Professional Documents
Culture Documents
IBM Training
October 2018 edition
NOTICES
This information was developed for products and services offered in the USA.
IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM
representative for information on the products and services currently available in your area. Any reference to an IBM product, program,
or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent
product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's
responsibility to evaluate and verify the operation of any non-IBM product, program, or service.
IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this
document does not grant you any license to these patents. You can send license inquiries, in writing, to:
IBM Director of Licensing
IBM Corporation
North Castle Drive, MD-NC119
Armonk, NY 10504-1785
United States of America
The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local
law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF
ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of
express or implied warranties in certain transactions, therefore, this statement may not apply to you.
This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein;
these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s)
and/or the program(s) described in this publication at any time without notice.
Any references in this information to non-IBM websites are provided for convenience only and do not in any manner serve as an
endorsement of those websites. The materials at those websites are not part of the materials for this IBM product and use of those
websites is at your own risk.
IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.
Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other
publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other
claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those
products.
This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible,
the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to
the names and addresses used by an actual business enterprise is entirely coincidental.
TRADEMARKS
IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many
jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM
trademarks is available on the web at “Copyright and trademark information” at www.ibm.com/legal/copytrade.shtml.
Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems
Incorporated in the United States, and/or other countries.
Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in the United States, other countries, or both and is used
under license therefrom.
Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and
Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.
IT Infrastructure Library is a Registered Trade Mark of AXELOS Limited.
ITIL is a Registered Trade Mark of AXELOS Limited.
Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates.
Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are trademarks of HP, IBM Corp. and Quantum in the U.S. and
other countries.
Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both.
Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries,
or both.
UNIX is a registered trademark of The Open Group in the United States and other countries.
Uempty
This is an Intermediate level course that is intended to teach the students foundation level
knowledge of the IBM BigFix Relevance language. This language is used by advanced master
operators, and others who have the responsibility to create custom Fixlets, tasks, analyses,
properties, and automatic groups. The course also provides and overview of the action script
language that is used in custom Fixlets and tasks to effect change on managed endpoints through
an action.
Course setup
Instructors must possess all of the teaching skills that are required of a successful instructor. This
section describes the additional course-specific knowledge that instructors should have.
Instructor background
This section describes the technical and tool-specific knowledge that is necessary for instructors to
deliver the course successfully. If the instructor cannot address these topics and draw on industry
experience in doing so, the course might not be successful.
Uempty
Suggested instructor preparation
The following preparations are suggested specifically for this course:
• Review and become familiar with the resources that are available on the IBM Knowledge
Center and understand how to locate the latest IBM BigFix documentation.
http://ibm.biz/IntroRelevance
• Be familiar with the content in the Fixlet Authoring section of the BigFix wiki page, especially the
Inspector Documentation.
http://ibm.biz/FixletAuthoring
• Review and understand the information for BigFix developers on the BigFix Developer site,
BigFix Me site, and Security Learning Academy. These are also a good resources to pass along
to students of this course.
– https://developer.bigfix.com/
– http://bigfix.me
– http://ibm.biz/SecurityLearningAcademyIBMBigFix
Other resources
• The BigFix forum contains information that is contributed by BigFix experts and users. You can
search for answers and post questions.
https://forum.bigfix.com/
• Many BigFix videos exist on the IBM Security Support YouTube channel. The content in these
videos can extend a student’s learning experience and answer a variety of BigFix-related
questions.
https://ibm.biz/BigFix-LMT-YT-Playlists
• The Instructor may also want to explore some of IBM’s other training offerings on the IBM
Security Support YouTube channel
https://www.youtube.com/user/IBMSecuritySupport
• The IBM BigFix Community is a collaborative community space for IBM BigFix users. Being part
of a community means collaborating, sharing knowledge, and supporting one another. You can
use forums, blogs, files, and face-to-face networking to connect with other BigFix users.
http://ibm.biz/IBMBigFixCommunity
Software requirements
The companion VMware image set is required.
