IBM Bigfix Tutorial

IBM’s security division offers a range of enterprise security products and services. The company monitors 35 billion security events per day in more than 130 countries. IBM acquired BigFix in 2010.

This tutorial provides all the information you will need to properly classify the software in your environment and to prepare your first audit report. All steps and functions have been limited to the minimum of necessity to save your time and to guide you through the easiest path. The main assumption is to use the list of part numbers for your software to improve automatic bundling, and help you complete software classification to generate a relevant audit report.

Prerequisites

• Installation: You have installed the BigFix platform, the clients, and License Metric Tool.
• Configuration: You have scheduled the software and capacity scans, and configured VM managers. 

Assumptions

• Basic scenario without complicated customizations.
• Basic users with up to approximately 5000 computers.
• The goal is to focus on subcapacity products, and generate a relevant audit snapshot.
• The tutorial provides a simple, fixed path. After you finish it, you can further explore the possibilities of and introduce any customizations you want.

Product Description

IBM BigFix is a collaborative endpoint management and security platform for IT Infrastructure and security professionals. It provides real-time endpoint data from a single tool that can re-image remote devices, distribute and patch software, discover and inventory new assets, assess application usage, and monitor and enforce compliance policies across many types of devices using multiple versions of Windows, Mac and Unix/Linux (*nix) operating systems and applications. It is offered as an independent patch management solution as well as being part of an endpoint management and security platform.

“BigFix can achieve 99% first-pass success rates with patching and remediation efforts, which rapidly reduces the attack surface,” said Teresa Worth, Global Product Marketing Manager, IBM Endpoint Security (BigFix). “In addition, it can find and remove unauthorized downloads which may contain malware, and keep anti-virus and other critical software applications running and current.”

Markets and Use Cases

BigFix is used by thousands of organizations of all sizes on more than 100 million endpoints worldwide.

Applicable Metrics

BigFix continuously collects thousands of attributes from endpoints and sends them to a single management server. First query results are returned within 15 seconds, with full query on 120,000 nodes returned within 5 minutes. Each query is updated every 15 seconds for up to 10 minutes. BigFix supports a catalogue of more than 8,000 software vendors and 40,000 titles across 100+ current and prior versions of Windows, Mac and variations of Unix operating systems.

Intelligence

BigFix has an intelligent agent that forces decision making and calculations to be performed at the endpoint rather than at a higher level in the network. This results in lower network bandwidth consumption, a smaller server footprint, and faster time to deploy, configure and remediate endpoints. BigFix is integrated with IBM Resilient to perform deep dive analysis on suspect endpoints. Endpoint data is displayed in IBM QRadar SIEM console, so security teams can prioritize incidents to remediate quickly.

Method of Delivery

BigFix is an on-premises solution.

Agents

BigFix has an agent that forces decision making and calculations to be performed at the endpoint rather than at a higher level in the network. This results in less network bandwidth consumption, smaller server footprint (less powerful/less expensive server requirements) and faster time to deploy, configure and remediate endpoints.

Pricing

• BigFix Patch – Starts at $2.49 per client device per year
• BigFix Inventory – Starts at $14.95 per client device per year
• BigFix Lifecycle – Starts at $43.80 per client device per year
• BigFix Compliance – Starts at $43.80 per client device per year

INSTALLATION

Before you start the installation, review information about hardware and software requirements and other considerations to ensure that the installation completes successfully.

• License Metric Tool infrastructure
  A complete deployment of License Metric Tool consists of the License Metric Tool server and its database, the BigFix server and its database, and a BigFix console. Additionally, a BigFix client must be installed on every computer from which you want to collect software inventory data. Depending on the environment size, you can install all components on a single computer, or distribute them among multiple computers.
• BigFix requirements
  The three major components of BigFix that you must install are server, console, and clients. The application also requires a database that stores all the data retrieved from the clients.
• Supported operating systems
  Ensure that computers on which you want to install License Metric Tool components run on supported operating systems and hypervisors and that they have the prerequisite software installed.
• Software requirements
  Ensure that all prerequisite software is installed on the computers in your infrastructure.
• Hardware requirements
  During setup, match your optimum deployment size to your hardware specifications. Use the recommendations as a general guidance.
• Network and port requirements
  When planning the infrastructure, ensure that port numbers used by License Metric Tool, BigFix, and the database are free to enable communication between those components.
• Firewall exceptions
  Some of the fixlets require files and updates from external fixlet sites that are downloaded over the Internet. To ensure that they can be automatically downloaded by the BigFix server, relevant web addresses must be accessible from the computer where the server is installed. Add those addresses as firewall exceptions and ensure that they are accessible to the proxy server if you are using it.
• Proxy exceptions
  If the BigFix server uses a proxy for Internet connection to access fixlet sites or prefetch downloads, the License Metric Tool server must be added to an exception list to ensure that the catalog propagation works properly.
• Installation accounts
  You can install all the infrastructure components as the administrative user. You can also install some components as a non-administrative user but some limitations apply.
• Coexistence scenarios
  This topic describes supported scenarios for the coexistence of BigFix Inventory and License Metric Tool.

Steps

1. 1. Import part numbers
   Part numbers significantly increase the accuracy of automated bundling, the process that associates the discovered components with products from the software catalog. They will also help you to identify products that are important for your license agreement, and on which you need to focus while preparing for an audit with IBM.
2. 2. Classify software
   After you imported the part numbers, you can focus on the software components that are included in your license agreement, and for which you are responsible. Verify the assignments and confirm them, or further reassign the components if needed. Your goal is to bundle and confirm all components.
3. 3. Verify sub capacity values and generate the snapshot
   After you classify the software, verify how PVU and RVU MAPC consumption that you would like to maintain relates to the actual consumption. For products for which the consumption is above or far below your expectation, ensure that the values were not distorted, for example by failing scans or false-positive software discovery. Finally, generate the audit snapshot and store it in case of an audit.

Lesson 1:Creating computer groups in the BigFix console

Procedure

1. 1. Log in to the BigFix console.
2. 2. Create a computer group that contains all computers that are located in the first IBM sub capacity region: North and South America.
   1. 1. In the top navigation bar, click Tools > Create New Automatic Computer Group.
   2. 2. Provide the name of the computer group.
      For example, the Americas.
   3. 3. Select the site and domain in which you want to create the computer group.
   4. 4. Specify criteria that must be met by the computers that belong to this group.
      For example, add all computers whose DNS name contains .us.

1. 5. To save the group, click Create.
2. 3. Create computer groups for the remaining IBM sub capacity regions in which you have computers.
3. 4. For every computer group, schedule scans and uploads of scan results.
4. For more informatio

Enroll in IBM BigFix Training with Industry Standard Syllabus

• Instructor-led Sessions
• Real-life Case Studies
• Assignments

Explore Curriculum

Results

You created computer groups in the BigFix console. To generate audit snapshots for a subset of computers, create analogical computer groups in the License Metric Tool.

Lesson 2: Creating computer groups that define the scope of reports

Procedure

1. 1. Log in to the License Metric Tool.
2. 2. Create a computer group that contains all computers that are in the first IBM sub capacity region: North and South America.
   1. 1. In the top navigation bar, click Management > Computer Groups.
   2. 2. To create a computer group, click New.
   3. 3. Provide the name of the computer group.
      For example, the Americas.
   4. 4. Optional: Provide a description of the computer group.
   5. 5. Specify criteria that must be met by the computers that belong to this group.
      To reuse the computer group that you created in the BigFix console, select Data Source Groups, in set, and select the proper BigFix computer group. In this case, select Americas.

1. 6. From the Type section, select Reporting.
2. 7. Select Enable license usage calculations to calculate utilization in this computer group.
3. 8. Specify the number of days for which the data is to be calculated.
   This number defines the default period for which the data that is show on the All Metrics report is calculated and up-to-date.

