Extended signature templates

Available from 9.2.2. Extended signatures are flexible signatures that are used for software recognition. They consist of a number of exported variables and the declaration of the operations that are required to assign a value to these variables. Update BigFix Server and Software Catalog to allow the Extended Signature capability to report the detailed versions of installed software.

Operands and operators

Every extended signature can be viewed as a set of processing instructions that are used by software scans to detect if a software item is installed on the target computer system. These processing expressions consist of two types of components: operands and operators. Operands are the objects that are manipulated, and the operators as the symbols that represent specific actions. Operands and operators can be either scalar (consisting of only one value) or vector (consisting of multiple values).

The schema version that is supported by BigFix Inventory is 2.7.

Variables interpret by the BigFix Inventory

Following variables are interpret by BigFix Inventory:
  • IS_INSTALLED - mandatory

    When the software is detected, the condition should be set to true. When the software is not detected, the condition should be set to false.

  • INSTALL_PATH - optional

    Value is listed in installation path.

  • 10.0.0 DETAILED_VER

    Use DETAILED_VER variable to search for the detailed version. The information is reported in Component Detailed Version column. Value is listed in Component Detailed Version column. The Component Release is referred from catalog entry.

Extended signature templates

The following section provides extended signature templates to help you create a new extended signature and lists the necessary operators and operands that explain the values that they have. The table lists the templates of extended signatures as they are created in BigFix Inventory.

Note: To prevent the XML validation from failing, ensure that the following XML element is present in the extended signature that you are creating. Otherwise, the XML validation fails.
<Variable name="IS_INSTALLED">
...
</Variable>
Identification or detection of Sample template
Reporting Detailed Version using the value fetched from the registry The following template checks existence of 4.0 value registry key and reports the key as Detailed Version.
<Variable name="DETAILED_VER">
  <RegKeyValue entry="Installed Version" key="HKEY_LOCAL_MACHINE\Software\Microsoft\SMS\Client\Client Components\Component Name\Installation Properties" section="64or32"/>
  </Variable>
  <Variable name="IS_INSTALLED">
  <Compare relation="eq" type="string">
  <StringSlice inputString="$(DETAILED_VER)" startIndex="0" endIndex="3"/>
  <ValueOf value="4.0"/>
  </Compare>
</Variable>
A file name

The following template checks the identification or detection of a file name.

<Variable name="IS_INSTALLED" export="true">
  <Compare type="string" relation="ne">
    <VectorToScalar>
      <FindFilePathEx name="A_FILENAME.EXE"/>
    </VectorToScalar>
    <ValueOf value=""/>
  </Compare>
</Variable>

The size of the file need not be provided.
Existence of a number of Windows™ registry keys

The following template checks the identification or detection of the existence of a number of Windows™ registry keys.

The number of keys to be provided depends on the application.

<Variable name="IS_INSTALLED">
  <And>
    <RegKeyValueEqual key="KEY NAME A" entry="ENTRY NAME" value="VALUE" section="64or32"/>
    <RegKeyValueEqual key="KEY NAME B" entry="ENTRY NAME" value="VALUE" section="64or32"/>
    <RegKeyValueEqual key="KEY NAME N" entry="ENTRY NAME" value="VALUE" section="64or32"/>
  </And>
</Variable>
Existence of at least one of the registry keys

The following template checks the identification or detection of the existence of at least one of the registry keys.

<Variable name="IS_INSTALLED" export="true">
  <Or>
    <RegKeyValueEqual key="KEY NAME A" entry="ENTRY NAME" value="VALUE" section="64or32"/>
    <RegKeyValueEqual key="KEY NAME B" entry="ENTRY NAME" value="VALUE" section="64or32"/>
    <RegKeyValueEqual key="KEY NAME N" entry="ENTRY NAME" value="VALUE" section="64or32"/>
  </Or>
</Variable>
File that is in a particular directory that is defined by a filter

The following template checks the identification or detection of the file that is in a particular directory that is defined by a filter.

