InTrust 11.6 - Customization Kit

Emulated Standard Objects

For custom scripted data sources and custom text log data sources, InTrust provides a number of special objects. These objects are look-alikes of standard WSH objects and can be accessed by the scripts that the data sources are based on.

Note that these objects can be used only for InTrust gathering and real-time monitoring purposes. They do not exist outside the scope of InTrust operations.

• FileSystemObject

• Folder

• File

• TextStream

• ShellObject

• ScriptExecObject

• RegKey

• SystemInformationObject

• TimeOfDayInfoObject

• ActiveXObject

Example

The following script displays a list of files and subfolders in the C:\Temp folder. Then it opens a text file and types it line by line.

Note that print() is a sfunction from the rule object model. It is not available outside the scope of rules.

try
{
    var FS = new FileSystemObject();
    var folders = FS.GetFolder("c:\\temp\\").SubFolders;
    print("> dir c:\\temp\n");
    for (var i=0; i<folders.length; ++i){
        print("["+folders[i].Name+"]\n");
    }
    var files = FS.GetFolder("c:\\temp").Files;
    for (var i=0; i<files.length; ++i){
        print(files[i].Name+"\n");
    }
    print("---------\n");
    var f = FS.OpenTextFile("example.txt",
                FileSystemObject.AccessMode.ForReading,
                FileSystemObject.CreationDisposition.OpenExisting, "Auto");
    var i = 1;
    while (! f.AtEndOfStream ) {
        s = f.ReadLine();
        print(i + "] " + s + "\n");
        ++i;
    }
}
catch (err)
{
    print("Error: " + err + "\n");
}

ActiveXObject

This class lets you use COM automation in scripts. It has the same functionality as the comparable class in Windows Script Host.

You can create ActiveX objects as follows:

// Method 1:
var p = new ActiveXObject("{CB3DF937-8DBB-4130-8A11-D47E12F61315}");
// Here, the argument is the CLSID
// of the object you want to create.
//Method 2:
var p = new ActiveXObject("Scripting.FileSystemObject");
// ProgID is the argument.

After you have created the object, you can access its methods, read and write its properties.

In case of error, an exception is generated, represented by an ActiveXError object. This object class contains the following fields:

• number
  Error code

• text
  Message that corresponds to the error code

• description
  An optional description of the error

In the following example, possible exceptions are caught:

try
{
var p = new ActiveXObject("SomeCOMObject.ProgID");
p.method();
}
catch( err )
{
      print( "Error: " + err );
}

File

FileSystemObject

Use "MBCS", "UTF-8", "UTF-16LE" or "UTF-16BE" only if you know for certain what file encoding is used. Otherwise, use "UTF-16" (platform specific) or "Auto". This is the default, which uses the byte order mask (BOM) to detect file encoding.

The following table shows how the encoding is determined from the BOM and explicitly specified format parameter.

*In the table "p. s." stands for platform-specific byte order.