Declarative data

Declarative data allows you to explicitly report information related to an asset.

They can be used to create an air-gapped asset or to edit the information of an asset that is already supervised by Cyberwatch to adapt the scan results.

The information to be filled in must respect the syntax described below.

Edit the declarative data of an asset

1. Click on Inventory.
2. Select an asset.
3. From the page dedicated to the asset, on “Analyses” tab, click on the edit button in front of “Declarative data”.
4. Fill in the information about the asset, respecting the syntax.
5. Confirm the changes by clicking on the “Update” button.

Syntax of the language

Each property is composed of a key/value pair, whose syntax is:

KEY:value

Syntax precision

• The keys are exclusively composed of capital letters and underscores:

   bad_key: → syntax error
   BAD-KEY: → syntax error
   GOOD_KEY:
  

• Lines that do not respect the key:value format also trigger syntax errors.

  Note that syntax errors are never fatal, the property will simply not be considered in the analysis.

• Comments start at the beginning of the line with the # character, and extend over the whole line. Since values can contain the # character, commenting a part of the line is not possible.

• Multi line values are accepted for some properties. They must have a larger indentation than the property that defines them:

   KEY:start
      ...
      end
  

Forbidding a value

You can forbid a value by preceding the previous syntax with a hyphen. The value will no longer be taken into account by Cyberwatch scans:

-KEY1:value1

All occurrences of KEY1:value1 that follow -KEY1:value1 will be ignored.

N.B.: The hyphen must be followed by the exact line found during the scan.

Types of properties

Two types of properties are available:

• The simple properties that can only be set once and accept only one value. If the property is redefined, the second value is ignored:

   HOSTNAME:server-1
   HOSTNAME:server-2 → ignored
  

• The multiple properties which can be filled in several times in the script. They allow you to build a list of elements:

   # Adds 2 packages
   PACKAGE:coreutils|8.32-1
   PACKAGE:bash|5.1.004-1
  

Note that when editing the information of an asset, the simple properties can be directly rewritten. They will then replace the information reported during scan:

   HOSTNAME:server-1 → remplaces the reported value

However, multiple properties cannot be directly rewritten. For a value to be overwritten, you must forbid it and add a property with the new value.

Use case example:

   # Replace a package version
   -PACKAGE:coreutils|8.31
   PACKAGE:coreutils|8.32

List of main properties

System information

System state

Services

Installed packages/applications

Network information

Windows specific properties

SAP specific properties

Security issues