Creating Instructions and Fragments Using TIMS

Tachyon provides many Instructions and Product Packs full of Instructions that can be executed out of the box from Tachyon. However, the value of Tachyon is its extendibility. Quite often, use cases will arise for different questions and actions that need to be performed on your client estate. This would require new instructions to be created. Tachyon provides a toolset to create your own instructions from scratch. These instructions can be created using either the native language used by the Tachyon client, or by deploying PS scripts. In this lab, we will create some instructions from scratch and use them in Tachyon. We will also use TIMS to create a fragment that we will import for use in Guaranteed State.

Configuring TIMS prerequisites

Tachyon Instruction Management Studio or TIMS is a utility that allows you to write your own instructions for consumption by Tachyon. In this exercise, we will configure TIMS prerequisites so we can begin writing our own instructions.

Enrolling a code signing certificate on the Tachyon server

Tachyon requires a code signing certificate to sign instructions with. This ensures that any instructions written for execution via Tachyon are signed, and no rogue instructions are introduced to the environment. The Code Signing certificate is also associated with the Tachyon license key to ensure that only those with the appropriate certificate are allowed to write instructions that can be used in Tachyon.

Validate the certificate

Enrolling the Code Signing certificate on a workstation

TIMS can be run on any machine in your environment. The instructions you develop will use the framework of the machine you are running TIMS on to validate the instruction. As such, we will run TIMS on one of the workstations. Wherever TIMS is run, the same Code Signing certificate must be enrolled in either the User or Computer store, generally in both.

Installing TIMS

In this exercise, we will install TIMS on a workstation, and use that workstation to write instructions.

Navigating TIMS

Now that we have prereqs in place and TIMS installed, we can begin working with TIMS. In this exercise, we will learn some basics about TIMS and begin exploring the native language, SCALE (Simple Cross-platform Agent Language for Extensibility), in the form of Modules and Methods used to write instructions.

SELECT "hello"

SELECT "hello" AS greeting;

SELECT "hello" greeting;

SELECT "goodbye" greeting;

Network.getconnections();

Network.GetConnections();

Software.GetInstallations(); 
Device.GetSummary(); 
FileSystem.GetFilesInFolder(Folder: "c:\\program files\\1E\\client"); 
OperatingSystem.GetServiceInfo(); 
OperatingSystem.GetInstalledUpdates();

Creating a basic Instruction

Clear the TIMS query window and run the following Network.GetConnections(); Click on the Schema button on the top ribbon. On the popup, click Yes In the Schema editor, click the different boxes. Here you can define the different parameters of the schema The GetConnections method has a predefined schema. We can define that value in the schema itself manually. The render as property allows for 3 rendering schemas currently, perforated, IPAddress, or currency. This allows for the results to be shown rendered as one of these data types Click on ProcessName and using the  button, move it to the top Click OK to save the schema Click on Workflow. Note the different options available for Instruction Workflow in the dropdown. Click Cancel The workflow is defined as a global setting, but we can override that by explicitly defining a workflow per instruction. Certain Instructions might be low risk, and thus not require approval or 2FA. Click Task groups Tasks allow us to add instructions to specific task groups so they can be executed directly from the Tasks workspace in the Tachyon explorer console. Click Cancel to exit out of Task Groups Click on the Aggregation button on the ribbon Here, we can group by a specific value that is returned, as well as aggregate based on the available operations. Click Cancel Click Validate in the top ribbon. Note the errors displayed. Click Close A readable payload must be defined, and a description for the Instruction provided so it can be searched against in the Tachyon explorer console. A payload is essentially what the Instruction will present to the operator via the explorer console. A task group is not required; hence it is only a warning. In the Instruction Definition panel at the top right, note the different properties In the Description field, input Active Network Connections and click Enter You can click on the ellipses in the field to open up a dialog box as well. For the Name field, change the value from the default to 1ETRN-ActiveNetworkConnections For the ReadablePayload field, click on the ellipses at the right and input Active Network Connections. Click OK Review the other properties in the Instruction Definition pane. These are all configurable parameters, but if left alone they will default to the values of the installation Click Validate in the top ribbon. Note only a task groups warning is shown. Click Close From the menu bar, click File>Save As. Click OK on the validation page Save the Instruction under c:\tools as 1ETRN-ActiveNetworkConnections.xml Note in the top pane a message is displayed stating that the instruction definition was signed by XXX. This is because we chose to Always Sign earlier. Leave TIMS open with the instruction still defined in the top pane

Validating the Instruction

Uploading the instruction in Tachyon

In this task, we will add the newly created Instruction to Tachyon and ask the question to our clients.

