Database Query Scan Exclusions

Hello shawn_38,

what's the motivation for this? Exclusions are static, so I assume you want to check whether they still are as they should be. The settings are per-policy, not stored in a central place and while it's not impossible to extract them it's not simple (and then there's the question which groups/computers the policy applies to).

If you want to detect changes in the policies I'd suggest to upgrade to 5.2 which provides auditing.

Christian

Hi,

How about something like the following code.

1. Save as something.vbs

2. Edit the variables at the top:

strServerName       
strInstanceName
strDatabaseName

as required for you install.

Code:

const ForWriting = 2

strServerName       = "databaseservername"
strInstanceName     = "sophos"
strDatabaseName     = "Sophos50"
strConnectionString = "Driver={SQL Server};Server="&strServerName&"\"&strInstanceName&";Database="&strDatabaseName&";Trusted_Connection=yes;"

strSQL = "SELECT p.name, p.policyxml.query(' " &_
     " declare namespace SAV=""http://www.sophos.com/EE/EESavConfiguration""; " &_
     "   (/SAV:config/SAV:onAccessScan/SAV:exclusions/SAV:filePathSet/SAV:filePath) " &_
     "  ') as Exclusion " &_
" FROM policies as p with (nolock) " &_
" where p.type = 2 "

set cn = CreateObject("ADODB.Connection")
cn.open strConnectionString

Set rs = CreateObject("ADODB.Recordset")
rs.Open strSQL , cn, adOpenDynamic

' Write file to disk
set fso = CreateObject("Scripting.FileSystemObject")

' Loop for each record
Do Until rs.EOF

   strPolicyName = rs("Name")
   strXMLOfPolicy = rs("Exclusion") 

   if strXMLOfPolicy <> "" then
     CreateFile strPolicyName, strXMLOfPolicy
   end if
   
  
  rs.movenext
Loop

'cleanup
set cn = nothing
set rs = nothing

Function  CreateFile (strName, strXML)
 

 on error resume next

 
 
      set file = fso.OpenTextFile(strName & "-Exclusions.txt", ForWriting, True)
      arr1 = split (strXML, "<SAV:filePath xmlns:SAV=""http://www.sophos.com/EE/EESavConfiguration"">")
      for a = 0 to ubound (arr1)
          if arr1(a) <> "" then
             file.writeline replace(arr1(a), "</SAV:filePath>", "")
          end if
       next
       
       file.close
       
       set file = nothing

   
End function

Regards,

Jak

@Christian:

I know that exclusions are static, also we have just one policy which is assigned to all computers.

But we had an audit and now we have to document e.g. servers with no antivirus software installed and the on-access scan exclusions.

@jak

The script works perfectly.

Thanks a lot.

Hello shawn_38,

we have to document ... the on-access scan exclusions

I see. Now I don't assume you neither have to prove that what you periodically export is what is actually in effect nor that you do it automated. You are aware that you can simply export (manually) the exclusions from the policy edit window?

Christian 

Hi Christian,

of course I know how to export the exclusions manually from the policy edit window.

I've automated the export and import it daily in our Wiki.

We haven't finished the rollout yet and I assume there will be lots of changes in near future.

With the automated export we have always the current exclusions in our Wiki and not everybody who may have to check these exclusions has access to the Enterprise Console.

Hello shawn_38,

sounds like you intend to have more than a few exclusions. Generally you should try to avoid them if possible. Apart from the (slightly) increased risk they might apply to other components (e.g. DLP). So you should only use them when necessary and safe. Just curious - could you give an example what you are excluding?

Christian