Uempty
Recommendations for students
Prerequisites
Before taking this course, make sure that you are proficient in the use of the IBM BigFix console,
including taking actions, creating retrieved properties, analyses, and other general tasks, or that
you have taken the IBM BigFix Platform Foundations course.
Course classification
Experience: Intermediate
End user level: This course is designed for users and administrators who develop fixlets or are
advanced master operators.
Uempty
• Review all of the Learning Journeys that refer to this course.
You should know what comes before and after this course so that you can verify that your
audience meets the prerequisites and sell your audience on the follow-on courses.
Course overview
IBM® BigFix® provides real-time visibility and control through a single infrastructure, a single
agent, and a unified console. You can use this platform for systems lifecycle management, endpoint
protection, and security configuration and vulnerability management. With IBM BigFix, you can
discover, assess, remediate, and enforce the health and security of servers, desktops, and laptops.
In this three-day course, you learn the basic Relevance constructs used to create Relevance
statements. You also learn how to manipulate various Relevance objects and properties, and how
to create Relevance for custom fixlets, tasks, automatic computer groups, retrieved properties and
analyses. Finally, you learn how to create and test action scripts that are included in the custom
fixlets and tasks that you develop.
Note: This course is designed with modular content. You can deliver the modules in any
sequence as a regular course or you can bundle them with other modular content to create
custom courses.
Strategy
Teaching strategy
Each classroom session uses a combination of facilitated lecture, discussions, group exercises,
and demonstrations to convey the material.
Uempty
Review the material
Review objectives at the conclusion of each unit to ensure that the students have a thorough
understanding of the material.
Group exercises and labs are used to reinforce knowledge and skills that the students have learned
in the previous classroom topics. The instructor serves as a mentor in checking results, answering
questions, and providing constructive feedback and evaluation.
Course evaluation
Evaluation measures the quality, effectiveness, and impact of the course. It enables students to
answer the question, “Are the requirements and objectives of the course being met?”
For all classes, instructors will provide an end-of-course questionnaire that students will complete
as feedback on course quality.
Materials
The following materials are available for this course:
• Course Guide (IS7311course.pdf)
• Course Exercises (IS7311exercises.pdf)
• Instructor Preparation Guide (IS731instprep.pdf)
• Virtual Machines Reference Guide (IS7311vmrg.pdf)
• Slide presentations (IS7311show.zip)
• Lab files (IS7311labfiles.zip)
This file includes the IS7311_code_cheat_sheet.pdf and the badge quiz questions
(IS7311assessment.xlsx)
• Lab environment
Uempty
Course updates
This class replaces IS730G ERC 1.0, IBM BigFix Content Development. The lab environment is
updated to BigFix version 9.5.4.38, and the lab exercises are updated to reflect the new lab
environment. The following table summarizes at a high level where to find changes to the course.
Unit Update
Unit 1: IBM BigFix Content • Expanded the explanation of Relevance
Development: Introduction • Included links to the Inspector Library
Unit 2: IBM BigFix Content Lab Update: Removed Exercise 1 Starting the environment.
Development: Basic Relevance These steps are included in the “About these exercises” section
on page vi.
Unit 3: IBM BigFix Content Lab Update: Removed Exercise 1 Starting the environment.
Development: Common objects These steps are included in the “About these exercises” section
on page vi.
Unit 4: IBM BigFix Content • Lab Update: Removed Exercise 1 Starting the environment.
Development: Action scripts These steps are included in the “About these exercises”
section on page vi.
• Lab Update: Removed Exercise 12 Downloading and
installing an application
• Lab Update: Removed Exercise 13 Uninstalling an
application
Important: The quiz students use to earn the BigFix Content Development badge now includes
38 questions. There is a copy of the quiz questions in the IS7311labfiles.zip file.
Uempty
This course is designed with modular content. You can deliver the modules in any sequence as a
regular course or you can bundle them with other modular content to create custom courses. When
modules include exercises, the exercises stand alone and do not depend on any other exercises.
This section lists the requirements of each module.
The total time for all of the modular units in this course, including the introduction, demonstrations,
and wrap-up, is 23 hours.
