4``
Version | Platforms |
---|---|
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the Debian package version revision object created parsing the specified string.
- Q: debian package version revision "2"
- A: 2
- Q: debian package version revision "12.3+deb9u4"
- A: 12.3+deb9u4
Version | Platforms |
---|---|
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the Debian package upstream version object created parsing the specified string.
- Q: debian package version upstream "1.10.1"
- A: 1.10.1
- Q: debian package version upstream "9.10.3.dfsg.P4"
- A: 9.10.3.dfsg.P4
Version | Platforms |
---|---|
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Interprets a distinguished name in the textual format described by RFC 2253 and used by LDAP/Active Directory.
- Q: distinguished name "CN=bearmo,OU=bears,DC=example,DC=com"
- A: CN=bearmo,OU=bears,DC=example,DC=com
Version | Platforms |
---|---|
8.0.584.0 | Session, Windows |
Returns the user object corresponding to the specified name.
Since version 8.1.535.0, "domain user <string>" returns <user> type. See domain user <string> : user.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
This inspector is available in relevance subsitution action processing. It returns a file object with the given name from the client's download folder.
This is equivalent to:
file "name" of download folder
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
This inspector is available in relevance subsitution action processing. It returns a string corresponding to the download path of the specified file. This inspector, along with download folder and download file, is designed to be used during the prefetch process of action execution.
This is equivalent to something like:
(pathname of download folder) & "\myfile".
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns an encoding object corresponding to the name provided in string. The name should be a name of encoding defined by the International Components for Unicode (ICU). An encoding object can be used with a file object to read it in the specified encoding.
Version | Platforms |
---|---|
9.5.5.193 | AIX, Debian, Mac, Red Hat, SUSE, Solaris, Ubuntu, Windows |
This expression allows you to output your own user-defined error message, typically in the 'else' clause of an 'if/then/else' statement.
- Q: error "hodor!"
- E: User-defined error: hodor!
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the named event log, which contains historical information that help to track down system and security problems. There are several distinct logs that you can specify, including:Application log: records application eventsSecurity log: recirds global or local policy audit eventsSystem log: records OS events.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Uses the Windows ExpandEnvironmentStrings API to translate a string containing special Windows environment variables.
- Q: expand environment string of "%25windir%25\my.dll"
- A: C:\Windows\my.dll
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Uses the Windows ExpandEnvironmentStrings API to translate a string containing special Windows environment variables.
- Q: expand x32 environment string of "%25windir%25\my.dll"
- A: C:\Windows\my.dll
Version | Platforms |
---|---|
9.0.586.0 | Windows |
Given an environment string such as %ProgramFiles%, this inspector expands it to 'C:\Program Files (x86)'. Although similar to 'expand environment string of <string>', this inspector works on 64-bit Windows systems only. On a 32-bit system, it returns 'No Such Object'.
Version | Platforms |
---|---|
8.1.535.0 | Windows |
Returns the same output as concatenation <string> of <string> : string, but input values are filtered to the current fxf encoding.
Version | Platforms |
---|---|
9.5.0.311 | AIX, Debian, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the same output as concatenation of <string> : string, but input values are filtered to the current fxf encoding.
Version | Platforms |
---|---|
9.5.0.311 | AIX, Debian, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
This reads a 32 bit integer from the MacOS. The selector name is the four character OSType that chooses which item is being inspected. The interpretation of the result depends on the selector. It might represent an integer or a version, for instance.
Version | Platforms |
---|---|
8.0.584.0 | Mac |
Creates a string from the given hexadecimal value.
The output depends on the locale of the computer where the inspector is executed. If the hexadecimal string cannot be converted, it displays an error message stating "Input is not valid hexadecimal.".
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns a filesystem object with the specified item name. The Macintosh has two different path types it can output. HFS (Hierarchical File System) was an OS9 format where the path separator was ':' and there were multiple roots (each volume). POSIX has superseded HFS and is single rooted with '/' as a separator. All of the Macintosh inspectors that are not otherwise specified default to the POSIX version.
Version | Platforms |
---|---|
8.0.584.0 | Mac |
Returns an HTML snippet enclosed in a tag specified by the string, modified by the html attribute list and bracketing the html argument.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns an HTML snippet enclosed in a tag specified by the first string, modified by the html attribute list and bracketing the second string argument.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the same output as concatenation <string> of <string> : string, but the input values are filtered to the current local encoding.
Version | Platforms |
---|---|
9.5.0.311 | AIX, Debian, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the same output as concatenation of <string> : string, but the input values are filtered to the current local encoding.
