About patterns
For collecting data from remote Systems or Devices the Patterns are used to describe how to get information and transforming that to Discovery-Objects. The best way to see which Objects are possible is to generate Host and Device Examples with "Discovery.exe -e".
Pattern Structure
A Pattern is a XML File wich can contain the following Nodes:
Node | Mandatory | Description |
---|---|---|
<Version> | A version string for the pattern | |
<PatternID> | A unique string for each pattern | |
<AlternativePattern> | A pattern that will be used instead of that one (e.g. used for PowerShell) | |
<ProcessType> | Describes which type of execution will be proceed by the Discovery-Tool to collect information. All possible Process Types are listed under 1.1. | |
<PatternType> | Describes for which type of Discovery-Object the pattern is responsible. All possible Pattern Types are listed under 1.2. | |
<OrderNr> | It is possible to have multiple Pattern for one Discovery-Object, the order number is used to set in which order the Pattern are executed. (For example you can see in the pattern folder 3 Pattern for Linux Network Interface) | |
<Command> | Contains the Command that will be executed on the Remote-System. The command depends on the Process Type examples are listed under 1.1: | |
<Processing> | Contains the C# SourceCode to processing result data to Discovery-Objects. For more details see Creating Custom Pattern | |
<IgnoreCommandCache> | If set to true, the CommandProvider will not observe the cache. Per default a command result will be stored in the cache and the result of the same command will be read from the cache. The cache is just persistent for a scan session. | |
<RegValue> | The Registry Variable that would be read in combination with the Command used by WMIRegValue. | |
<ApplicationName> | The name of the application that is used to collect extended information for | |
<ContextName> | Optional SNMP Walk context name | |
<WMINamespace> | define an alternative WMI Namespace for the initial command |
Process Types
Type | Example Command | Command Result Type | Description |
---|---|---|---|
SSHExecute | ifconfig -a | String | Executes a SSH Command on a connected Remote Unix System |
WMIQuery | SELECT * FROM Win32_OperatingSystem | ManagementObjectCollection | Executes a WMI Query on a connected Remote Windows System |
WMIExecute | netstat -an | String | Executes a Command on a connected Remote Windows System |
WMIRegValue | <![CDATA[ | The result object can any type of a registry value | By WMIRegValue the Command contains the Registry Path and reads the Value described in the <RegValue> Node of the Pattern. The "Root" is set by default to "HKEY_LOCAL_MACHINE\" and should not included in the command. The Result is an object containing all Variations of an Registry Variable. |
WMIRegValueList | <![CDATA[ | List<string> | By WMIRegValueList the Command contains the Registry Path and returning the "subKeys" of the Registry Path. The "Root" is set by default to "HKEY_LOCAL_MACHINE\" and should not included in the command. |
PowerShellExecute | Get-WmiObject win32_computersystem | String | Executes a PowerShell-Command on a connected Remote Windows System |
SNMP_GET | 1.3.6.1.4.1.2021.4.5.0;1.3.6.1.4.1.2021.4.6.0 | ExtendedInformation is an object with two attributes: | Executes a SNMP GET Command for the given MIB's. Returning a List of ExtendedInformation, a ExtendedInformation containing the Name (the MIB) and the Value of the MIB. |
SNMP_WALK | 1.3.6.1.2.1.2.2.1.2;1.3.6.1.2.1.4.20.1.2 | ExtendedInformation is an object with two attributes: | Executes a SNMP WALK Command for the given MIB's. Returning a List of ExtendedInformation, a ExtendedInformation containing the Name (the MIB) and the Value of the MIB. |
Command Result Types
In Discovery 3 version every Pattern Process Type has a Command Result implementation.
Process Type | Command Result Type |
---|---|
WMIQuery | WMIQueryResult |
WMIRegValue | WMIRegValueResult |
WMIRegValueList | WMIRegValueListResult |
WMIExecute | WMIExecuteResult |
PowerShellExecute | PowerShellExecuteResult |
SSHExecute | SSHExecuteResult |
SNMP_GET | SNMPExecuteResult |
SNMP_WALK | SNMPExecuteResult |
VIMObject | VIMCommandResult |
Pattern Types
The pattern type defines which type of Discovery-Object are returning as result from the processing.
The result of Discovery-Objects will be merged. For example in the Discovery/pattern folder you can see multiple HostInfo pattern, they are all collecting partial results of a host and the Discovery-Tool merging the Attributes together.
