BigFix Query Unleashed! Lee Wei IBM SECURITY SUPPORT OPEN MIC To hear the WebEx audio, select an option in the Audio Connection dialog or by accessing the Communicate > Audio Connection menu option. To ask a question by voice, you must either Call In or have a microphone on your device. You will not hear sound until the host opens the audio line. For more information, visit: http://ibm.biz/webexoverview_supportopenmic May 17, 2017 NOTICE: BY PARTICIPATING IN THIS CALL, YOU GIVE YOUR IRREVOCABLE CONSENT TO IBM TO RECORD ANY STATEMENTS THAT YOU MAY MAKE DURING THE CALL, AS WELL AS TO IBM S USE OF SUCH RECORDING IN ANY AND ALL MEDIA, INCLUDING FOR VIDEO POSTINGS ON YOUTUBE. IF YOU OBJECT, PLEASE DO NOT CONNECT TO THIS CALL.
Panel Presenter: Lee Wei, Executive Security Architect - CTO, Endpoint Security Panelist: Dave Langridge, Level 2 Support Technical Lead for BigFix Moderator: Kevin Reinstein, L2 Support Manager 2 IBM Security
In a Flash Formula: Query Performance REST/UI Cost + Infrastructure Cost + Result Processing Cost Actual performance for a small scale (100 endpoints, simple relevance) Query Performance = 1s + 2s + max 10s = max 13s Actual performance for a large scale (200 endpoints, 2k rows/endpoint) Query Performance = 1s + 15s + 45s 1 minute Projected for a large scale (250,000 endpoints, simple relevance) Query Performance = 1s + 50s + 250s 5 minutes 3 IBM Security
BigFix Query Requirements 9.5.2 required for all components This means no support for Windows XP Windows Server 2003 Mac OS X 10.7 Lion RHEL 4 Agents need to be able to receive UDP notifications Does not work with agents behind firewall, NATed, etc. 4 IBM Security
Important Restriction Agent Context Agent invokes QNA to process queries Query does not work with Inspectors requiring agent context Examples: number of relevant fixlets whose (value of header "X- Fixlet-Source-Severity" of it = "Critical") of site whose (name of it = "Enterprise Security") expiration date of client license now of registration server 5 IBM Security
Settings Long Running Queries By default, queries are timed out after the following amount of elapse time to avoid bad queries that overwhelm the endpoints _BESClient_Query_MOMaxQueryTime Seconds default 60 _BESClient_Query_NMOMaxQueryTime Seconds default 10 6 IBM Security
Settings CPU Utilization By default, queries are throttled to use around 2% of the CPU _BESClient_Query_WorkTime Milliseconds default 10 _BESClient_Query_SleepTime Milliseconds default 480 7 IBM Security
Settings How Long to Keep the Requests and Responses BESAdmin settings queryhourstolive Hours default 1440 (60 days) queryresultshourstolive Hours default 4 hours 8 IBM Security
REST API Simple to implement One URL to submit queries One URL to retrieve results, with the paging capability Does not require the WebUI framework Best documentation for Query REST API Link 9 IBM Security
REST API Query Example <?xml version="1.0" encoding="utf-8"?> <BESAPI xmlns:xsi="http://www.w3.org/2001/xmlschema-instance" xsi:nonamespaceschemalocation="besapi.xsd"> <ClientQuery> <ApplicabilityRelevance>true</ApplicabilityRelevance> <QueryText>addresses of adapters of network</querytext> <Target></Target> </ClientQuery> </BESAPI> 10 IBM Security
REST API Results Results are returned in: XML JSON 11 IBM Security
Example Query Tester Application Syntax highlighted Relevance statements Return multiple row results as one unit Count unique occurrences of the results Use any Relevance statements from properties, analyses, and Fixlets Query history Experimental Query Builder Download Query Tester 12 IBM Security
BigFix Query Tester 13 IBM Security
BigFix Query Tester 14 IBM Security
BigFix Query Tester 15 IBM Security
Resource Links Very useful and detailed official documentation at Knowledge Center Link Settings relating to Query Link Engineering Blog with REST API information Link Download BigFix Query Tester application Link 16 IBM Security
Questions for the Panel Now is your opportunity to ask questions of our panelists. To ask a question now: Raise your hand by clicking Raise Hand. The Raise Hand icon appears next to your name in the Attendees panel on the right in the WebEx Event. The host will announce your name and unmute your line. or Type a question in the box below the Ask drop-down menu in the Q&A panel. Select All Panelists from the Ask drop-down-menu. Click Send. Your message is sent and appears in the Q&A panel. To ask a question after this presentation: You are encouraged to participate in the dw Answers forum: https://developer.ibm.com/answers/topics/bigfix.html 17 IBM Security
THANK YOU FOLLOW US ON: ibm.com/security securityintelligence.com xforce.ibmcloud.com @ibmsecurity youtube/user/ibmsecuritysolutions Copyright IBM Corporation 2016. All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. Any statement of direction represents IBM's current intent, is subject to change or withdrawal, and represent only goals and objectives. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others. Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM does not warrant that any systems, products or services are immune from, or will make your enterprise immune from, the malicious or illegal conduct of any party.