Manual pattern execution

Patterns are generally triggered by specific events or changes that occur during a discovery run. Sometimes you might want to run a pattern outside a discovery run (for example, you might be developing patterns against already scanned hosts). To do this you can run a pattern against the nodes contained in a Group.

When you run a pattern manually, it is not the same as triggering it as a result of scanning. Discovery calls may be made from the pattern, but it does not undertake full discovery. If you have changed your discovery credentials or configuration, you should rescan before running patterns manually.

To select hosts or other nodes

You can select hosts or other nodes by adding them to a group.
From a view node (including host) page, select Groups from the Actions list and add the node to a group. Or, from a report or other search result, select the required items. Then, select Groups from the Actions list and add the nodes to a group.

Node types against which patterns can be run

You should add nodes to your group of the kind that the pattern triggers on (for example, if the pattern triggers on a DiscoveredProcess, then you should add DiscoveredProcess nodes). However, the system is able to expand host nodes in an intelligent fashion such that it is possible, for example, to simply add a host even though the pattern requires a DiscoveredProcess.

The following table defines the complete set of traversals used to expand from host nodes to other node kinds. Where more than one traversal is shown, the traversal steps are followed one after the other.

To run a pattern

1. From the Discovery tab, click Pattern Management.
2. Click the Package containing the pattern you want to run from the package list.
3. Click the Pattern Modules link.
4. Select the Pattern Module containing the pattern that you want to run.

5. From this page you can edit the pattern source or configuration if necessary. Editing the pattern is described in Pattern configuration and editing.

    Click this link to continue this procedure after editing the pattern.

   After the pattern is edited, the Pattern Management: Browse Packages page displays.

   1. Select the Package containing the pattern you want to run from the package list.
   2. Click the Pattern Modules link.
   3. Click the Pattern Package link.
6. Click the Pattern link in the heading table.
7. From the Actions list, select Run Pattern.

8. Select the Group that you want to run the pattern against using the Run against Group list. Then choose the settings for the pattern run. Set Expand, Execution Logging, and Additional Discovery. The settings are described in the following table.

   Field	Description
   Run against Group	Provides the list to select the group to run the pattern against. If you do not have any Working Sets then the check box for showing only Working Sets will be disabled. If you do have at least one working set then clearing this check box enables you to choose Groups that are not in your working set. The text beneath shows the number of nodes in the group that are the correct node kind to match the pattern's trigger. If the group contains a host node, select the Expand check box to check the host for additional nodes that match the pattern's trigger. For example, the ApacheBasedWebserver pattern triggers on DiscoveredProcess nodes. If the group contains one DiscoveredProcess node and one host node (containing, 162 DiscoveredProcess nodes) this field shows 1 Discovered Process node if Expand is not checked and 163 Discovered Process nodes (including 162 via 1 Host node) if it is checked.
   Execution Logging	Select the logging level for this pattern run. This is one of Debug, Info, Warning, Error, or Critical.
   Additional Discovery	Choose whether discovery commands that perform additional discovery should perform live discovery of the host. For example, the runCommand method performs additional discovery by calling remote commands from patterns. • Do not get extra data: Use any existing data that is available on the appliance. • Get data as needed: Use any existing data that is available on the appliance. If additional data is required, perform discovery on the target to obtain it. Get data as needed will only make a request if that request has not been made before. • Get all new discovery data: Always perform a new discovery. Do not use any previously discovered data.

   
   While the pattern is running, the results page is displayed.