ThinkShield Firmware Assurance (TSFA) is a tool based on UDC that, once installed on a device, retrieves security event logs from the device's embedded controller and uploads them to the cloud. These logs can then be viewed on a cloud portal UI. The agent typically retrieves logs at startup and every hour at a random time. If the device lacks an embedded controller, the agent cannot retrieve logs but will report to the TSFA cloud that the embedded controller is not detected, meaning TSFA features cannot be leveraged.
Key features of the TSFA agent UI include:
Log Presentation: Displays collected logs from the past month, including timestamps and event details.
Security Health Summary: Summarizes the device's security health based on recent component measurements and event logs, presenting it as the Security Posture Status on TSFA device statuses.
Refresh Button: Updates the table with the latest logs present in the database without running new component measurements.
UI Adjustments: The UI cannot be made full screen but can be resized using the icon in the lower right corner, minimized, or closed.
License Agreement Link: Opens the Lenovo website.
Open-Source Licenses Link: Opens a text file containing the third-party software for ThinkShield Firmware Assurance.
TSFA Agent CLI
Along with the Agent app itself, there is a TSFA CLI (ThinkShield Firmware Assurance Command Line Interface). The CLI tool serves a similar function to the Agent UI by gathering logs from the embedded controller (EC) and displaying them with timestamps.
The TSFA CLI supports the following commands: