How can I do a custom check on endpoints?

As of January 09, 2018, MetaAccess provides administrators a way to do a custom check which OPSWAT does not offer in OPSWAT's granular policy, for example: whether a specific registry key/file exists, whether a specific process is running.

How does it work?

Administrators can write a script to do a custom check on a device and apply it to a policy on their MetaAccess account. When a policy enables the custom check, MetaAccess will push a script uploaded to the policy to devices which associated to that policy. The agent will invoke the script with system/root permission frequently. Administrators can configure the script frequency under Policies > "Particular Device" > Custom.

images/download/attachments/336269/image2018-6-13_9-50-9.png

Whenever an agent executes the script, it will report the script result to the MetaAccess cloud. If the script failed to run or timed out, the MetaAccess cloud will treat custom check on the device as GOOD. Administrators can view the script result on device details page

images/download/attachments/336269/image2018-6-13_9-54-45.png and also able to filter devices which the script returns FALSE on Devices page

images/download/attachments/336269/image2018-1-8_16-40-49.png

What scripts does MetaAccess support?

MetaAccess only supports PowerShell script for Windows devices and shell script for macOS devices. MetaAccess doesn't support inputs when executing a script. Scripts MUST return an output as the below format. If the script returns wrong format or invalid value for result or msg, the agent will treat it as failed to execute. From the cloud, we consider the device pass the check. We have some sample scripts here for your reference.

[output]

result = 0

msg = This is a script log

in which:

  • result only accepts 0/1: 0 is FALSE, 1 is TRUE

  • msg limits 2048 bytes

Sample scripts

 

Windows

macOS

Whether a specific registry key exists

Win-CheckExistingRegistryKeyScript.ps1

 

Whether a specific registry key value contains certain regex string

Win-CheckRegistryKeyValueScript.ps1

 

Whether a specific process is running on the system

Win-CheckRunningProcessScript.ps1

MacOS-CheckRunningProcessScript.sh

Whether a specific service is running on the system

Win-CheckRunningServiceScript.ps1

MacOS-CheckRunningServiceScript.sh

Whether a specific file exists on a specific path in the system

Win-CheckExistingFileScript.ps1

MacOS-CheckExistingFileScript.sh

Note that only agent version listed below is able to execute a custom script. If your devices are running older version, you should upgrade them first. See our KB How do I enable agent auto-update feature?.

  • Windows agent: 7.6.136.0+

  • macOS agent: 10.4.162.0+

This article was last updated on 2018-01-09
TT