Intel AMT Features > System Defense > Use Cases > Get the Heuristic Statistics (Including Current State)
CollapseAll image

Get the Heuristic Statistics (Including Current State)

 Note:

Heuristic settings are NOT supported by wireless interfaces.  Therefore, this feature is not available on LAN-less platforms.

This feature was deprecated in Release 10.0 and removed in Release 12.0.

The following steps describe how to get the Heuristic System Defense statistics of an Intel AMT system.

1.  Create a reference to the instance of CIM_EthernetPort, where the “DeviceID” key equals “Intel(r) AMT Ethernet Port 0”.

2.  Use the created reference as a selector to enumerate CIM_ElementStatisticalData.

3.  Examine the list returned by the Enumerate method and search for instances where the value of the Stats property is AMT_HeuristicPacketFilterStatistics.

Perform the following steps for each of the instances you find.

4.  Invoke AMT_HeuristicPacketFilterStatistics.Get using the EPR stored in the Stats property of CIM_ElementStatisticalData.

Click here for a snippet demonstrating this step

You can execute this snippet by inserting it into the execution template found here.

  

# Create a reference to the CIM_EthernetPort instance.

$ethernetPortRef =$wsmanConnectionObject.NewReference("SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port 0'")

$elementStatisticalDataRef =$wsmanConnectionObject.NewReference("CIM_ElementStatisticalData")

$elementStatisticalDataRef.AddSelector("ManagedElement",$ethernetPortRef)

# Traverse to the CIM_ElementStatisticalData instances that are connected to the CIM_EthernetPort instance.

foreach($elementStatisticalDataItem in$elementStatisticalDataRef.Enumerate("http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter",$null))

{

    # For each instance, check if it is associated to the AMT_HeuristicsPacketFilterStatiistics instance.

if($elementStatisticalDataItem.Object.GetProperty("Stats").IsA("AMT_HeuristicPacketFilterStatistics"))

    {

          # Get the AMT_HeuristicPacketFilterStatistics object using its EPR.

          $heuristicPacketFilterStatisticsRef =$elementStatisticalDataItem.Object.GetProperty("Stats").Ref

          $heuristicPacketFilterStatisticsInstance =$heuristicPacketFilterStatisticsRef.Get()

          break

    }

}

 

 

Instance Diagram

Classes Used in This Flow

   AMT_HeuristicPacketFilterStatistics

   CIM_ElementStatisticalData

   CIM_EthernetPort

SDK Sample

If there is a sample demonstrating this flow, it is included in the SDK installation file. See SDK Installation Layout for details.

 

See Also:

   Network Isolation

   System Defense Policies

   Heuristic Policies

   System Defense Filter Types

   Processing Network Packets with System Defense

   Networking Packet Structures

Copyright © 2006-2022, Intel Corporation. All rights reserved.