WMI Query Template

The WMI Query Template enables Network Administrators and ISSMs to monitor results returned from Windows Management Instrumentation (WMI). This template is typically used by ISSMs that want to scan for DISA vulnerabilities and DoD STIG compliance.

For more information, see Windows Management Instrumentation.

In this Topic

• To Configure the WMI Query Template
• Options Configuration

To Configure the WMI Query Template

• From the Menu Bar, select File | New. The Create New Object View displays.
• From the Create New Object View, expand Templates | Windows Monitors then select Windows Management Instrumentation (WMI). The New Template Properties View displays.
• The Template Properties view contains 4 tabs.
  • General
  • Options Configuration
  • Agent Template
  • Actions

Options Configuration

• Use the Windows server or workstation drop-down to target a specific host while configuring this Template.

Select Host Drop-Down

• Use the Namespace path textbox to specify the target namespace, for example:

root\cimv2

• Use the Class textbox to specify the WMI Class to call, for example:

Win32_Service

• Use the Select textbox to specify the columns to return, for example:

DisplayName

• Use the Where textbox to specify WMI filter criteria, for example:

DisplayName LIKE '%Defender%' OR DisplayName LIKE '%mcafee%' OR DisplayName LIKE '%symantec%'

• Click the Refresh button to load available results.

WMI Query Monitor Template Properties for DISA Vulnerability ID V-253264

• Click Load Columns to execute the WMI Query then load all key value pairs returned.

WMI Query Column Definitions for DISA Vulnerability ID V-253264

• Use the Warning and Critical triggers controls to define trigger filter criteria and value thresholds.

WMI Query Must Contain Filter Criteria and Value Thresholds for DISA Vulnerability ID V-253264

Related Topics

Template Properties

Windows Monitor Templates