From d789d728101e92a239ae1c5f186857cf90d4e2dd Mon Sep 17 00:00:00 2001
From: jgstew <james@jgstew.com>
Date: Mon, 30 Jul 2018 10:53:01 -0700
Subject: [PATCH] Update TPM - Windows.bes

Should this be max TPM version, instead of Min TPM version, which is what tuple string item 0 would give?
---
 Analyses/TPM - Windows.bes | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Analyses/TPM - Windows.bes b/Analyses/TPM - Windows.bes
index 6b3d565..3262c1d 100644
--- a/Analyses/TPM - Windows.bes	
+++ b/Analyses/TPM - Windows.bes	
@@ -13,6 +13,6 @@
 		<Property Name="TPM - Activated in OS - Windows" ID="2" EvaluationPeriod="P1D">if (exists wmi "root\CIMV2\Security\MicrosoftTpm" and exists selects "* from Win32_Tpm" of wmi "root\CIMV2\Security\MicrosoftTpm") then (if (boolean value of select "IsActivated_InitialValue from Win32_Tpm" of wmi "root\CIMV2\Security\MicrosoftTpm" = true) then "Activated" ELSE "Not Activated") else ERROR "TPM not visible to OS"</Property>
 		<Property Name="TPM - Owned in OS - Windows" ID="3" EvaluationPeriod="P1D">if (exists wmi "root\CIMV2\Security\MicrosoftTpm" and exists selects "* from Win32_Tpm" of wmi "root\CIMV2\Security\MicrosoftTpm") then (if (boolean value of select "IsActivated_InitialValue from Win32_Tpm" of wmi "root\CIMV2\Security\MicrosoftTpm" = true) then "Owned" ELSE "Not Owned") else ERROR "TPM not visible to OS"</Property>
 		<Property Name="TPM - Visible to OS - Windows" ID="4" EvaluationPeriod="P1D">exists selects "* from Win32_Tpm" of wmi "root\CIMV2\Security\MicrosoftTpm"</Property>
-		<Property Name="TPM - Version - Windows" ID="5" EvaluationPeriod="P1D">tuple string item 0 of string value of selects "SpecVersion from Win32_Tpm" of wmis "root\CIMv2\Security\MicrosoftTpm"</Property>
+		<Property Name="TPM - Version - Windows" ID="5" EvaluationPeriod="P1D">maxima of (it as version) of tuple string items of string values of selects "SpecVersion from Win32_Tpm" of wmis "root\CIMV2\Security\MicrosoftTpm"</Property>
 	</Analysis>
 </BES>