Extended signature templates

Available from 9.2.2. Extended signatures are flexible signatures that are used for software recognition. They consist of a number of exported variables and the declaration of the operations that are required to assign a value to these variables.

Operands and operators

Every extended signature can be viewed as a set of processing instructions that are used by software scans to detect if a software item is installed on the target computer system. These processing expressions consist of two types of components: operands and operators. Operands are the objects that are manipulated, and the operators as the symbols that represent specific actions. Operands and operators can be either scalar (consisting of only one value) or vector (consisting of multiple values).

The schema version that is supported by BigFix Inventory is 2.7.

Extended signature templates

The following section provides extended signature templates to help you create a new extended signature and lists the necessary operators and operands that explain the values that they have. The table lists the templates of extended signatures as they are created in BigFix Inventory.

Note: To prevent the XML validation from failing, ensure that the following XML element is present in the extended signature that you are creating. Otherwise, the XML validation fails.
<Variable name="IS_INSTALLED">
...
</Variable>
Identification or detection of Sample template
A file name

The following template checks the identification or detection of a file name.

<Variable name="IS_INSTALLED" export="true">
  <Compare type="string" relation="ne">
    <VectorToScalar>
      <FindFilePathEx name="A_FILENAME.EXE"/>
    </VectorToScalar>
    <ValueOf value=""/>
  </Compare>
</Variable>

The size of the file need not be provided.
Existence of a number of Windows™ registry keys

The following template checks the identification or detection of the existence of a number of Windows™ registry keys.

The number of keys to be provided depends on the application.

<Variable name="IS_INSTALLED">
  <And>
    <RegKeyValueEqual key="KEY NAME A" entry="ENTRY NAME" value="VALUE" section="64or32"/>
    <RegKeyValueEqual key="KEY NAME B" entry="ENTRY NAME" value="VALUE" section="64or32"/>
    <RegKeyValueEqual key="KEY NAME N" entry="ENTRY NAME" value="VALUE" section="64or32"/>
  </And>
</Variable>
Existence of at least one of the registry keys

The following template checks the identification or detection of the existence of at least one of the registry keys.

<Variable name="IS_INSTALLED" export="true">
  <Or>
    <RegKeyValueEqual key="KEY NAME A" entry="ENTRY NAME" value="VALUE" section="64or32"/>
    <RegKeyValueEqual key="KEY NAME B" entry="ENTRY NAME" value="VALUE" section="64or32"/>
    <RegKeyValueEqual key="KEY NAME N" entry="ENTRY NAME" value="VALUE" section="64or32"/>
  </Or>
</Variable>
File that is in a particular directory that is defined by a filter

The following template checks the identification or detection of the file that is in a particular directory that is defined by a filter.

Note: Use "?" as the single-character wildcard and "*" to denote multiple characters.
Restriction: Replace the forward or backslashes in the file path with the "?" wildcard.
<Variable name="IS_INSTALLED" export="true">
  <Compare type="string" relation="ne">
    <VectorToScalar>
      <Vector filter="?opt?symantec*">
        <FindFilePathEx name="FILENAME"/>
      </Vector>
    </VectorToScalar>
    <ValueOf value="" />
  </Compare>
</Variable>
Key name, key entry, and its value for a registry key

The following template checks the identification or detection of the key name, key entry, and its value for a registry key.

<Variable name="IS_INSTALLED" export="true">
  <RegKeyValueEqual key="KEY NAME" entry="ENTRY NAME" value="VALUE" section="64or32"/>
</Variable>
CPU architecture

The following template checks the identification or detection of CPU architecture.

<Variable name="IS_INSTALLED" export="true">
  <Compare relation="eq" type="string">
    <ValueOf value="$(B_PROCESSOR_ARCH)"/>
    <ValueOf value="ARCHITECTURE_CODE"/>
  </Compare>
</Variable>
Where ARCHITECTURE_CODEs:
  • AIX, IBM i, and Linux PPC: PPC
  • Linux x86, Mac OS X, and Solaris x86: IX86
  • Linux on System z: S390
  • HP-UX Itanium: ITANIUM
  • HP-UX PA-RISC: PA-RISC
  • Solaris SPARC: SPARC
File contents and matching specified strings

The following template checks the identification or detection of the file contents and matching specified strings.