Objectives
• Describe how to use the Relevance language to build fixlets and tasks and retrieve endpoint
data
• Describe how to use Fixlet Debugger to perform a Relevance query
• Use the Inspector documentation to find the objects and object properties necessary to develop
custom Relevance queries and action scripts
Uempty
Content
Lessons:
• Lesson 1: IBM BigFix content
• Lesson 2: Inspector tools and objects
Topic/Lesson Notes
Lesson 1: IBM BigFix content This lesson introduces the Relevance language, types of
Relevance, and where you can use Relevance. It also
introduces the difference between how you can use
Relevance to build fixlets and tasks and retrieve endpoint
properties and analyses.
Note: Emphasize the various components within IBM
BigFix where Relevance is used. Inform the students that
they create many of these structures during this class.
Explain that Relevance is an object-oriented query
language, and it is unlike other programming languages in
that it has no variables, loops, or other programming
structures.
Lesson 2: Inspector tools and This lesson describes tools and documents you can use to
objects create Relevance statements. You learn about using the
qna and single clause tabs in Fixlet Debugger. You also
learn how to find inspector forms you can used to develop
custom Relevance queries and action scripts in the
Inspector Library and Inspector Reference guides.
Note: There are 4 badge quiz questions associated with this unit. Refer to the
IS7311assessment.xlsx file for the quiz questions.
Uempty
Unit 2: IBM BigFix Content Development: Basic Relevance
Objectives
• Use the property of an object construct to return file data
• Develop basic Relevance queries using the if-then-else construct
• Develop basic Relevance queries using the whose-it construct
• Develop basic Relevance queries using the it-without-a-whose construct
Content
Lessons:
• Lesson 1: Property of an object construct
• Lesson 2: Developing queries with the if-then-else construct
• Lesson 3: Using the whose-it construct
• Lesson 4: Using the it-without-a-whose construct
Number of exercises: 14
The estimated time for this unit is 4 hours, 30 minutes for lecture and 1 hour, 30 minutes for the
exercises.
Topic/Lesson Notes
Lesson 1: Property of an object The <property> of <object> is the most basic construct
construct used in Relevance. You can use this construct to retrieve
information about files on your endpoints. The <property>
of <object> construct also forms the basis of other
constructs such as the if-then-else, whose-it, and
it-without-a-whose constructs. In this lesson, you also
learn about Boolean operators and use running application
and regapp to create a file object.
Note: It might be useful to show the Relevance code on the
Console before teaching the Fixlet Debugger. Explain how
it relates to that component. For example, look at the
details of a fixlet and examine the Relevance code.
Uempty
Topic/Lesson Notes
Lesson 1 Exercises • Exercise 1: Determining the size of a Windows file
• Exercise 2: Determining the version of a file
• Exercise 3: Comparing versions
• Exercise 4: Checking the existence of a file
• Exercise 5: Using Boolean operators
• Exercise 6: Determining whether an application is
running
Lesson 2: Developing queries with The if-then-else Relevance construct checks for a
the if-then-else construct condition and evaluates different properties that are based
on the results of the condition. The if-then-else clause is
often used to retrieve properties.
Lesson 2 Exercise Exercise 7: Using the if-then-else structure
Lesson 3: Using the whose-it The whose-it clause is commonly used to filter a list that
construct is based on a specific condition. Although the examples in
this course use simple conditions, you can use these
concepts to create more complex statements.
Lesson 3 Exercises • Exercise 8: Querying for quantities
• Exercise 9: Using the whose-it clause for counting
executable files
• Exercise 10: Using the whose-it clause for finding
services
• Exercise 11: Using the whose-it clause to avoid errors
Lesson 4: Using the This lesson describes the it-without-a-whose construct.
it-without-a-whose construct You can use this construct to write simpler Relevance
clauses.
Note: The Class challenge on page 74 is optional. If time
permits, have the students work through the analysis
individually or walk the class through the challenge.
