Compliance Checks for ranges using the Desired Configuration Monitoring (DCM) Solution
There might be several scenarios where you might want to check if a particular value lies within a range. Examples:
Like a file version should be between 1.0.29.0 and 1.0.34.0
OR
Antivirus version between 7.1 and 7.4
OR
CPU processing power between 1GHz and 3 GHz
Scenarios like these are pretty common and the DCM Solution can help you do that. Let us see how we can create a manifest with the DCM Solution to check for ranges of values.
When we talk about ranges, there are three types of ranges:
- Integer range (like raw CPU processing power)
- Decimal range (like antivirus version)
- String range (like file version)
The Query Expression in a DCM rule is an XPath expression. Since XPath can handle integer ranges and decimal ranges, DCM Rules also can handle these types of ranges. However string ranges are not supported by XPath for comparison. For example $. > ‘1.24.3.1’. Hence the only way to do such comparisons in DCM is to convert the string to a number and then do the comparison.
Examples:
Check for the value of a setting to be between 17 and 24. You can do this in DCM why creating a rule expression like: $. > 17 and $. < 24.
Check for the value of a setting to be between 9.1 and 9.4. You can do this in DCM by creating a rule expression like: $. > 9.1 and $. < 9.4.
Check for the value of a setting between 1.0.29 and 1.0.34. These are string values. DCM Solution cannot do a direct comparison for strings like these. So what we would need to do is convert these strings to numbers by removing the decimal points in between them and then do the comparison. Here is how you would do it…
Step 1: Convert the actual value to a number using replace($., '\.', '') . This essentially removes the dot in the value.
Step 2: Write the query as replace($., '\.', '') > 1029 and replace($., '\.', '') < 1034
If you note all the three examples discussed here can be done using the DCM Solution Query Builder. However, the DCM query builder does not allow you to create these query expressions using the dropdowns / textboxes because these are supposed to be advanced query expressions. For the purpose of creating advanced query expressions, the DCM query builder screen provides a section called Advanced Query Expression. Click the Build XPath Expression checkbox in this section and start typing in your XPath query in the text area provided. This way you can create complex XPath expressions. The DCM Solution does not attempt to validate / parse the complex XPath expressions which you enter in the advanced text area.
I have included a sample xml manifest to do range comparisons (for all types of ranges). You will also need to create the sample registry entries to get the manifests working. Or else, DCM will ignore the rules.
Thanks!