Entity Properties
Entities can hold structured information in the form of properties. The user or a module can query or modify existing entity properties and even create arbitrary ones with new information.
Properties can be viewed and modified through the Entity Properties Dialog panel. You can activate or deactivate this dialog box using the Views -> Entity Properties option of the main menu or by clicking the Entity Properties button on the Views Toolbar. Additionally, you can activate the Entity Properties dialog for a specific entity by right-clicking on that entity and selecting Properties from the context menu.
figure 38 - Entity Properties Panel
The Entity Properties Dialog Box is a dockable window, which means that you can move it around to a different location, leave it floating, or hide it. To "dock" the window, drag it by its title bar to the desired position. Windows can only be docked against the Console's edges. To "un-dock" the window, double click in its title bar.
Individual properties are organized into containers (displayed in bold-face in the Properties Dialog Box). Each container can be expanded or collapsed using the arrow head in front of its name. Containers can also hold other containers.
Hidden properties. Some special system properties have a hidden attribute that keeps them from being displayed in the Entity Properties Dialog Box. If you wish, you can make these properties visible using the Show hidden properties option in the Entity Properties Tab of the Options Dialog Box (use
-> ).Editing the Value of a Property
To manually change the value of a specific property, click on the Value cell of the property's row. The value will be replaced by an edit box that allows you to enter new information or a drop down box that allows you to select from a list of valid values.
figure 39 - Entity Properties Dialog Box - Editing Values
Adding a New Property to a Container
To add a new property to a container, follow this procedure.
-
Right-click on the container's name in the Entity Properties Dialog Box (to add a property to an entity's root container, right-click on the entity's name). Select Add new from the context menu.
The Property value Dialog Box appears.
-
Enter a Name, select a Type, and enter a Value for the new property. (See field definitions below.) Then click OK.
- Name
-
A name for the new property.
- Type
-
There are many Types that the new property can be - a few examples are listed in the following table:
Type Description arch Host architecture bool true or false certificate The host's certificate container A generic property container entity_name An Entity name file A file in the agent's filesystem int Any integer value null No value. Useful for sets os Host operating system port A TCP/UDP port ports A container of ports set A set of properties. Sets can only contain null properties string Any string value uint16 An unsigned integer 16 bits long uint32 An unsigned integer 32 bits long xmldata Unparsed XML data The types entity, entity listed, xmldata, and user are not currently configurable by the user.
- Value
-
The initial value for the new property. This value can be edited using the Entity Properties Dialog Box.