Note: Use "?" as the single-character wildcard and "*" to denote multiple characters.
Restriction: Replace the forward or backslashes in the file path with the "?" wildcard.
<Variable name="IS_INSTALLED" export="true">
  <Compare type="string" relation="ne">
    <VectorToScalar>
      <Vector filter="?opt?symantec*">
        <FindFilePathEx name="FILENAME"/>
      </Vector>
    </VectorToScalar>
    <ValueOf value="" />
  </Compare>
</Variable>
Key name, key entry, and its value for a registry key

The following template checks the identification or detection of the key name, key entry, and its value for a registry key.

<Variable name="IS_INSTALLED" export="true">
  <RegKeyValueEqual key="KEY NAME" entry="ENTRY NAME" value="VALUE" section="64or32"/>
</Variable>
CPU architecture

The following template checks the identification or detection of CPU architecture.

<Variable name="IS_INSTALLED" export="true">
  <Compare relation="eq" type="string">
    <ValueOf value="$(B_PROCESSOR_ARCH)"/>
    <ValueOf value="ARCHITECTURE_CODE"/>
  </Compare>
</Variable>
Where ARCHITECTURE_CODEs:
  • AIX, IBM i, and Linux PPC: PPC
  • Linux x86, Mac OS X, and Solaris x86: IX86
  • Linux on System z: S390
  • HP-UX Itanium: ITANIUM
  • HP-UX PA-RISC: PA-RISC
  • Solaris SPARC: SPARC
File contents and matching specified strings

The following template checks the identification or detection of the file contents and matching specified strings.

Note: The scanner reads only text files. It cannot read binary files and archives, such as .jar, .ear, and .zip.
<MultipleInstance>
  <Iterator name="file_list" export="false">
    <FindFilePathEx name="MYFILE.txt" />
  </Iterator>
  <Instance>
    <Variable name="file_read" export="false">
      <ReadFile path="$(file_list)MYFILE.txt" />
    </Variable>
    <Variable name="IS_INSTALLED">
      <Compare type="string" relation="ne">
        <VectorToScalar>
          <Vector filter="*MYAPP_version=MYAPP-1.3*">
          <ValueOf value="$(file_read)" />
          </Vector>
        </VectorToScalar>
        <ValueOf value="" />
      </Compare>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP" />
    </Condition>
  </Instance>
</MultipleInstance>
The name of the file to be detected is MYFILE.txt and the string value is MYAPP_version=MYAPP-1.3.

Existence of two files in a particular directory where someprog.jar file has a particular size

The following template checks the identification or detection of the existence of two files in a particular directory where someprog.jar file has a particular size.

<MultipleInstance>
  <Iterator name="INSTALL_PATH">
    <Vector filter="*SOMEPROG.ear?SOMEPROG.war?">
      <FindFilePathEx name="essbase.jar"/>
    </Vector>
  </Iterator>
  <Instance>
    <Variable name="IS_INSTALLED">
      <FileInfoCompare absolutePath="$(INSTALL_PATH)someprog.jar" field="size" value="649432" relation="eq" />
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP"/>
    </Condition>
	</Instance>
</MultipleInstance>
Matching BFI Package Data report on endpoint side It is possible to match data listed on BFI Package Data report on endpoint side using PackageInforMatch operand.

Below is an example for the same. The below example can be combined with other examples mentioned on this page.

<Variable name="IS_INSTALLED" export="true">
<PackageInfoMatch vendor="RStudio*" name="rstudio-server" version="1.1.*"/></Variable>
The existence of a particular file

The following template checks the identification or detection of the existence of a particular file.