Lesson 4 Exercises • Exercise 12: Using an it-without-a-whose construct
• Exercise 13: Using an it-without-a-whose clause and
including the version
• Exercise 14: Determining the type of operating system
Note: There are 8 badge quiz questions associated with this unit. Refer to the
IS7311assessment.xlsx file for the quiz questions.
Uempty
Unit 3: IBM BigFix Content Development: Common objects
Objectives
• List some common objects you can use to modify IBM BigFix data
• Create and manipulate string objects
• Create network objects
• Describe how t use environmental variables and Registry objects
• Use the Time and Date objects to return endpoint data
• Use the File, WMI, and Client objects to return endpoint data
• use Tuple to create a list of elements and group properties of the same object type
• Use RegEx objects in Relevance queries and concatenate string properties
• Create various User objects
Content
Lessons:
• Lesson 1: Introduction to BigFix Relevance objects
• Lesson 2: Strings
• Lesson 3: Network objects
• Lesson 4: Environment and Registry
• Lesson 5: Time and Date
• Lesson 6: Queries and settings
• Lesson 7: Tuple
• Lesson 8: Regular expressions
• Lesson 9: User objects
Number of demonstrations: 2
Number of exercises: 24
Uempty
The estimated time for this unit is 4 hours for lecture and 4 hours for exercises.
Topic/Lesson Notes
Lesson 1: Introduction to BigFix This lesson describes some of the common objects used in
Relevance objects BigFix Relevance, such as files and user objects.
Lesson 1 Exercises • Exercise 1: Determining the percentage of free space
• Exercise 2: Determining the free space on all drives
• Exercise 3: Determining the system architecture
Lesson 2: Strings This lesson describes how to create and manipulate string
objects.
Lesson 2 Exercise Exercise 4: Locating a file
Lesson 3: Network objects In this lesson, you learn how to create network objects.
Lesson 3 Exercises • Exercise 5: Using address of network inspector
• Exercise 6: Interrogating network adapters
Lesson 4: Environment and This lesson describes how to use environment variables
Registry and Registry objects.
Lesson 4 Exercises • Exercise 7: Inspecting the environment
• Exercise 8: Inspecting the registry
• Exercise 9: Using a whose-it clause to avoid errors
• Exercise 10: Extracting a path name
• Exercise 11: Extracting a path name and checking for
errors
Lesson 5: Time and Date In this lesson, you use the Time and Date objects to return
endpoint data.
Lesson 5 Exercises • Exercise 12: Determining the amount of time that a host
is operational
• Exercise 13: Displaying date and time
• Exercise 14: Finding the first of the month
Lesson 6: Queries and settings In this lesson, you use the File, WMI, and Client objects to
return endpoint data.
Note: There are 2 demonstrations in this lesson:
• Instructor Demonstration: Relevance and WMI speed
comparison on page 110.
• Instructor Demonstration: Using the console to add a
client setting on page 113.
Uempty
Topic/Lesson Notes
Lesson 6 Exercises • Exercise 15: Displaying the last line of a log file
• Exercise 16: Determining the number of lines in a log
file without hard-coded paths
• Exercise 17: Determining the number of lines in a log
file and using error checking
Important: To complete exercises 16 and 17, you need at
least 1 log file that was generated 1 day ago. If you follow
this course as is, the log file will exist and the exercises
work as written. If a participant does not have log files
generated on the previous day, the exercise will not return
results. One work-around is to remove the (current date
- 1*day) code from the Relevance clause.
• Exercise 18: Finding a specific line in a file
• Exercise 19: Performing a WMI query
• Exercise 20: Inspecting client settings
Lesson 7: Tuple Tuple is an element of the Relevance language. This
lesson describes how to use Tuple to create a list of
elements and group properties of the same object type
together.
Lesson 7 Exercise Exercise 21: Using a tuple construct
Lesson 8: Regular expressions This lesson defines regular expressions (RegEx) and
describes RegEx objects. You also learn how to
concatenate string properties.