Note: The scanner reads only text files. It cannot read binary files and archives, such as .jar, .ear, and .zip.
<MultipleInstance>
  <Iterator name="file_list" export="false">
    <FindFilePathEx name="MYFILE.txt" />
  </Iterator>
  <Instance>
    <Variable name="file_read" export="false">
      <ReadFile path="$(file_list)MYFILE.txt" />
    </Variable>
    <Variable name="IS_INSTALLED">
      <Compare type="string" relation="ne">
        <VectorToScalar>
          <Vector filter="*MYAPP_version=MYAPP-1.3*">
          <ValueOf value="$(file_read)" />
          </Vector>
        </VectorToScalar>
        <ValueOf value="" />
      </Compare>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP" />
    </Condition>
  </Instance>
</MultipleInstance>
where the name of the file to be detected is MYFILE.txt and the string value is MYAPP_version=MYAPP-1.3.

Existence of two files in a particular directory where someprog.jar file has a particular size

The following template checks the identification or detection of the existence of two files in a particular directory where someprog.jar file has a particular size.

<MultipleInstance>
  <Iterator name="INSTALL_PATH">
    <Vector filter="*SOMEPROG.ear?SOMEPROG.war?">
      <FindFilePathEx name="essbase.jar"/>
    </Vector>
  </Iterator>
  <Instance>
    <Variable name="IS_INSTALLED">
      <FileInfoCompare absolutePath="$(INSTALL_PATH)someprog.jar" field="size" value="649432" relation="eq" />
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP"/>
    </Condition>
	</Instance>
</MultipleInstance>
httpd file with a size in a specific directory (but not in other paths)

The following template checks the identification or detection of the httpd file with a size in a specific directory (but not in other paths).

<MultipleInstance>
  <Iterator name="DIR" export="false">
    <Vector filter="*Apache?Apache?bin?">
      <FindFilePathEx name="httpd" excludeDirectories="*backup*,*bak*,*bkup*"/>
    </Vector>
  </Iterator>
  <Instance>
    <Variable name="IS_INSTALLED" export="true">
      <FileInfoCompare absolutePath="$(DIR)httpd" field="size" value="629868" relation="eq"/>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP"/>
    </Condition>
  </Instance>
</MultipleInstance>
Component information on AIX® platform

The following template checks the identification or detection of the component information on AIX® platform.

<Variable name="IS_INSTALLED">
  <And>
    <Compare type="string" relation="eq">
      <AixProductInfo code="WSBAA@5.0.0.0" field="version"/>
      <ValueOf value="5.0.0.0"/>
    </Compare>
    <Compare type="string" relation="eq">
      <AixProductInfo code="WSBAA@5.0.0.0" field="description"/>
      <ValueOf value="BigFix"/>
    </Compare>
  </And>
</Variable>

Provide three values for each AIX® native component:

Code: WSBAA@5.0.0.0
Version: 5.0.0.0
Description: IBM WebSphere® Application Server
Component information on HP-UX platform

The following template checks the identification or detection of the component information on HP-UX platform.

<Variable name="IS_INSTALLED">
  <And>
    <Compare type="string" relation="eq">
      <HpProductInfo code="MQSERIES" field="version"/>
      <ValueOf value="6.0.1.0"/>
    </Compare>
    <Compare type="string" relation="eq">
      <HpProductInfo code="MQSERIES" field="name"/>
      <ValueOf value="WebSphere MQ for HP-UX"/>
    </Compare>
  </And>
</Variable>

Provide three values for each HP-UX native component:

Code: MQSERIES
Version: 6.0.1.0
Name:  WebSphere® MQ for HP-UX
The existence of a particular file

The following template checks the identification or detection of the existence of a particular file.