Type | example Pattern (inlcuded) | Description |
---|---|---|
Host | Linux_Hostinfo_Hostname.pat Windows_Hostinfo_Hostname_Model.pat | Processing collected data for a Host. The pattern function (PerformAction) processing a HostInfo-Object. |
Deviceinfo | SNMP_Deviceinfo_Default.pat | Processing collected data for a Host or a Device. The pattern function (PerformAction) processing a DeviceInfo-Object. |
Network | Linux_NetworkInterfaces.pat Windows_NetworkInterfaces.pat | Processing collected data for NetworkInterfaces. The pattern function (PerformAction) processing the NetworkInterface-Objects of the parent system. |
CPU | Linux_CPUs.pat Windows_CPUs.pat | Processing collected data for CPUs. The pattern function (PerformAction) processing the CPUInfo-Objects of the parent system. |
OS | Linux_OS.pat Windows_OS.pat | Processing collected data for OS. The pattern function (PerformAction) processing the OSInfo-Objects of the parent system. |
FileSystem | Linux_FileSystem.pat Windows_FileSystem.pat | Processing collected data for FileSystems. The pattern function (PerformAction) processing the FileSystemInfo-Objects of the parent system. |
Application | Linux_Application_RPM.pat Windows_Application_Product.pat | Processing collected data for Applications. The pattern function (PerformAction) returning a list of ApplicationInfo-Objectsof the parent system. |
Patch | Windows_Patches.pat | Processing collected data for Patches. The pattern function (PerformAction) processing the PatchInfo-Objects of the parent system. |
ApplicationService | Windows_ApplicationServices.pat | Processing collected data for ApplicationServices. The pattern function (PerformAction) processing the ApplicationServiceInfo-Objects of the parent system. |
OSProductKey | Windows_ProductKey.pat | Processing collected data for License. The pattern function (PerformAction) processing the License for the Operating-System |
ApplicationProductKey | Example: Application Product Key | Processing collected data for License. The pattern function (PerformAction) processing the License for the Applications of the parent system. |
User | Linux_User.pat Windows_User.pat | Processing collected data for User. The pattern function (PerformAction) processing the User of the parent system. |
Group | Linux_Group.pat Windows_Group.pat | Processing collected data for Groups. The pattern function (PerformAction) processing the Groups of the parent system. |
ConnectedPeripherie | Windows_Peripherie_USB_Storage.pat | Processing collected data for Extended Informations. The pattern function (PerformAction) processing the ExtendedInformation-Objects of the parent system. |
SNMPExtendedValues | SNMP_Deviceinfo_ExtExampleRAM.pat | Processing collected data for Extended Informations. The pattern function (PerformAction) processing the ExtendedInformation-Objects of the parent system. |
ConnectedPeripherie | Windows_Peripherie_USB_Storage.pat | Processing collected data for Connected Devices of the parent system. |
HostinfoList | Windows_VBox_VMs.pat Linux_VBox_VMs.pat | Processing collected data for a lis of Virtual Guests The patten function (PerformAction) processing the Host-Objects (like virtual guest machines) of the parent system. |
PostProcessing | Post Processing pattern will be executed after all the pattern types and can be used to add or modify host/device information The pattern function (PerformAction) returning a HostInfo- or a DeviceInfo-Object. |
Creating custom patterns
For creating a custom pattern navigate to the Discovery/pattern folder. Here you can create a new file (UTF-8) with the ending .pat or you copy and modifying an existing pattern of the Pattern-Type you want. The best practice to develop and test a new pattern is to extract a separate Discover-Tool Instance and setting up a connection to the Host or Device that returning the result data you want to handle with.
Then remove all Pattern excluding a "main" HostInfo Pattern (Linux_Hostinfo_Hostname.pat, Windows_Hostinfo_Hostname_Model.pat, SNMP_Deviceinfo_Default.pat) it is mandatory to have a "main" HostInfo Object with the including Hostname. With this Setup it is possible to fast testing a new pattern without waiting of the response of all other Pattern.
Be sure that your new Pattern are containing all required XML-Nodes, the <Processing>-Node containing the C# class to process the result data from the command to a Discovery-Object. The functionality is that the Discovery-Tool reading the C# Source Code that is including the <Processing>-Node and invoking the PerformAction-Method of the PatternExec-Class.
The PerformAction Method is mandatory and the Discovery-Tool invoking it with an object array that are including the following 4 objects:
parameter | object type | description |
---|---|---|
parameters[0] | Command Result | Containing the result of the initial pattern command |
parameters[1] | IProvider | Containing the executing Provider-Class that is connected to the discovering system. This provider will be used in the pattern to execute other commands if required. |
parameters[2] | object | Containing the HostInfo-/Device-Object that is initial created on the start of the scan. |
For connecting to Host or Devices there are 4 Types of Providers used by the Discovery-Tool, the following described Providers handling the connection and execution of commands to collecting data.