<MultipleInstance>
  <Iterator name="INSTALL_PATH">
    <FindFilePathEx name="SWTAG_NAME.swtag"/>
  </Iterator>
  <Instance>
    <Variable name="IS_INSTALLED">
      <Compare type="string" relation="ne">
        <ValueOf value="$(INSTALL_PATH)" />
        <ValueOf value="" />
      </Compare>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP"/>
    </Condition>
  </Instance>
</MultipleInstance>
File type with only a part of the name given

The following template checks the identification or detection of the file type with only a part of the name given.

<MultipleInstance>
  <Iterator name="INSTALL_PATH">
    <FindFilePathEx name="*.FILETYPE" appendFileName="true"/>
  </Iterator>
  <Instance>
    <Variable name="IS_INSTALLED">
      <Compare type="string" relation="ne">
        <ValueOf value="$(INSTALL_PATH)" />
        <ValueOf value="" />
      </Compare>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP"/>
    </Condition>
  </Instance>
</MultipleInstance>
The existence of a specific file, another file does not exist

The following template checks the identification or detection of the existence of a specific file, another file does not exist.

<MultipleInstance>
  <Iterator name="INSTALL_PATH">
    <FindFilePathEx name="file1"/>
  </Iterator>
  <Instance>
    <Variable name="IS_INSTALLED">
      <And>
        <FileExists absolutePath="$(INSTALL_PATH)file1"/>
        <Not>
          <Compare type="string" relation="ne">
            <VectorToScalar>
              <FindFilePathEx name="file2"/>
            </VectorToScalar>
            <ValueOf value=""/>
          </Compare>
        </Not>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP"/>
    </Condition>
  </Instance>
</MultipleInstance>
Software items when the registry key identifies the product, Windows™ systems

The following template checks the identification or detection of the Software items when the registry key identifies the product, Windows™ systems.

Compares a part of the key string. To address this case, two signatures must be created, one for 32 -bit and one for 64-bit architecture.

<MultipleInstance>
  <Iterator name="reg">
    <Vector filter="*000000FF1CE}" ignoreCase="false">
      <RegKeyList root="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" section="32" subkeys="false"/>    </Vector>
  </Iterator>
  <Instance>
    <Variable name="IS_INSTALLED">
      <And>
        <Compare relation="eq" type="string">
          <Clip endIndex="76" inputString="$(reg)" startIndex="74"/>
          <ValueOf value="140"/>
        </Compare>
        <Compare relation="eq" type="string">
          <Clip endIndex="84" inputString="$(reg)" startIndex="81"/>
          <ValueOf value="0018"/>
        </Compare>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action do="SKIP" onValue="false"/>
    </Condition>
  </Instance>
</MultipleInstance>


<MultipleInstance>
  <Iterator name="reg">
    <Vector filter="*000000FF1CE}" ignoreCase="false">
      <RegKeyList root="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" section="64" subkeys="false"/>
    </Vector>
  </Iterator>
  <Instance>
    <Variable name="IS_INSTALLED">
      <And>
        <Compare relation="eq" type="string">
          <Clip endIndex="76" inputString="$(reg)" startIndex="74"/>
          <ValueOf value="140"/>
        </Compare>
        <Compare relation="eq" type="string">
          <Clip endIndex="84" inputString="$(reg)" startIndex="81"/>
          <ValueOf value="0018"/>
        </Compare>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action do="SKIP" onValue="false"/>
    </Condition>
  </Instance>
</MultipleInstance>
Registry keys, where edition and version are stored

The following template checks the identification or detection of the registry keys, where edition and version are stored.

This signature matches a specific version range.

<Variable name="IS_INSTALLED">
  <And>
   <RegKeyValueContains entry="Edition" key="HKEY_LOCAL_MACHINE\SOFTWARE\Vendor\SoftwareName\Data" value="Enterprise" section="64or32"/>
    <RegKeyVersionCompare key="HKEY_LOCAL_MACHINE\SOFTWARE\Vendor\SoftwareName\CurrVer" entry="Version" relation="ge" value="3.00.00.00" section="64or32"/>
    <RegKeyVersionCompare key="HKEY_LOCAL_MACHINE\SOFTWARE\Vendor\SoftwareName\CurrVer" entry="Version" relation="le" value="3.9999.9999.9999" section="64or32"/>
  </And>
</Variable>
Software instances by identifying their registry keys.