<MultipleInstance>
  <Iterator name="INSTALL_PATH">
    <FindFilePathEx name="SWTAG_NAME.swtag"/>
  </Iterator>
  <Instance>
    <Variable name="IS_INSTALLED">
      <Compare type="string" relation="ne">
        <ValueOf value="$(INSTALL_PATH)" />
        <ValueOf value="" />
      </Compare>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP"/>
    </Condition>
  </Instance>
</MultipleInstance>
File type with only a part of the name given

The following template checks the identification or detection of the file type with only a part of the name given.

<MultipleInstance>
  <Iterator name="INSTALL_PATH">
    <FindFilePathEx name="*.FILETYPE" appendFileName="true"/>
  </Iterator>
  <Instance>
    <Variable name="IS_INSTALLED">
      <Compare type="string" relation="ne">
        <ValueOf value="$(INSTALL_PATH)" />
        <ValueOf value="" />
      </Compare>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP"/>
    </Condition>
  </Instance>
</MultipleInstance>
The existence of a specific file, another file does not exist

The following template checks the identification or detection of the existence of a specific file, another file does not exist.

<MultipleInstance>
  <Iterator name="INSTALL_PATH">
    <FindFilePathEx name="file1"/>
  </Iterator>
  <Instance>
    <Variable name="IS_INSTALLED">
      <And>
        <FileExists absolutePath="$(INSTALL_PATH)file1"/>
        <Not>
          <Compare type="string" relation="ne">
            <VectorToScalar>
              <FindFilePathEx name="file2"/>
            </VectorToScalar>
            <ValueOf value=""/>
          </Compare>
        </Not>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP"/>
    </Condition>
  </Instance>
</MultipleInstance>
Software items when the registry key identifies the product, Windows™ systems

The following template checks the identification or detection of the Software items when the registry key identifies the product, Windows™ systems.

Compares a part of the key string. To address this case, two signatures must be created, one for 32 -bit and one for 64-bit architecture.

<MultipleInstance>
  <Iterator name="reg">
    <Vector filter="*000000FF1CE}" ignoreCase="false">
      <RegKeyList root="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" section="32" subkeys="false"/>    </Vector>
  </Iterator>
  <Instance>
    <Variable name="IS_INSTALLED">
      <And>
        <Compare relation="eq" type="string">
          <Clip endIndex="76" inputString="$(reg)" startIndex="74"/>
          <ValueOf value="140"/>
        </Compare>
        <Compare relation="eq" type="string">
          <Clip endIndex="84" inputString="$(reg)" startIndex="81"/>
          <ValueOf value="0018"/>
        </Compare>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action do="SKIP" onValue="false"/>
    </Condition>
  </Instance>
</MultipleInstance>


<MultipleInstance>
  <Iterator name="reg">
    <Vector filter="*000000FF1CE}" ignoreCase="false">
      <RegKeyList root="HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" section="64" subkeys="false"/>
    </Vector>
  </Iterator>
  <Instance>
    <Variable name="IS_INSTALLED">
      <And>
        <Compare relation="eq" type="string">
          <Clip endIndex="76" inputString="$(reg)" startIndex="74"/>
          <ValueOf value="140"/>
        </Compare>
        <Compare relation="eq" type="string">
          <Clip endIndex="84" inputString="$(reg)" startIndex="81"/>
          <ValueOf value="0018"/>
        </Compare>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action do="SKIP" onValue="false"/>
    </Condition>
  </Instance>
</MultipleInstance>
Registry keys, where edition and version are stored

The following template checks the identification or detection of the registry keys, where edition and version are stored.

This signature matches a specific version range.

<Variable name="IS_INSTALLED">
  <And>
   <RegKeyValueContains entry="Edition" key="HKEY_LOCAL_MACHINE\SOFTWARE\Vendor\SoftwareName\Data" value="Enterprise" section="64or32"/>
    <RegKeyVersionCompare key="HKEY_LOCAL_MACHINE\SOFTWARE\Vendor\SoftwareName\CurrVer" entry="Version" relation="ge" value="3.00.00.00" section="64or32"/>
    <RegKeyVersionCompare key="HKEY_LOCAL_MACHINE\SOFTWARE\Vendor\SoftwareName\CurrVer" entry="Version" relation="le" value="3.9999.9999.9999" section="64or32"/>
  </And>
</Variable>
Software instances by identifying their registry keys.

