Advanced Endpoint Analysis policy expression reference
This topic describes the format and construction of Advanced Endpoint Analysis expressions. The NetScaler Gateway configuration utility automatically builds the expression elements contained here and does not require manual configuration.
Expression format
An Advanced Endpoint Analysis expression has the following format:
CLIENT.APPLICATION (SCAN-type_ Product-id_ Method-name _ Method-comparator_ Method-param _…)
Where:
SCAN-type is the type of application being analyzed.
Product-id is the product identification for the analyzed application.
Method-name is the product or system attribute being analyzed.
Method-comparator is the chosen comparator for the analysis.
Method-param is the attribute value or values being analyzed.
Example:
client.application(ANTIVIR\_2600\_RTP\_==\_TRUE)
Note:
For non-application scan types, the expression prefix is CLIENT.SYSTEM instead of CLIENT.APPLICATION.
Expression strings
Each of the supported scan types in Advanced Endpoint Analysis uses a unique identifier in the expressions. The following table enumerates the strings for each type of scan.
| Scan type | Scan type expression string |
|---|---|
| Anti-phishing | ANTIPHI |
| Antivirus | ANTIVIR |
| Backup Client | BACKUP |
| Citrix Workspace app (macOS) | MAC-CWA |
| Citrix Workspace app (Windows) | WIN-CWA |
| Data Loss Prevention | DATA-PREV |
| Firewall | FIREWALL |
| Health Agent | HEALTH |
| Hard disk Encryption | HD-ENC |
| Instant Messenger | IM |
| Web Browser | BROWSER |
| P2P | P2P |
| Patch Management | PATCH |
| MAC address (expression) | MAC |
| Domain check | DOMAIN |
| Registry Scan | REG |
| Windows Update Scan | WIN-UPDATE |
Note:
-
For macOS specific scans, expressions include the prefix
MAC-before the method type. Therefore, for antivirus and anti-phishing scans, the methods are MAC-ANTIVIR and MAC-ANTIPHI respectively. For example:client.application(MAC-ANTIVIR_2600_RTP_==_TRUE). -
The WIN-CWA scan is supported from Windows EPA library version 24.8.1.4 available at EPA library.
-
The MAC-CWA scan is supported from EPA client for macOS version 24.9.26 available at EPA client for macOS and mac_epa.tgz with OPSWAT version 4.3.3762 available at EPA.
Application scan methods
In configuring Advanced Endpoint Analysis expressions, methods are used to define the parameters of the endpoint scans. These methods include a method name, a comparator, and a value. The following tables enumerate the methods available for use in expressions.
Common Scan Methods:
The following methods are used for multiple types of application scans.
| Method | Description | Comparator | Possible values |
|---|---|---|---|
| VERSION* | Specifies version of the application. | <, <=, >, >=, !=, == | Version string |
| AUTHENTIC** | Check if the application is authentic or not. | \== | TRUE |
| ENABLED | Check if the application is enabled. | \== | TRUE |
| RUNNING | Check if the application is running. | \== | TRUE |
| COMMENT | Comment field (ignored by scan). Delineated by [] within expressions. | \== | Any text |
* The VERSION string can specify a decimal string of up to four values, such as 1.2.3.4.
** An AUTHENTIC check verifies the authenticity of the binary files for the application.
Note:
You can select a generic version for application scan types. When generic scans are selected, the product ID is 0.
Gateway provides an option to configure Generic scans for each type of software. Using generic scan, an admin can scan the client machine without restricting the scanning check to any particular product.
For Generic scans, scan methods work only if the product installed on the users system supports that scan method. To know which products support a particular scan method, contact NetScaler® support.