The following template checks the identification or detection of the software instances by identifying their registry keys.

Instance name is reflected by the asterisk character in registry path: HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\SoftwareName\*\Info\CurrVer

This signature matches a specific edition and version range. To address this case, two signatures must be created, one for 32-bit and one for 64-bit architecture.

<MultipleInstance>
  <Iterator export="false" name="rg">
    <Vector>
      <RegKeyList root="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SoftwareName\*" section="64" subkeys="false"/>
    </Vector>
  </Iterator>
  <Instance>
    <Variable export="false" name="vr">
      <RegKeyValue entry="Version" key="$(rg)\Info\CurrVer" mustExists="true" section="64"/>
    </Variable>
    <Variable name="IS_INSTALLED">
      <And>
        <RegKeyValueContains entry="Edition" key="$(rg)\Data" section="64" value="Enterprise"/>
        <Contains inputString="$(vr)" position="start" searchedString="3."/>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action do="SKIP" onValue="false"/>
    </Condition>
  </Instance>
</MultipleInstance>

<MultipleInstance>
  <Iterator export="false" name="rg">
    <Vector>
      <RegKeyList root="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SoftwareName\*" section="32" subkeys="false"/>
    </Vector>
  </Iterator>
  <Instance>
    <Variable export="false" name="vr">
      <RegKeyValue entry="Version" key="$(rg)\Info\CurrVer" mustExists="true" section="32"/>
    </Variable>
    <Variable name="IS_INSTALLED">
      <And>
        <RegKeyValueContains entry="Edition" key="$(rg)\Data" section="32" value="Enterprise"/>
        <Contains inputString="$(vr)" position="start" searchedString="3."/>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action do="SKIP" onValue="false"/>
    </Condition>
  </Instance>
</MultipleInstance>
Uninstall registry keys, Windows™ systems

The following template checks the identification or detection of the uninstall registry keys, Windows™ systems.

This signature iterates through all keys and tries to match specific patterns in DisplayName and DisplayVersion values. To address this case, two signatures must be created, one for the 32-bit and one for the 64-bit architecture.

<MultipleInstance>
  <Iterator name="reg" export="true">
    <RegKeyList root="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"     section="32" subkeys="false"/>      </Iterator>
  <Instance>
    <Variable name="valueName" export="true">
      <RegKeyValue entry="DisplayName" key="$(reg)" section="32" />
    </Variable>
    <Variable name="valueVersion" export="true">
      <RegKeyValue entry="DisplayVersion" key="$(reg)" section="32" />
    </Variable>
    <Variable name="IS_INSTALLED">
      <And>
        <Contains inputString="$(valueName)" searchedString="TestProduct" position="start"/>
        <Contains inputString="$(valueVersion)" searchedString="12.0" position="start"/>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP"/>
    </Condition>
  </Instance>
</MultipleInstance>

<MultipleInstance>
  <Iterator name="reg" export="true">
    <RegKeyList root="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"     section="64" subkeys="false"/>
  </Iterator>
  <Instance>
    <Variable name="valueName" export="true">
      <RegKeyValue entry="DisplayName" key="$(reg)" section="64" />
    </Variable>
    <Variable name="valueVersion" export="true">
      <RegKeyValue entry="DisplayVersion" key="$(reg)" section="64" />
    </Variable>
    <Variable name="IS_INSTALLED">
      <And>
        <Contains inputString="$(valueName)" searchedString="TestProduct" position="start"/>
        <Contains inputString="$(valueVersion)" searchedString="12.0" position="start"/>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP"/>
    </Condition>
  </Instance>
</MultipleInstance>