Inside of a Pattern you have the availability to use the actual connected Provider to execute additional commands if more informations from the System are needed.
SSH-Provider
The SSH-Provider-Class is connected to a Linux System and can be used insight of a Pattern:
using Insight.Discovery.ProviderClasses; // Include the ProviderClasses Namespace at the Head of the PatternCode using Insight.Discovery.InfoClasses; // Include the InfoClasses Namespace at the Head of the PatternCode // Casting the connected Provider out of the parameters from the PerformAction-Method SSHProvider ssh = (SSHProvider)parameters[1]; // using the SSH-Provider to execute a command and receiving the result. var result = (SSHExecuteResult)ssh.ExecuteCommand("hostname"); // returning the hostname of a Linux System
For example a cast SSHProvider is used in the "Linux_Hostinfo_Hostname.pat" Pattern.
WMI-Provider
The WMI-Provider-Class is connected to a Windows System and can be used insight of a Pattern:
using Insight.Discovery.ProviderClasses; // Include the ProviderClasses Namespace at the Head of the PatternCode using Insight.Discovery.InfoClasses; // Include the InfoClasses Namespace at the Head of the PatternCode // Casting the connected Provider out of the parameters from the PerformAction-Method WMIProvider wmiProvider = (WMIProvider)parameters[1]; // using the WMI-Provider to read a Registry Value. var result = (WMIRegValueResult)wmiProvider.GetRegistryValue("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\<Key>", "DisplayName"); // using the WMI-Provider to get a List of all Registry-Sub-Keys. var result = (WMIRegValueListResult)wmiProvider.GetSubKeysFromRegistry("SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\"); //using the WMI-Provider to execute a WMI query receiving the result. var result = (WMIQueryResult)wmiProvider.ExecuteWMIQuery("netstat -an"); //using the WMI-Provider to execute a command and receiving the result. var result = (WMIExecuteResult)wmiProvider.ExecuteWMICommand("netstat -an");
SNMP-Provider
The SNMP-Provider-Class is connected to a SNMP Device and can be used insight of a Pattern:
using Insight.Discovery.ProviderClasses; // Include the ProviderClasses Namespace at the Head of the PatternCode using Insight.Discovery.InfoClasses; // Include the InfoClasses Namespace at the Head of the PatternCode // Casting the connected Provider out of the parameters from the PerformAction-Method SNMPProvider snmp = (SNMPProvider)parameters[1]; // using the SNMP-Provider to execute a SNMPGet command and receiving the results var result = (SNMPExecuteResult)snmp.ExecuteCommand("1.3.6.1.2.1.1.6.0", ScanProcessType.SNMP_GET, true); // using the SNMP-Provider to execute a SNMPWalk command and receiving the results var result = (SNMPExecuteResult)snmp.ExecuteCommand("1.3.6.1.2.1.2.2.1.2", ScanProcessType.SNMP_WALK, true); // using the SNMP-Provider to execute a SNMPWalk command with contextName and receiving the results var result = (SNMPExecuteResult)snmp.ExecuteCommand("1.3.6.1.2.1.2.2.1.2", ScanProcessType.SNMP_WALK, "myContext",true);
VIM-Provider
The SNMP-Provider-Class is connected to a VMWare ESXi System and can be used insight of a Pattern:
using Insight.Discovery.ProviderClasses; // Include the ProviderClasses Namespace at the Head of the PatternCode using Insight.Discovery.InfoClasses; // Include the InfoClasses Namespace at the Head of the PatternCode // Casting the connected Provider out of the parameters from the PerformAction-Method VIMProvider snmp = (SNMPProvider)parameters[1]; // using the VIM-Provider to execute a command and receiving the results var result = (VIMCommandResult)snmp.ExecuteCommand("HostSystem");
Additional Functions
ImportService
If you want to set a Date Attribute for a Discovery-Object like the InstallDate for an Application it must be in a specific Format ("MM/dd/yyyy").