Version | Platforms |
---|---|
9.5.0.311 | AIX, Debian, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns a local group corresponding to the given name, such as Adminstrator, Guests, and others. For backward compatibility, the 'as string' cast of this inspector only returns the user name, not the other components of the sid. For all parts, use 'component string' instead.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Returns the Active Directory local user object for the specified local user. This allows inspection of AD properties for that user, whether cached or currently logged in.
Since version 8.1.535.0, "local user <string>" returns <user> type. See local user <string> : user.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Returns the local user object specified by the name <string>.
On Unix/Linux platform with Bigfix client version below 9.5, this returns only logged-on users. Since 9.5, this returns all local users, logged in or not.
Version | Platforms |
---|---|
8.1.535.0 | Windows |
8.2.1078.0 | AIX, Debian, HP-UX, Red Hat, SUSE, Solaris, Ubuntu |
9.0.586.0 | Mac |
9.5.13.130 | Raspbian |
Returns an HTML snippet with the specified string enclosed in an <ol><li> tag, where the <ol> tag is modified by the first given string.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
This inspector is a synonym for the parameter <string> of <action>. It looks up the value of the action parameter specified by <string>. This is used in conjunction with the parameter set command.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Immediately after running an action requires restart command like:
action requires restart "PatchGroupX"
The following expression will be true until the next restart:
pending restart "PatchGroupX"
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the plugin store object whose name matches the provided string. You can use the following asset discovery plugins:
AWSAssetDiscoveryPlugin
to inspect AWS assetsAzureAssetDiscoveryPlugin
to inspect Azure assetsVMwareAssetDiscoveryPlugin
to inspect VMware assets
- Q: plugin store "AWSAssetDiscoveryPlugin"
- A: AWSAssetDiscoveryPlugin
Version | Platforms |
---|---|
10.0.0.133 | Red Hat, Windows |
Returns an object representing a POSIX compliant regular expression corresponding to the supplied string. This inspector is available on Solaris but only on x86 and x64 architectures.
Version | Platforms |
---|---|
11.0.3 | AIX, Debian, Mac, Raspbian, Red Hat, SUSE, Solaris, Ubuntu, Windows |
Returns an application for the name provided it has recently executed. The name is assumed to be the last part of an executable file name.
Version | Platforms |
---|---|
8.0.584.0 | Red Hat, SUSE, Windows |
8.1.535.0 | Debian, Solaris, Ubuntu |
9.5.3.211 | Mac |
9.5.13.130 | Raspbian |
Returns the RPM package version record object created parsing the specified string.
- Q: rpm package version record "1.0.5-7.el6_0"
- A: 1.0.5-7.el6_0
- Q: rpm package version record "1:2.28.4-4.el6"
- A: 1:2.28.4-4.el6
Version | Platforms |
---|---|
8.0.584.0 | Red Hat, SUSE |
8.2.1078.0 | AIX |
Returns an application for the name provided it is currently executing. The name is assumed to be the last part of an executable file name.
Version | Platforms |
---|---|
8.0.584.0 | Red Hat, SUSE, Windows |
8.1.535.0 | Debian, Solaris, Ubuntu |
9.5.3.211 | Mac |
9.5.13.130 | Raspbian |
Returns the running service object matching the name provided. The service name must be passed between double quotes (e.g. "BESClient"). On Debian, Raspbian, Ubuntu, AIX, HP-UX and Solaris, the inspector only works for BigFix services. The BigFix service names are: BESClient, BESExplorer, BESFillDB, BESGatherDB, BESPluginPortal, BESRelay, BESRootServer, BESWebReportsServer and BESWebUI.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the service object matching the name provided, regardless of its running state.On a Macintosh, returns a <dummy> type. The service name must be passed between double quotes (e.g. "BESClient"). On Debian, Raspbian, Ubuntu, AIX, HP-UX and Solaris, the inspector only works for BigFix services. The BigFix service names are: BESClient, BESExplorer, BESFillDB, BESGatherDB, BESPluginPortal, BESRelay, BESRootServer, BESWebReportsServer and BESWebUI.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Red Hat, SUSE, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the sha2-384 of the string.
- Q: sha2_384 of "bigfix"
- A: 073f25784413df63213f501404737ddb37c9d796d4e43c5d0877dd190b2d5da0761fc28d91e799b12748fe6b1320f869
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the sha2-512 of the string.
- Q: sha2_512 of "bigfix"
- A: 2d142f89401703e3227bd27d77f6e24dabac79e50dd4b4388e8d2d712e68c2b307a1661d647b24538f796428696e7a8a6c5a051a6b4c50a605c61001ff29c96d
Version | Platforms |
---|---|
9.0.586.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the sha2-384 of the string.
- Q: sha2_384 of "bigfix"
- A: 073f25784413df63213f501404737ddb37c9d796d4e43c5d0877dd190b2d5da0761fc28d91e799b12748fe6b1320f869
Version | Platforms |
---|---|
9.1.1065.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns the sha2-512 of the string.