Running the newly created Instruction

Creating a Product Pack with multiple Instructions

Now that we have navigated around the TIMS utility, we will create a Product Pack that will contain multiple instructions. In a production environment, you often will have multiple instructions that logically bind together. You can add those instructions individually to Tachyon, or you can bundle them up and add them together. In this exercise, we will create two instructions, a question and an action, and add them to Tachyon to validate their functionality.

Create a Question Instruction

In this task, we will create a query that identifies what the ConfigMgr assigned Site code is for our clients.

NativeServices.RunWmiQuery(Namespace:"root\\ccm", Query:"SELECT name from sms_authority");

What is the SCCM Site code?

Creating an Action Instruction using a script

In this task, we will create an action Instruction that changes the CM site code on the Tachyon clients. We will accomplish this via the use of a PowerShell script. In Tachyon, we have the ability to use the native language Modules and Methods, or a PS script.

Scripting.Run( Language: "PowerShell", ExecutionPolicy : "Override", Script : @resource1, InterpretAsJson : False , "%SCCMSite%");

Creating and Uploading the Product Pack

Now that we have two instructions, a question and an action, we are ready to upload them to Tachyon as a Product Pack.

Validating the Instructions

Now that we've created Instructions and added them to Tachyon, we are ready to validate that the instructions execute exactly what we defined within them and output the appropriate information when run.

Creating a Fragment for Guaranteed State

Now that we have learned how to create an instruction and a product pack using TIMS. We will now use TIMS to create a simple test fragment for use in Guaranteed State. The fragments that we create and import into Tachyon contain the items that we can use in our rules to evaluate device state and remediate. Fragments must have a specific schema defined. They must have at least 1 column Passed (case sensitive) and can have an optional column named Data to display some data from the device. In this scenario, we need to determine if certain files are present on our devices. Many times, a malware outbreak can be identified by looking for specific files. First, we will create a fragment that will check to see if a file is on the device. We will add a parameter that will allow our rule to supply the name of the file to search for, so that our Rule will test for any files that our Admin chooses. We will then modify the schema of our fragment so that it contains what is required for Guaranteed State to use the fragment. Once we have the fragment written we will import it into Guaranteed State and create a policy that will check our devices and view our results.

Creating the Fragment

@a = FileSystem.FindFileByName(FileName:"myfile.txt", Fast:true);

IF (@a)

SELECT 0 as Passed, "MyFile.txt exists" as Data;

SELECT 1 as Passed, "MyFile.txt does not exist" as Data;

Viewing the Contents of an Integrated Product Pack

Before we make our own Integrated Product Pack to import into Guaranteed State, we will look at the format and contents of one of the default Integrated Product Packs

Creating the Product Pack

In order to import our Fragment into Tachyon we need to create a Product Pack. The product pack contains the objects needed for use by Tachyon and a manifest file. We will then import our Product Pack into Guaranteed State.

Importing into Guaranteed State

Now that we have created our Product Pack, we will import that into Guaranteed State using the Product Pack Deployment Tool

Creating the Rule

Now that we have our Product Pack imported, we will create our rule that will use that fragment

Creating the Policy

Now that we have our Rule created, we need to create a policy that we will assign and deploy that will contain the rule we just created.

Assign and Deploy the Policy

View the Results

Lab Summary

In this lab, we learned how to create instructions using TIMS. We started with a simple example, using the native language to query for active network connections. Then we created a question Instruction to query for the SCCM Site code of the client machines. Lastly, we created an action Instruction which allowed us to change the site code of the SCCM client to a value inputted by the operator. In doing so, we used a script rather than native language to execute the action. We also created a simple fragment in TIMS to extend Guaranteed State. We created a Product Pack and imported this into Guaranteed State. We then manually created a rule using this fragment and a policy to assign and deploy to our devices to determine the state of our environment. If you want to learn more about how to use TIMS to create even more complex Instructions and Fragments take our Extending Tachyon course.