You can use the delivered ImportService.ImportDate Method that will do the transformation for you:
using Insight.Discovery.Tools; // Include the Discovery Tools Namespace at the Head of the PatternCode // using the ImportDate Method to transform the Date string of a result Object discoveryObject.InstallDate = ImportService.Instance.ImportDate("resultDateString"); // The following input formats will be transformed: // "MM/dd/yy", "M/dd/yy", "MM/dd/yyyy", "M/dd/yyyy", "MM/dd/yy", "M/d/yy", "MM/d/yyyy", "M/d/yyyy", "yyyyMMdd", "yyMMdd", "dd.MM.yy", "dd.MM.yyyy", "MMM-dd-yy", "MMM-dd-yyyy", "yyyy-MM-dd"
LogService
If you want to write entrys into the Discovery Logfile you can use the delivered LogService Class.
using Insight.Discovery.Tools; // Include the Discovery Tools Namespace at the Head of the PatternCode // creating a "normal" log entry LogService.Instance.LogNormal("My normal log entry"); // creating a "debug" log entry with additional Exception object try { LogService.Instance.LogDebug("a debug log entry"); // Code that could raise an exception } catch (Exception ex) { LogService.Instance.LogError("Log of an exception", ex); }
Custom Pattern examples
Example: SNMP Extended Values
It is possible to extend the Information of a SNMP Device.
You must know which OID-Number returning the Value that should be discovered. In the processing script the return value of the OID will be mapped to a ExtendedInformation.
The following example is sending 3 OID's to discover different RAM Information.
<?xml version="1.0" encoding="utf-8"?> <ScanPattern xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <Version>3.0.1</Version> <PatternID>RIADA-Cust-SNMP-1</PatternID> <OrderNr>0</OrderNr> <ProcessType>SNMP_GET</ProcessType> <PatternType>SNMPExtendedValues</PatternType> <Command> <![CDATA[ 1.3.6.1.4.1.2021.4.5.0;1.3.6.1.4.1.2021.4.6.0;1.3.6.1.4.1.2021.4.11.0 ]]> </Command> <Processing> <![CDATA[ using System; using System.Collections.Generic; using Insight.Discovery.InfoClasses.CommandResult.ResultTypes; using Insight.Discovery.Tools; using Insight.Discovery.InfoClasses; using Insight.Discovery.InfoClasses.CommandResult; namespace Insight.Discovery { public class PatternExec { public void PerformAction(object[] parameters) { DeviceInfo deviceInfo = (DeviceInfo)parameters[2]; if (deviceInfo.ExtendedInformations.IsNullOrEmpty()) deviceInfo.ExtendedInformations = new List<ExtendedInformation>(); try { var commandResult = (SNMPExecuteResult)parameters[0]; commandResult.LogResult(); foreach (KeyValuePair<string, object> item in commandResult) { switch (item.Key) { case "1.3.6.1.4.1.2021.4.5.0": // OID to get available RAM if (item.Value != null) { try { long t = 0; long.TryParse(item.Value.ToString().Replace("\n", "").Trim(), out t); if (t > 0) { deviceInfo.ExtendedInformations.Add(new ExtendedInformation() { Name = "RAM Total", Value = (t / 1024).ToString() }); } } catch { // } } break; case "1.3.6.1.4.1.2021.4.6.0": // OID to get used RAM if (item.Value != null) { try { long t = 0; long.TryParse(item.Value.ToString().Replace("\n", "").Trim(), out t); if (t > 0) { deviceInfo.ExtendedInformations.Add(new ExtendedInformation() { Name = "RAM Used", Value = (t / 1024).ToString() }); } } catch { // } } break; case "1.3.6.1.4.1.2021.4.11.0": // OID to get free RAM if (item.Value != null) { try { long t = 0; long.TryParse(item.Value.ToString().Replace("\n", "").Trim(), out t); if (t > 0) { deviceInfo.ExtendedInformations.Add(new ExtendedInformation() { Name = "RAM Free", Value = (t / 1024).ToString() }); } } catch { // } } break; } } } catch (Exception ex) { LogService.Instance.LogDebug("Error getting Extended SNMP RAM Information.", ex); } } } } ]]> </Processing> </ScanPattern>
Example: Application Product Key
It is possible to add a discovered Licence-Information to an Application. For example if you know that a Licence File exists you can add a Pattern that read this file.
In the following example the pattern is reading a file "lic" that contains the Licence-Key for the Linux-Application "apt".
<?xml version="1.0" encoding="utf-8"?> <!-- © Mindville --> <ScanPattern xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <Version>1.0.1</Version> <PatternID>Mindville-Cust-Linux-AppPK-1</PatternID> <OrderNr>0</OrderNr> <ProcessType>SSHExecute</ProcessType> <PatternType>ApplicationProductKey</PatternType> <ApplicationName>apt</ApplicationName> <Command> <![CDATA[ cat /etc/apt/lic ]]> </Command> <Processing> <![CDATA[ using System; using Insight.Discovery.InfoClasses; using Insight.Discovery.Tools; using Insight.Discovery.InfoClasses.CommandResult.ResultTypes; using System.Collections.Generic; namespace Insight.Discovery { public class PatternExec { public void PerformAction(object[] parameters) { HostInfo hostInfo = (HostInfo) parameters[2]; try { SSHExecuteResult sshExecuteResult = (SSHExecuteResult)parameters[0]; sshExecuteResult.LogResult(); string input = sshExecuteResult; if (input != string.Empty) { if(hostInfo.OS.License == null)hostInfo.OS.License = new LicenseInfo(); hostInfo.OS.License.LicenseKey = input.Trim(); } } catch (Exception ex) { LogService.Instance.LogDebug("Error getting apt product key Information", ex); } } } } ]]> </Processing> </ScanPattern>
Example: Application Extended Information
It is possible to extend the Information of any object type.