- Q: sha512 of "bigfix"
- A: 2d142f89401703e3227bd27d77f6e24dabac79e50dd4b4388e8d2d712e68c2b307a1661d647b24538f796428696e7a8a6c5a051a6b4c50a605c61001ff29c96d
Version | Platforms |
---|---|
9.1.1065.0 | AIX, Debian, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Ubuntu, Windows |
9.5.13.130 | Raspbian |
Returns a substring of the specified string as defined by the start and length. The first integer is the start and the second integer is the length.
- Q: substring (2, 2) of "abcdef"
- A: cd
- Q: substrings (integers in (0, length of it, 2), 2) of "abcdef"
- A: ab
- A: cd
- A: ef
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Iterates through the string returning all the substrings matching the name given.
- Q: number of substrings "be" of "to be or not to be"
- A: 2
- Q: preceding texts of substrings "be" of "to be or not to be"
- A: to
- A: to be or not to
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns the substring in the second string found between two instances of the first string.
- Q: substrings between "." of "abc.def.hij.klm"
- A: def
- A: hij
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns a substring (or set of substrings) delimited by the first string.
- Q: substrings separated by "," of "1,2,3"
- A: 1
- A: 2
- A: 3
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Parses the given string as if it were a tuple result string and returns the string which is the nth item of the tuple. The tuple inspectors used to be session-only, but as of version 8.0, they are core inspectors, available to all platforms at all times.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
8.2.1175.0 | Mac |
9.5.13.130 | Raspbian |
Parses the given string as if it were a tuple result string and iterates over the <string> objects that make up the tuple. The tuple inspectors used to be session-only, but as of version 8.0, they are core inspectors, available to all platforms at all times.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
8.2.1175.0 | Mac |
9.5.13.130 | Raspbian |
Returns the unique values of a given list of <string> types, removing duplicates and sorting by value. As of version 6.0 of BES, this inspector returns a <string with multiplicity>.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns an HTML snippet with the specified string enclosed in a <ul><li> (unordered list item) tag modified by the first given string.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Returns an object corresponding to the 64-bit application specified by <string>. On a 32-bit computer, this is equivalent to a normal application inspector, but on a 64-bit machine, this inspector returns an object that has filesystem redirection disabled.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Returns an object corresponding to a 64 bit file with pathname specified by <string>. On a 32-bit computer, this is equivalent to a normal file inspector, but on a 64-bit machine, this inspector returns an object that has filesystem redirection disabled.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Returns a filesystem object corresponding to a 64-bit folder with the given pathname. On a 32-bit computer, this is equivalent to a normal folder inspector, but on a 64-bit machine, this inspector returns an object that has filesystem redirection disabled. This action is transitive: any resulting filesystem objects will also have redirection disabled. For example, "pathnames of files of x64 folder <path>" will disable redirection when locating the folder, iterating over the files in the folder and calculating pathnames.
Version | Platforms |
---|---|
8.0.584.0 | Windows |
Casts
Converts the provided string into the corresponding integer value. If the string contains anything but a number, the conversion will fail. Use numeric value
for more liberal parsing rules.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Converts the provided string into the corresponding 128-bit signed integer value. If the string contains anything but a number, the conversion will fail. Use numeric value
for more liberal parsing rules.
Version | Platforms |
---|---|
11.0.2.0 | AIX, Debian, Mac, Raspbian, Red Hat, SUSE, Solaris, Ubuntu, Windows |
Converts the provided string into the corresponding unsigned integer value. If the string contains anything but a number, the conversion will fail. Use numeric value
for more liberal parsing rules.
Version | Platforms |
---|---|
11.0.1.0 | AIX, Debian, Mac, Raspbian, Red Hat, SUSE, Solaris, Ubuntu, Windows |
Returns a version if the string can be parsed as a version. The first numeric set of characters delimited with period, comma or comma-space is returned.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
9.5.13.130 | Raspbian |
Operators
Returns True
if the regular expression is equal to the specified string.Example: regex ".+match.+" = "We will win the match tonight" - Returns True
.Example: regex ".PATH." = line 1 of file "/etc/profile" - Returns True
if the word "PATH" exists in line 1 of the given file.
Version | Platforms |
---|---|
8.0.584.0 | AIX, HP-UX, Mac, Red Hat, SUSE, Session, Solaris, Windows |
8.1.535.0 | Debian, Ubuntu |
Returns a string containing a comment associated with the specfied local group (Administrator, Guest, Users).Example: comment of local group "Administrators" - Returns the string "Administrators have complete and unrestricted access to the computer/domain".