Unique Scan Methods:
The following methods are unique to the specified types of scans.
| Method | Description | Comparator | Possible values |
|---|---|---|---|
| ENABLED-FOR | Check whether anti-phishing software is enabled for the selected application. | allof, anyof,noneof |
For Windows: Internet Explorer, Mozilla Firefox, Google Chrome, Opera, Safari. For Mac: Safari, Mozilla Firefox, Google, Chrome, Opera |
Table 2. Antivirus
| Method | Description | Comparator | Possible values |
|---|---|---|---|
| RTP | Check whether the real-time protection is on or not. | \== | TRUE |
| SCAN-TIME | How many minutes since a full system scan was performed. | <, <=, >, >=, !=, == | Any positive number |
| VIRDEF-FILE-TIME | How many minutes since virus definition file was updated (that is, Number of minutes between virus definition file stamp and current timestamp). | <, <=, >, >=, !=, == | Any positive number |
| VIRDEF-FILE-VERSION | Version of definition file. | <, <=, >, >=, !=, == | Version string |
| ENGINE-VERSION | Engine version. | <, <=, >, >=, !=, == | Version string |
Table 3. Backup client
| Method | Description | Comparator | Possible values |
|---|---|---|---|
| LAST-BK-ACTIVITY | How many minutes since last backup activity was completed. | <, <=, >, >=, !=, == | Any positive number |
Table 4. Data loss prevention
| Method | Description | Comparator | Possible values |
|---|---|---|---|
| ENABLED | Check whether the application is enabled or not and time protection is on or not on. | \== | TRUE |
Table 5. Health check agent
| Method | Description | Comparator | Possible values |
|---|---|---|---|
| SYSTEM-COMPL | Check whether the system is in compliance. | \== | TRUE |
Table 6. Hard disk encryption
| Method | Description | Comparator | Possible values |
|---|---|---|---|
| ENC-PATH | PATH for checking encryption status. | NO OPERATOR | Any text |
| ENC-TYPE | Check whether the encryption type for the specified path. | allof, anyof, noneof |
List with the following options: UNENCRYPTED, PARTIAL, ENCRYPTED, VIRTUAL, SUSPENDED, PENDING |
Table 7. Web browser
| Method | Description | Comparator | Possible values |
|---|---|---|---|
| DEFAULT | Check whether set as the default browser. | \== | TRUE |
Table 8. Patch management
| Method | Description | Comparator | Possible values |
|---|---|---|---|
| SCAN-TIME | How many minutes since the last scan for the patch was performed. | <, <=, >, >=, !=, == | Any positive number |
| MISSED-PATCH | Client system is not missing patches of these types. | anyof, noneof |
ANY Pre-selected (Pre-selected patches on Patch Manager server) |
Table 9. MAC Address (expression)
| Method | Description | Comparator | Possible values |
|---|---|---|---|
| ADDR | Check whether the client machine MAC addresses are or are not in the given list. | anyof, noneof |
Editable list |
Table 10. Domain membership
| Method | Description | Comparator | Possible values |
|---|---|---|---|
| SUFFIX | Check whether the client machine exists or does not exist in the given list. | anyof, noneof |
Editable list |
Table 11. Numeric registry entry
| Method | Description | Comparator | Possible values |
|---|---|---|---|
| PATH | Path for registry check. In the format: HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Secure Access Client\EnableAutoUpdate. No escaping of special characters is required. All registry root keys: HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, HKEY_USERS, HKEY_CLASSES_ROOT, HKEY_CURRENT_CONFIG | NO OPERATOR | Any text |
| REDIR-64 | Follow 64-bit redirection. If set to TRUE, WOW redirection is followed (that is, Registry path is checked on 32-bit systems but WOW redirected path is checked for 64-bit systems.) If not set, WOW redirection is not followed (that is, the same registry path is checked for 32-bit and 64-bit systems.) For registry entries that are not redirected this setting has no effect. See the following article for the list of registry keys that get redirected on 64-bit systems: http://msdn.microsoft.com/en-us/library/aa384253%28v=vs.85%29.aspx |
== | TRUE |
| VALUE | Expected value for the above path. This scan works only for registry types of REG_DWORD and REG_QWORD. | <, <=, >, >=, !=, == | Any number |