1. For example, when you set the value to 30 days, and then display a report for the last 90 days, the report shows the following data:
   • If you display the report for a newly created computer group, the report shows values for the last 30 days and is empty for the rest of the period.
   • If you display the report for an existing group, the values might be outdated.
2. 9. In both cases, recalculate the data.
3. 10. To save the group, click Create.
4. 3. Create computer groups for the remaining IBM sub capacity regions in which you have computers.
5. 4. Optional: If you do not need a collective snapshot for all computers, but separate audit snapshots for each computer group, open the All Computers group, and clear PVU and RVU MAPC. Then, click Save.
6. 5. Important
7. 6. Perform this step if you are creating computer groups to report PVU usage for IBM software that is installed in multiple IBM sub capacity regions. If you choose to calculate sub capacity data for the All Computers group, see: IBM sub capacity regions to understand what is the difference between reports generated for each region separately and the report generated for the All Computers group.
8. Do not perform this step if you are creating computer groups to manage software that is installed in multiple business units. When you do not calculate sub capacity data for the All Computers group, you will not be able to generate audit snapshots for the entire environment.
9. 7. To make the computer groups available in the License Metric Tool, wait for the scheduled import or run it manually.
10. 8. Optional: If software in each computer group is managed by a separate person, create dedicated users, each with access to one computer group.

Results

You created computer groups for which you can manage software and generate audit snapshots and dedicated users who can access these groups.

Lesson 3: Managing software and generating audit snapshots per computer group

Procedure

1. 1. Log in to the License Metric Tool.

• If software in all computer groups is managed by one person, log in as the user that has access to all computer groups, for example the Administrator.
• If software in each group is managed by a different person, log in as the user with access only to the computer group that represents the first IBM sub capacity region.

2. If you have a file with part numbers related to the software that is installed in this region, upload the file.

• Click Reports > Computer Groups.
• Select the computer group for which you want to upload the part numbers. In this case, select Americas.
• In the upper left corner, select Products & Metrics.

• Click Import Part Numbers, browse for the file with part numbers, and click Import.

1. 3. To bundle the software, click Reports > Software Classification. The panel contains software from all computer groups to which the user that you used to log in has access. Assign each component to a product, exclude, or suppress the instances that should not be included in the metric calculation, and confirm your actions. For more information.
2. 4. When you finish bundling the software, generate the audit snapshot for this region.
   • If you logged in as a user with access to multiple computer groups, open the Computer Groups report, and click the computer group that represents the first IBM sub capacity region. Then, in the upper left corner, select All Metrics or PVU Subcapacity.

• The report that opens contains information only about software that is installed on the computers in North and South America. Click Audit Snapshot. Provide a comment to the generated snapshot and upload any related files. Then, click Generate.
• If you logged in as a user with access only to the computer group that represents the first IBM sub capacity region, open the All Metrics or PVU Subcapacity report, and click Audit Snapshot. Provide a comment to the generated snapshot and upload any related files. Then, click Generate

Results

You generated the audit snapshot with information about PVU consumption in the first IBM sub capacity region: North and South America.

On December 6th, 2018, India based HCL Technologies announced its plans to purchase a large part of IBM’s software portfolio. Included in this $1.8 billion acquisition is an array of products, including core components of IBM BigFix. Changes as a result of this deal won’t be finalized until mid-2019, but this acquisition leaves IBM customers wondering, “how will this affect me?” Although only time can tell, here is our high-level assessment of the acquisition and what to expect.

What is the strategy behind this acquisition?

Why would IBM give up a portion of its portfolio? Although we don’t have a ton of details on this deal yet, we do know why IBM has decided to sell a bundle of 7 assets. IBM is seeking to trim its older and outdated assets to provide room to focus on hybrid cloud computing. “For IBM, the divestiture of this part of its software business is a way for the company to better prioritize its investments in more emerging, high-value segments of the IT industry,” said John Kelly, IBM senior vice president of cognitive solutions and research, in a statement.

For HCL, this deal is about growth and expansion. “About three years ago, we started looking at our growth strategy and how to move away from the labor-intensive software business to provide more value to our clients,” said Darren Oberst, corporate vice president and head of the products and platforms business of HCL. “This represents a fundamentally new direction for us. We’re moving into working with software with some of the largest companies in the world. We want to create a set of solutions that very few companies in the world can deliver.”

So, what will BigFix support be like?

If you have received support for BigFix in the last year, chances are that you have already experienced what support from HCL will be like. “HCL has had support and development responsibility for these products since Dec 2017 as part of the IP partnership, with the majority of the team remaining the same, under the same senior leadership.”

After the deal closes, “HCL will take end-to-end responsibility for all aspects of the business associated with these products, including existing customer contracts, new product sales, marketing, strategy, product development, and support.”