IN the following example, we exten the host info with some extended informations.
<?xml version="1.0" encoding="utf-8"?> <ScanPattern xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <Version>1.0.1</Version> <PatternID>Mindville-Cust-Linux-OpenPorts-1</PatternID> <OrderNr>700</OrderNr> <ProcessType>SSHExecute</ProcessType> <PatternType>Host</PatternType> <Command> <![CDATA[ netstat -an ]]> </Command> <Processing> <![CDATA[ using System; using System.Collections.Generic; using Insight.Discovery.Tools; using Insight.Discovery.InfoClasses; using Insight.Discovery.InfoClasses.CommandResult.ResultTypes; using Insight.Discovery.Tools.Networking; namespace Insight.Discovery { public class PatternExec { public void PerformAction(object[] parameters) { HostInfo hostInfo = (HostInfo)parameters[2]; try { SSHExecuteResult sshExecuteResult = (SSHExecuteResult)parameters[0]; sshExecuteResult.LogResult(); string input = sshExecuteResult; if (input != string.Empty) { if (hostInfo != null) { string[] lines = input.Split('\n'); ExtendedInformation tcpPortInfo = new ExtendedInformation() { Name = "TCP Ports", Value = string.Empty }; ExtendedInformation udpPortInfo = new ExtendedInformation() { Name = "UDP Ports", Value = string.Empty }; for (int i = 0; i < lines.Length; i++) { if (!string.IsNullOrEmpty(lines[i]) && lines[i].Contains(":") && (lines[i].ToLower().StartsWith("tcp") || lines[i].ToLower().StartsWith("udp"))) { string[] parts = lines[i].TrimReduce().Split(' '); try { for (int x = 0; x < parts.Length; x++) { if (parts[x].Contains("]")) { parts[x] = parts[1].Substring(parts[x].IndexOf("]")); } if (parts[0].ToLower().StartsWith("tcp") && !string.IsNullOrEmpty(parts[x]) && parts[x].Contains(":")) { if (!tcpPortInfo.Value.Contains(parts[x].Split(':')[1])) { tcpPortInfo.Value += parts[x].Split(':')[1] + ","; break; } } if (parts[0].ToLower().StartsWith("udp") && !string.IsNullOrEmpty(parts[x]) && parts[x].Contains(":")) { if (!udpPortInfo.Value.Contains(parts[x].Split(':')[1])) { udpPortInfo.Value += parts[x].Split(':')[1] + ","; break; } } } } catch { // } } } if (hostInfo.ExtendedInformations.IsNullOrEmpty()) hostInfo.ExtendedInformations = new List<ExtendedInformation>(); if (!string.IsNullOrEmpty(tcpPortInfo.Value) && tcpPortInfo.Value.EndsWith(",")) { tcpPortInfo.Value = tcpPortInfo.Value.Substring(0, tcpPortInfo.Value.Length - 1); hostInfo.ExtendedInformations.Add(tcpPortInfo); } if (!string.IsNullOrEmpty(udpPortInfo.Value) && udpPortInfo.Value.EndsWith(",")) { udpPortInfo.Value = udpPortInfo.Value.Substring(0, udpPortInfo.Value.Length - 1); hostInfo.ExtendedInformations.Add(udpPortInfo); } } } } catch (Exception ex) { LogService.Instance.LogDebug("Error getting ReferencedHosts Information", ex); } } } } ]]> </Processing> </ScanPattern>
Modifying patterns
It is possible but not recommend to modify delivered Pattern. If there are any missing Information the best practice is to add a new pattern, the missing Information will be merged to the Discovery-Object. If you are modified a delivered Pattern, you should save that Pattern external to pretend the lose of your change by updating the Discovery-Tool.
When you updating the Discovery-Tool with the updater, the updater will ask you before overwriting the modified Pattern.
Removing patterns
You can disable a pattern file in general:
- go to the Pattern Tab and uncheck the unwanted pattern
You can disable a pattern file for a specific scan range
- got to the Scan Setting an select the pattern files that you don't want to use