Registrations to Open-AudIT forums are now closed. To ask any new questions please visit Opmantek Community Questions.


What's on your network?
It is currently Sun Apr 21, 2024 4:24 pm

All times are UTC + 10 hours

Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 1 post ] 
Author Message
PostPosted: Tue Dec 09, 2008 8:44 pm 
User avatar

Joined: Tue Jan 25, 2005 3:09 am
Posts: 2140
Location: Scotland
Subject: Custom Software Registry Searching (thanks to Malenx for this FAQ)

Open-Audit contains a simple method for logging registry keys as software. This uses existing code to read a registry key and place it into the database under the Software table. This topic covers what's going on, how to do it ourself, and how to view the data.

In the scripts folder of your open-audit you should find a file named, by default it contains two examples. Around line 2578 of the audit.vbs is a section (' Include customer specific audits) that calls the code in the to run. As such, our needs to be stored in the same directory as our audit.vbs. To get started, I've listed the code to log a key for Mcafee's Network Associates Engine Definition.

' McAffe Engine-Version to the Software Register
strKeyPath = "SOFTWARE\Network Associates\TVD\VirusScan Enterprise\CurrentVersion"
strValueName = "szEngineVer"
display_name = "McAfee Engine-Definition-Version"
oReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,McAfeeVirEng_Version
form_input = "software^^^" & display_name & "^^^" _
& McAfeeVirEng_Version & "^^^" _
& "" & "^^^" _
& "" & "^^^" _
& OSInstall & "^^^" _
& "McAfee^^^^^^^^^^^^^^^^^^" _
& "" & "^^^" _
& "" & "^^^" _
& "" & "^^^ "
entry form_input,comment,objTextFile,oAdd,oComment
form_input = ""

[color=#0000BF]strKeyPath[/color] is our base key folder.
[color=#0000BF]szEngineVer[/color] is the registry key we want.
[color=#0000BF]display_name[/color] is what we will register the key's label as in our database.
[color=#0000BF]oReg.GetStringValue[/color]... pulls the string from the registry. If you are pulling a different data value (IE DWORD, Binary) then you will need to tweak this.
Strings = GetSTRINGValue
Dword = GetDWORDValue
Binary = GetBINARYValue

The rest formats the data into a string and adds it to our xml. The software table has numerous columns, which is why we have so many blank sections. If desired, you could move the data into a different column.

[color=#00BF00](TIP - ^^^ is what open-audit uses to keep the data seperated)[/color]

From here, you can just edit what values you want to read into the database, save the file, and test it on something. I like to have the database open in a viewer like phpmyadmin so I can verify it copied the data correctly. Just browse the software category.


No point in writing data to the database without viewing it. You need two things to view it in open-audit; a query to read the data and a link in the menu to use the query. Both are explained at [url][/url].

[color=#00BF00]Tip: Define the correct path in the menu link.

CORRECT: link.view=all_systems_virus_uptodate_test
INCORRECT: link.view=list_viewdef_all_systems_virus_uptodate_test.php[/color]


[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]

Reply with quote  
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 1 post ] 

All times are UTC + 10 hours

Who is online

Users browsing this forum: No registered users and 1 guest

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group