Agent Client Collector- Check command denied by Agent allow list

[daware-madhu103]

Hello all,

I am encountering an issue with the Agent Client Collector and the "Get running services" flow action. We are receiving the error "check command denied by the agent allow list. Context: Asset allow list empty, using agent config file allow list. Found exec, but no matching arguments."
The commend is showing in the flow is "select * from services order by service_type"

I tried to update allowlist by creating a check definition and then clicking 'Generate allow-list content'  but did not worked

When I am clicking 'Test Check' related link It shows below error -

Can anyone please guide me to update allow list for correct query format?

[Rafael Batistot]

Hi @daware-madhu103 

this article might help you 

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0815247#mcetoc_1fqdaehph99

[Thomas Buecker]

Hi,
did you find a solution?
I'm running in a similar issue and even as it should work as osquery is in the check allow list. It didn't.

[Edxavier Robert]

Hi @daware-madhu103  , 

@Thomas Buecker 

From ServiceNow you can go to Agent -> Check Definitions -> in the Related Links click on Generate allow-list content. This will give you a full list: 

The following generated content may be used for the check command allow-list of Agent Client Collector (ACC) 

[
  {  
    "args":[    
      "self-test --format=json"
    ],
    "exec":"acc",
    "skip_arguments":false
  },
  {  
    "args":[    
      ""
    ],
    "exec":"application_metrics.rb",
    "skip_arguments":true
  },
  {  
    "args":[    
      ""
    ],
    "exec":"browser_extension.rb",
    "skip_arguments":true
  },
  {  
    "args":[    
      ""
    ],
    "exec":"browser_extension_device_init.rb",
    "skip_arguments":true
  },
  {  
    "args":[    
      ""
    ],
    "exec":"browser_extension_init.rb",
    "skip_arguments":true
  },
  {  
    "args":[    
      ""
    ],
    "exec":"Cancel",
    "skip_arguments":false
  },
  {  
    "args":[    
      "--compact --select=data_collection,enhanced_inventory,file_systems,network_adapters,tcp_connections,storage_devices,running_processes,local_users,intel_ema,memory_modules",
      "--compact --select=installed_software",
      "--compact --select=installed_software_with_sam_metering",
      "--compact --select=oracle_glas_hw_discovery\n",
      "--compact --select=oracle_glas_hw_discovery\n        "
    ],
    "exec":"endpoint_discovery.rb",
    "skip_arguments":false
  },
  {  
    "args":[    
      ""
    ],
    "exec":"files.rb",
    "skip_arguments":true
  },
  {  
    "args":[    
      ""
    ],
    "exec":"files_background.rb",
    "skip_arguments":false
  },
  {  
    "args":[    
      ""
    ],
    "exec":"osqueryi",
    "skip_arguments":true
  },
  {  
    "args":[    
      ""
    ],
    "exec":"read-file.rb",
    "skip_arguments":true
  },
  {  
    "args":[    
      "agent"
    ],
    "exec":"Restart",
    "skip_arguments":false
  },
  {  
    "args":[    
      ""
    ],
    "exec":"runUpgrade.rb",
    "skip_arguments":false
  },
  {  
    "args":[    
      ""
    ],
    "exec":"sam_processor.rb",
    "skip_arguments":false
  },
  {  
    "args":[    
      ""
    ],
    "exec":"sam_processor_without_osqueryd.rb",
    "skip_arguments":false
  },
  {  
    "args":[    
      ""
    ],
    "exec":"system_command",
    "skip_arguments":false
  },
  {  
    "args":[    
      ""
    ],
    "exec":"tls_ssl_certs.rb",
    "skip_arguments":false
  }
]