This is what I use :

#!/bin/sh

#

############################################################################

#

# Extension Attribute checks to display FireEye HX installed version number.

# 

#

############################################################################

FireEyeVersion=`/usr/bin/defaults read /Library/FireEye/xagt/xagt.app/Contents/Info CFBundleVersion`

echo "<result> $FireEyeVersion </result>"



exit 0

I combined @Mhomar info and the logic that Jamf uses for their Patch Reporting EAs to come up with this:

#!/bin/bash



##############################################################################

# A script to collect the version of FireEye currently installed. #

# If FireEye is not installed then "Not Installed" is the result#

##############################################################################

RESULT="Not Installed"



if [ -f "/Library/FireEye/xagt/xagt.app/Contents/Info.plist" ] ; then

    RESULT=$( defaults read /Library/FireEye/xagt/xagt.app/Contents/Info CFBundleVersion )

fi



echo "<result>$RESULT</result>"

This is exactly what I'm looking for, thank you! Took a while to populate the EA data once implemented but it is slowly but surely capturing the version information.

Thank you, works like a charm!