HCL BigFix

HCL BigFix is a unified endpoint management and security platform that provides comprehensive visibility, patching, compliance, and configuration management capabilities across enterprise IT infrastructure. BigFix enables organizations to manage and secure endpoints including servers, workstations, laptops, mobile devices, and virtual machines across Windows, Linux, macOS, Unix, and other operating systems.

Category	Device management
Direction	Query source
Sign-in	Username and Password
Query languages	STIX, SQLite
Tables	8
Website	http://hcl-software.com

Before you start

Huntbase signs in to HCL BigFix with Username and Password. Create the credential in HCL BigFix first, then keep it to hand for the Connect step.

1. In the BigFix Console, create a dedicated console operator for Huntbase, or pick an existing one.
2. In the operator definition, or in one of its assigned roles, set Can use REST API and Custom Content to Yes.
3. Make sure the Web Reports service is running on the BigFix server.

Permissions:

• Can use REST API
• Custom Content

Watch out for

• Only turn on Skip TLS Verification for test servers with self-signed certificates.

For the vendor's own instructions, see BigFix REST API prerequisites.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect HCL BigFix

1. Go to Connections and click New connection, or click New connection on the HCL BigFix product page.
2. On Product, pick HCL BigFix and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings

Where your HCL BigFix lives:

Field	Required	Notes
Server Address	Yes	Specify the IP address or hostname of the data source.
Port	Yes	The BigFix server port. It defaults to 52311. Defaults to 443.
Self-Signed Cert (PEM)	No	Provide a self-signed or CA-signed certificate to securely communicate with the data source.
Server Name	Yes	The hostname or IP address of your BigFix server, such as bigfix.example.com.
Max Retries	No	Defaults to 3.
Min Retry Delay (ms)	No	Defaults to 100.
Ignore Error Messages	No
Skip TLS Verification	No
Request Timeout (seconds)	No	Defaults to 120.

Credentials

The only Method is Username and Password. Enter a Credential label (for example Production), then fill in:

Field	Required	Notes
Username	Yes	Username with access to the search API. Secret — not shown again after you save it.
Password	Yes	Password of the user with access to the search API. Secret — not shown again after you save it.

Query it

Once connected, HCL BigFix can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
STIX	STIX patterns for indicator sweeps, translated into the product's native search.
SQLite	SQL over the 8 tables listed below, alongside every other connected source.

Tables

HCL BigFix adds 8 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 8 tables

Table	Contains
bigfix_action	BigFix Action contains automated remediation actions with scripts, relevance expressions, success criteria, and deployment settings for endpoint management.
bigfix_analysis	BigFix Analysis contains custom queries and reporting tools with relevance expressions for endpoint assessment and compliance monitoring.
bigfix_computer	BigFix Computer contains endpoint inventory data including system specifications, network information, OS details, hardware configuration, and reporting status for managed computers.
bigfix_fixlet	BigFix Fixlet contains security patches, software updates, and configuration changes with metadata, relevance expressions, and categories for deployment.
bigfix_property	BigFix Property contains custom and system defined properties and attributes with definitions and reservation status for extending BigFix functionality and data collection.
bigfix_role	BigFix Role contains user permissions and access control configurations with role definitions and privilege settings for security management.
bigfix_site	BigFix Site contains content repositories and organizational structures with configurations, permissions, and subscription settings for content management.
bigfix_task	BigFix Task contains multi-step deployment workflows and complex remediation procedures with coordinated fixlets and actions for sophisticated deployments.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog