Using BigFix Scanner Service Data

Accessing BigFix Scanner Service data.

The information collected by BigFix Scanner Service is available through the SQLite database and can be accessed using the sqlite database inspector.

Note: Minimal version of BigFix Platform Agent supporting access to the BigFix Scanner APIs is 11.0.2 (sqlite driver version 3.45.1). On older versions of BigFix Platform Agent, due to the older version of SQLite driver, some of the BigFix Scanner APIs might be not accessible and querying them will result in an error.

Information available in the documented views with name prefixed with api_ is considered as an interface and is recommended. Using any other structure or through any other interface is not recommended and is not supported.

Refer to BigFix Scanner Service API section for available interfaces.

Use case on using the process to access the information from the BigFix Relevance, samples:

Partition info

Q: rows of statements "select * from api_dev_partitions" of sqlite database of files "bf-scanner.db" of folder (pathname of the parent folder of the client & "\tools\scanner\db\")

Output

A: 1,Test,D:,NTFS,10719588352,2024-11-29T12:28:57Z,1,\\.\PHYSICALDRIVE1,10733990400,0 ,SSD,(Standard disk drives),Microsoft Virtual Disk,,2024-11-29T12:28:57Z 
        A: 2,Windows,C:,NTFS,1021821579264,2024-11-29T12:28:57Z,2,\\.\PHYSICALDRIVE0, 1024203640320,0,SSD,(Standard disk drives),SKHynix_HFS001TEJ9X162N, ACE4_2E00_35D9_5CC6_2EE4_AC00_0000_0001.,2024-11-29T12:28:57Z 
        A: 3,Dev Drive,E:,ReFS,53687091200,2024-11-29T12:28:57Z,3,\\.\PHYSICALDRIVE2, 53702853120,0,SSD,(Standard disk drives),Microsoft Virtual Disk,,2024-11-29T12:28:57Z 
        T: 3228

Package info

Q: rows of statements "select * from api_package_data" of sqlite database of files "bf-scanner.db" of folder (pathname of the parent folder of the client & "\tools\scanner\db\")

Output

A: Microsoft Corporation,Microsoft Windows Server 2022 Standard,10.0.20348.2849 (21H2),C:\Windows,SPECIAL,*,2021-05-08 00:00:00,NULL
        A: Microsoft Corporation,Internet Explorer,11.0.20348.2849,,SPECIAL,*,,NULL
        A: Google LLC,Google Chrome,131.0.6778.265,C:\Program Files\Google\Chrome\Application,REG32,Google Chrome,2025-01-10 00:00:00,NULL
        ... 
        ...
        ...
        
        A: "CrowdStrike, Inc.",CrowdStrike Firmware Analysis,7.14.18456.0,C:\Program Files\CrowdStrike,REG64,{617D389D-AD52-43DA-8A21-F297A5D90322},2024-10-24 00:00:00,NULL
        
        T: 26733

Web browser monitoring tables

Web browser monitoring adds three tables to bf-scanner.db.

browsermon_components - known web applications, populated at module start-up from the embedded configuration.


Column	Type	Null	Description
id	integer	no	Primary key, autoincrement
name	text	no	Component name
publisher_name	text	no	Publisher name
publisher_regid	text	no	Publisher registration ID
tag_id	text	no	SWID tag identifier

Unique: id, tag_id, (name, publisher_name).

browsermon_component_patterns - patterns identifying a component. Many-to-many.


Column	Type	Null	Description
component_id	integer	no	Foreign key to browsermon_components.id
url_pattern	text	no	Regular expression matched against reported addresses

Unique: (component_id, url_pattern).

browsermon_matched_components - components actually detected, per operating system user.


Column	Type	Null	Description
component_id	integer	no	Foreign key to browsermon_components.id
os_user_dir	text	no	Name of the operating system user's home directory, used to attribute the match and to name the SWID tag file
first_seen	integer	no	Timestamp of first detection
last_seen	integer	no	Timestamp of most recent detection

Unique: (component_id, os_user_dir).

Rows are removed by the 5-minute maintenance job when last_seen is more than 30 days old.