The following template checks the identification or detection of the software instances by identifying their registry keys.

Instance name is reflected by the asterisk character in registry path: HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\SoftwareName\*\Info\CurrVer

This signature matches a specific edition and version range. To address this case, two signatures must be created, one for 32-bit and one for 64-bit architecture.

<MultipleInstance>
  <Iterator export="false" name="rg">
    <Vector>
      <RegKeyList root="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SoftwareName\*" section="64" subkeys="false"/>
    </Vector>
  </Iterator>
  <Instance>
    <Variable export="false" name="vr">
      <RegKeyValue entry="Version" key="$(rg)\Info\CurrVer" mustExists="true" section="64"/>
    </Variable>
    <Variable name="IS_INSTALLED">
      <And>
        <RegKeyValueContains entry="Edition" key="$(rg)\Data" section="64" value="Enterprise"/>
        <Contains inputString="$(vr)" position="start" searchedString="3."/>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action do="SKIP" onValue="false"/>
    </Condition>
  </Instance>
</MultipleInstance>

<MultipleInstance>
  <Iterator export="false" name="rg">
    <Vector>
      <RegKeyList root="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SoftwareName\*" section="32" subkeys="false"/>
    </Vector>
  </Iterator>
  <Instance>
    <Variable export="false" name="vr">
      <RegKeyValue entry="Version" key="$(rg)\Info\CurrVer" mustExists="true" section="32"/>
    </Variable>
    <Variable name="IS_INSTALLED">
      <And>
        <RegKeyValueContains entry="Edition" key="$(rg)\Data" section="32" value="Enterprise"/>
        <Contains inputString="$(vr)" position="start" searchedString="3."/>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action do="SKIP" onValue="false"/>
    </Condition>
  </Instance>
</MultipleInstance>
Uninstall registry keys, Windows™ systems

The following template checks the identification or detection of the uninstall registry keys, Windows™ systems.

This signature iterates through all keys and tries to match specific patterns in DisplayName and DisplayVersion values. To address this case, two signatures must be created, one for the 32-bit and one for the 64-bit architecture.

<MultipleInstance>
  <Iterator name="reg" export="true">
    <RegKeyList root="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"     section="32" subkeys="false"/>      </Iterator>
  <Instance>
    <Variable name="valueName" export="true">
      <RegKeyValue entry="DisplayName" key="$(reg)" section="32" />
    </Variable>
    <Variable name="valueVersion" export="true">
      <RegKeyValue entry="DisplayVersion" key="$(reg)" section="32" />
    </Variable>
    <Variable name="IS_INSTALLED">
      <And>
        <Contains inputString="$(valueName)" searchedString="TestProduct" position="start"/>
        <Contains inputString="$(valueVersion)" searchedString="12.0" position="start"/>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP"/>
    </Condition>
  </Instance>
</MultipleInstance>

<MultipleInstance>
  <Iterator name="reg" export="true">
    <RegKeyList root="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"     section="64" subkeys="false"/>
  </Iterator>
  <Instance>
    <Variable name="valueName" export="true">
      <RegKeyValue entry="DisplayName" key="$(reg)" section="64" />
    </Variable>
    <Variable name="valueVersion" export="true">
      <RegKeyValue entry="DisplayVersion" key="$(reg)" section="64" />
    </Variable>
    <Variable name="IS_INSTALLED">
      <And>
        <Contains inputString="$(valueName)" searchedString="TestProduct" position="start"/>
        <Contains inputString="$(valueVersion)" searchedString="12.0" position="start"/>
      </And>
    </Variable>
    <Condition withVariable="IS_INSTALLED">
      <Action onValue="false" do="SKIP"/>
    </Condition>
  </Instance>
</MultipleInstance>