Entity Properties

Entities can hold structured information in the form of properties. The user or a module can query or modify existing entity properties and even create arbitrary ones with new information.

Properties can be viewed and modified through the Entity Properties Dialog panel. You can activate or deactivate this dialog box using the Views -> Entity Properties option of the main menu or by clicking the Entity Properties button on the Views Toolbar. Additionally, you can activate the Entity Properties dialog for a specific entity by right-clicking on that entity and selecting Properties from the context menu.

Entity Properties Dialog Box

figure 38 - Entity Properties Panel

The Entity Properties Dialog Box is a dockable window, which means that you can move it around to a different location, leave it floating, or hide it. To "dock" the window, drag it by its title bar to the desired position. Windows can only be docked against the Console's edges. To "un-dock" the window, double click in its title bar.

Individual properties are organized into containers (displayed in bold-face in the Properties Dialog Box). Each container can be expanded or collapsed using the arrow head in front of its name. Containers can also hold other containers.

Hidden properties. Some special system properties have a hidden attribute that keeps them from being displayed in the Entity Properties Dialog Box. If you wish, you can make these properties visible using the Show hidden properties option in the Entity Properties Tab of the Options Dialog Box (use Tools -> Options).

Editing the Value of a Property

To manually change the value of a specific property, click on the Value cell of the property's row. The value will be replaced by an edit box that allows you to enter new information or a drop down box that allows you to select from a list of valid values.

Entity Properties Dialog Box - Editing Values

figure 39 - Entity Properties Dialog Box - Editing Values

Adding a New Property to a Container

To add a new property to a container, follow this procedure.

  1. Right-click on the container's name in the Entity Properties Dialog Box (to add a property to an entity's root container, right-click on the entity's name). Select Add new from the context menu.

    Entity Properties Dialog Box - Add New Property to Container

    The Property value Dialog Box appears.

    The Property value Dialog Box

  2. Enter a Name, select a Type, and enter a Value for the new property. (See field definitions below.) Then click OK.

Name

A name for the new property.

Type

There are many Types that the new property can be - a few examples are listed in the following table:

Type Description
arch Host architecture
bool true or false
certificate The host's certificate
container A generic property container
entity_name An Entity name
file A file in the agent's filesystem
int Any integer value
null No value. Useful for sets
os Host operating system
port A TCP/UDP port
ports A container of ports
set A set of properties. Sets can only contain null properties
string Any string value
uint16 An unsigned integer 16 bits long
uint32 An unsigned integer 32 bits long
xmldata Unparsed XML data

The types entity, entity listed, xmldata, and user are not currently configurable by the user.

Value

The initial value for the new property. This value can be edited using the Entity Properties Dialog Box.