Computer correlation

BigFix 10 has the capability of correlating multiple representations of the same computer, allowing operators to manage them as a single entity (also referred to as correlation computer throughout this documentation) as well as to operate on a specific representation as needed.

For instance, if the Microsoft Azure cloud plugin discovers a VM created on Microsoft Azure, and at the same time the discovered VM runs the BigFix Agent, then two separate representations of the same computer is reported to the BigFix Server. In this case, BigFix 10 correlates the two representations, and the BigFix Console shows them in a grouped, expandable format.

In this documentation, the term proxied refers to computer representations discovered by cloud plugins, and the term native refers to computer representations associated to BigFix Agents.
Note: Computer correlation requires BigFix Agent version 10 or higher.

Enabling computer correlation for a cloud plugin

When a cloud plugin is installed, the correlation feature for computers discovered by that plugin is automatically activated.

Displaying correlation computers

The correlation computer is a logical entity, and the BigFix Console shows it as an expandable object in the Computers view. The root element of the object represents the correlation computer itself, and has an own Computer ID. The ID of the correlation computer is created at correlation time, and typically falls in a range higher than the IDs of the single representations. Correlated representations are shown slightly indented when expanding the correlation computer.

In the blue boxes examples of expanded correlation computers, in the orange boxes examples of collapsed correlation computers

The correlation computer inherits the properties from all the computers it correlates. In case the computers report different values for the same property, the correlation computer inherits the value from the native one as it is the most accurate and meaningful source of data.

Note:
  • When one of the correlated representations has not been checking in for the amount of time specified in the BigFix Console preferences, besides appearing itself as offline, it makes the correlation computer appear offline as well.
  • The Agent Version associated with proxied computers corresponds to the version of the Plugin Portal that is managing them.
  • The Computer Name of proxied computers discovered by the AWS plugin corresponds to the name of the host taken from the Private DNS Name.

Administering correlation computers

Correlation computers are visible to Master Operators and to Non-Master Operators who administer two or more correlated representations. Operators can administer the correlated representations independently of one another. No inheritance mechanisms propagate administration rights from a correlated representation to another one.

Performing operations on correlation computers

Operators can target correlation computers, and depending on the type of operation, the BigFix Server takes care of dispatching it to the proper correlated representations. Following are a few examples:

  • As shown in the following figure, an Operator takes a custom action, and in the Target tab, clicks Select devices and selects a correlation computer:

    In this case, the BigFix Server dispatches the action to one of the correlated representations based on the parsing of the actionscript commands. If only one of the correlated representations can run all the commands of the actionscript, then the BigFix Server dispatches the action to that representation. If the whole actionscript is applicable to more than one representation, then the BigFix Server always chooses to dispatch the action to the native computer.

    Note:
    • If the Operator wants to target a specific computer representation, it is enough to expand the correlation computer in the Target tab, and select the desired representation. In this case, the BigFix Server sends the action to that representation directly.
    • If the action is taken from a Fixlet that is applicable to only one of the representations (in this scenario, you can verify it by expanding the correlation computer in the Target tab), then the action is sent to that representation.
  • Operator runs a BigFix query and targets a correlation computer. In this case, the BigFix query is always sent to the native computer because the BigFix Agent is the only component that can execute a BigFix query.
  • In the Computers view, an operator selects a correlation computer and adds it to a manual computer group. In this case, all the correlated representations are added to the manual computer group.
  • In the Computers view, an operator selects a correlation computer and opts for Remove From Database.... In this case, all the correlated representations are set to deleted, and stop being displayed by the BigFix Console both as correlated and standalone computers.
  • In the Computers view, an operator selects a correlation computer and runs a Send Refresh. In this case, the refresh notification is sent to all the correlated representations.
Note: Any client relevance expressions referring to the IDs of correlation computers are not matched by any native or proxied computers, because those IDs represent logical entities that are only known to the BigFix Server. For instance, referring to the IDs of correlation computers for defining an automatic computer group or for subscribing computers to a site does not cause any computers to be included in the computer group or be subscribed to the site.

Using REST APIs with correlation computers

While remaining compatible with the XML schema definition of previous BigFix releases, REST APIs in BigFix 10 can handle correlation computers supporting them with methods and applicable resources.

For instance, the ID of a correlation computer may be used as target of an action, and in this case the BigFix Server takes care of dispatching the action to the proper target based on the operator permissions and on the commands contained in the actionscript.

Similarly, the ID of a correlation computer may be used to retrieve information from the BigFix Server. For instance, if an operator wants to retrieve the settings of a correlation computer, the REST API returns an XML made up of a main section with the settings of the native computer, and a subsection named ManagementExtension that contains the settings of the proxied computer. For further details, see Computer REST APIs.

Deleting a correlated representation

If, for instance, a correlation computer correlates a native and a proxied representation, and at some point one of the two representations is set to deleted (either manually through the BigFix Console, or by the BigFix Computer Remover tool), the correlation computer is set to deleted as well, and is no longer displayed by the BigFix Console. The remaining representation goes back to being displayed as a standalone computer.

When the BigFix Computer Remover tool removes the deleted representation from the database, the correlation computer is removed as well.