Obtaining properties via WMI (F-Secure)

1. Turn on the WMI Provider setting as follows:
   1. In the F-Secure Elements Endpoint Protection portal, go to Profiles > General Settings.
   2. Under Integrations, turn on WMI Provider.
   3. Select Save and Publish.
   4. Go to Devices and select your device.
   5. Select Assign profile > Assign.
2. Open Windows PowerShell with the administrator rights.
3. At the command prompt, enter commands as shown below to retrieve, for example, the following classes and properties.
   • • Requesting a listing of all singleton instances

   Get-WmiObject -Namespace root/fsecure -List | where { $_.Qualifiers[“Singleton”].Value }

   • • Retrieving product version

   $product = Get-WmiObject -Namespace “root/fsecure” -Class Product
   Write-Host Version: $product.Version

   Result:

   Version: 18.15

   • • Retrieving real-time scanning status

   $av = Get-WmiObject -Namespace “root/fsecure” -Class AntiVirus2
   Write-Host “Is real-time scanning enabled: ” $av.RealTimeScanningEnabled

   Result:

   Is real-time scanning enabled: True

   • • AvDefinitions

   $av = Get-WmiObject -Namespace “root/fsecure” -Class AntiVirus2
   $status = if ($av.AvDefinitionsAgeInHours -lt 7*24){
   “up to date” } else { “outdated” }
   Write-Host “AV definitions are” $status

   Result:

   Av definitions are up to date

   • • Firewall status

   $fw = Get-WmiObject -Namespace “root\fsecure” -Class Firewall
   Write-Host “Is firewall enabled: ” $fw.Enabled

   Result:

   Is firewall enabled: True

   • • Time of last policy connection to the F-Secure Elements Endpoint Protection portal

   $cm = Get-WmiObject -Namespace “root\fsecure” -Class CentralManagement2
   $status = if ($cm.LastConnectionTimeInHoursAgo -lt 24) { “OK” } else { “Connectivity issues” }
   Write-Host “PSB Portal connection status: ” $status

   Result:

   PSB Portal connection status: OK

   • • Time of last policy update from the F-Secure Elements Endpoint Protection portal

   $cm = Get-WmiObject -Namespace “root\fsecure” -Class CentralManagement
   Write-Host “PolicyUpdateTime: ” $cm.PolicyUpdateTime

   Result:

   PolicyUpdateTime: 20181001144235.000000+000

   • • DeepGuard status:

   $av = Get-WmiObject -Namespace “root\fsecure” -Class AntiVirus2
   Write-Host “Is DeepGuard enabled:” $av.DeepGuardEnabled

   Result:

   Is DeepGuard enabled: True

   • • Browsing protection status:

   $inet = Get-WmiObject -Namespace “root\fsecure” -Class Internet2
   Write-Host “Is Browsing Protection enabled:” $inet.BrowsingProtectionEnabled

   Result:

   Is Browsing Protection enabled: True

   • • Software Updater status (status of automatic installation of security updates, counts for missing updates split by type; critical, important, and other)

   $su = Get-WmiObject -Namespace “root\fsecure” -Class SoftwareUpdater
   Write-Host “Enabled: ” $su.Enabled
   Write-Host “InstallSecurityUpdatesAutomatically: ” $su.InstallSecurityUpdatesAutomatically
   Write-Host “MissingCriticalUpdatesCount: ” $su.MissingCriticalUpdatesCount
   Write-Host “MissingImportantUpdatesCount: ” $su.MissingImportantUpdatesCount
   Write-Host “MissingOtherUpdatesCount: ” $su.MissingOtherUpdatesCount

   Result:

   Enabled: True

   InstallSecurityUpdatesAutomatically : 0

   MissingCriticalUpdatesCount : 2

   MissingImportantUpdatesCount : 1

   MissingOtherUpdatesCount : 1

   • • subscription status:

   $license = Get-WmiObject -Namespace “root\fsecure” -Class LicenseStatus
   Write-Host “License status: ” $license.Valid “; End date: ” $license.EndDate

   Result:

   License status: True ; End date: 20191231235959.000000+000

   • • Last manual scan report information:

   $report = Get-WmiObject -Namespace “root\fsecure” -Class LastManualScanReport

   Write-Host “HarmfulItemsFound: ” $report.HarmfulItemsFound

   Result:HarmfulItemsFound: False

   • • Last scheduled scan report information:

   $report = Get-WmiObject -Namespace “root\fsecure” -Class LastScheduledScanReport

   Write-Host “HarmfulItemsFound: ” $report.HarmfulItemsFound

   Result:HarmfulItemsFound: True

Source : Official F-Secure Brand
Editor by : BEST Antivirus KBS Team