Lesson 8 Exercises • Exercise 22: Using regular expressions to remove
control characters in string expressions
• Exercise 23: Using regular expressions to extract
portions of a string
Note: Exercise 23 uses the Regex.txt file. This file is
included in the virtual machine images and in the
IS7311labfiles.zip file.
Lesson 9: User objects This lesson reviews how to create User objects. It also
reviews user objects properties and standard user objects.
Lesson 9 Exercise Exercise 24: Using user objects
Note: There are 13 badge quiz questions associated with this unit. Refer to the
IS7311assessment.xlsx file for the quiz questions.
Uempty
Unit 4: IBM BigFix Content Development: Action scripts
Objectives
• Locate Action script documentation and the Fixlet Debugger Action tab
• Edit existing Relevance to create a custom fixlet or task
• Use basic Action commands within fixlets and tasks
• Describe how to use Fixlet Debugger to create custom actions and define success criteria
• Use actions that are specific to the Windows operating system
• Use commands to perform conditional branching in action scripts
• Create and append a file using an action script
• Use the Archive Manager and leverage configuration settings
• Discuss download logs, prefetching, and the download file process
Note: Introduce the IS7311_code_cheat_sheet.pdf. Students can use this document to copy and
paste the Relevance code that is used in the exercises.
Content
Lessons:
• Lesson 1: Action script documentation and tools
• Lesson 2: Editing properties and groups
• Lesson 3: Basic action commands
• Lesson 4: Creating custom content
• Lesson 5: Using Windows actions
• Lesson 6: Using conditions
• Lesson 7: Creating files
• Lesson 8: Archiving files
• Lesson 9: Downloading files
Number of exercises: 10
Uempty
The estimated time for this unit is 4 hours, 30 minutes for lecture and 2 hours, 30 minutes for
exercises.
Topic/Lesson Notes
Lesson 1: Action script This lesson introduces the high-level purpose of action
documentation and tools scripting, Action script documentation resources, and the
Action tab included in Fixlet Debugger.
Lesson 1 Exercises • Exercise 1: Using Relevance to create an automatic
group
• Exercise 2: Editing Relevance to create a property
Lesson 2: Editing properties and In this lesson you locate, copy, and modify existing
groups Relevance statements to create a new Relevance
expression that are used to create a custom fixlet or
custom task. Editing and re-purposing existing Relevance
is a common task.
Lesson 3: Basic action commands In this lesson, you are introduced to the basic action script
commands. You also learn how to use Relevance
substitution within an action script.
Lesson 3 Exercises • Exercise 3: Renaming a file
• Exercise 4: Using Relevance substitution
Lesson 4: Creating custom content In this lesson, you review the various tabs that are used to
create a custom fixlet or custom task in the IBM BigFix
console.
Lesson 5: Using Windows actions In this lesson, you learn about the basic action commands
that apply to Windows clients only. You also learn about the
Override command that is available for all operating
systems. It is presented in this lesson as an extension to
the Runascurrentuser command.
Lesson 5 Exercises • Exercise 5: Disabling the Windows Firewall service
• Exercise 6: Run as current user
Lesson 6: Using conditions In this lesson, you review the various commands that are
available for performing conditional branching within action
scripts.
Lesson 6 Exercises • Exercise 7: Using the if-else if-else-endif clause
• Exercise 8: Developing parameters
Lesson 7: Creating files In this lesson, you learn how to create a file within an action
script. Using this capability, you can create batch files,
UNIX shell scripts, and other files from the action script that
fixlets can then run or parse for specific values.
Lesson 7 Exercise Exercise 9: Creating a UNIX script
Uempty
Topic/Lesson Notes
Lesson 8: Archiving files In this lesson, you learn how to use the Archive Manager
to archive BigFix client log files. You also learn about key
Archive Manager client settings and where the files are
stored on the IBM BigFix server.
Lesson 8 Exercise Exercise 10: Archiving the client log files
Lesson 9: Downloading files In this lesson, you learn how to download a file to an
endpoint using an action script.
Note: There are 13 badge quiz questions associated with this unit. Refer to the
IS7311assessment.xlsx file for the quiz questions.