Unrecognized Installer Evidence Analysis Report
The Unrecognized Installer Evidence Analysis report retrieves all unrecognized installer evidences and returns prioritized mapping suggestions to existing applications or to be created applications in the Application Recognition Library (ARL).
Installer evidence is generally the most reliable way to recognize installed applications. In an ITAM environment, the number of unrecognized installer evidence can be in the thousands, either because the evidence has no interest (for example, drivers), the evidence is the result of renamed packages, or because the ARL is lacking signatures of applications worth being recognized.
Thanks to a matching logic that looks for “similar” evidence, this report can help you analyze unrecognized evidence, with the goal of linking retrieved evidence with commercial applications to be monitored by a license.
The report sets a priority for processing based on the fact that the “matched raw evidence” (“brother” evidence), is a “Managed vendor” (other signatures with the same raw publisher are linked to licensed applications).
From the report, you can open the installer evidence and do the following:
-
Ignore it if there is nothing of interest.
-
Modify it and link it to an existing application in the ARL.
-
Modify it and link it to a previously created application not in the ARL. Ensure to pay attention to the application version numbering and be consistent with already existing applications.
In order to prevent unrecognized evidence false positives, it is good practice to delete any raw evidences that may overlap with evidence you create or modify. For example, if you create or modify the following evidence: 'Application X Publisher Y', overlapping raw evidence, such as 'Application X.1 Publisher Y inc.' and 'Application X.2 Publisher Y incorporated' should be deleted.
Generating the Report
To generate the report, perform the following steps.
To generate an Unrecognized Installer Evidence Analysis report:
- Go to the Unrecognized Installer Evidence Analysis page (Reporting > Operations Reports > Unrecognized Installer Evidence Analysis). You can also access this report by going to the Saved Reports page (Reporting > Saved Reports & Views > Saved Reports), navigating to the SAM Operations folder, and clicking Unrecognized Installer Evidence Analysis.
- Click Run report.
Reading the Report
This report combines properties of:
To clarify the report, the properties are grouped under headers that identify their underlying database object. Similarly, this list of properties is grouped first by the database object (alphabetically ordered), and then the related properties (also sorted alphabetically). Some of these columns are not displayed by default; however, you can make them visible by moving them out of the column chooser.
Matched Raw Evidence Properties
The following Matched Raw Evidence properties are displayed.
| Property | Description |
|---|---|
| ARL publisher | The publisher of the ARL evidence linked to the matched raw evidence. |
| ARL version | The version of the ARL evidence linked to the matched raw evidence. |
| Assigned application | The application that the matched raw evidence recognizes. |
| Assigned application Classification | The application classification that the matched raw evidence recognizes. |
| Assigned application edition | The application edition that the matched raw evidence recognizes. |
| Assigned application License | The active license that monitors the application recognized by the matched evidence. |
| Assigned application normalization level | The normalization level of the matched application. Is calculated according to the pattern of the version number. |
| Assigned application version | The application version that the matched raw evidence recognizes. |
| Display name | The display name of the matched raw evidence that maps to the recognized application. |
| Publisher | The publisher of the matched raw evidence. |
| Version | The version of the matched raw evidence. |
To Be Assigned Application Properties
The following To Be Assigned Application properties are displayed.
| Property | Description |
|---|---|
| Name | The recommended application to be linked to evidence still to be created. Note: Use you judgement carefully on linking to an existing application or creating a new one. |
| Product | The recommended linked product. |
| Publisher | The recommended linked publisher. |
| New | This Yes/No flag that shows Yes if the version of the recommended linked application looks to be new. Given the complexity of versioning (commercial versus technical versions), it is recommended that this decision is to be made carefully. |
| Other recognized versions for recognized product | Other versions recognized for the matched application. |
| Other evidences already linked to recommended application | A list of other raw installer evidence already linked to the matched application. |
To Be Created Evidence Properties
The following To Be Created Evidence properties are displayed.
| Property | Description |
|---|---|
| Display name | The display name of the recommended evidence to be created that will make the raw evidence disappear from this report the following day. |
| Publisher | The publisher for the installer evidence to be created. |
| Version | The recommended version name for the installer evidence to be created. |
Unrecognized Raw Evidence Properties
The following Unrecognized Raw Evidence properties are displayed.
| Property | Description |
|---|---|
| Clean name | The clean name is the display name without version information. It is built on the unrecognized and recognized raw evidence. A clean name with 3 letters or less is ignored by unrecognized evidence false positives. |
| Comment based on analysis | A summary of analysis and needed actions. |
| Display name | The display name of the unrecognized raw evidence that maps to the recognized application. |
| Evidence type | The type of the unrecognized raw evidence reported by the inventory source. |
| Inventory source | The inventory Source that has reported the unrecognized raw evidence. |
| Matches | The number of devices (from the same inventory source) that have exactly the same unrecognized installer evidence. |
| Priority | The priority (1, 2, 3 or 4) allows you to work in a phased approach: Priority 1: the matched evidence is linked to a commercial and licensed application. A new application needs to be created (new version). Priority 2: the matched evidence is linked to a commercial and licensed application. The evidence can be linked to an existing evidence. Priority 3: matched evidence is linked to commercial application. Priority 4: need to link to an non-commercial application. |
| Publisher | The publisher of the unrecognized raw evidence. |
| Publisher is licensed | This flag is set to Yes if another installer evidence with the same raw publisher name is currently mapped to an application linked to a license. Filtering this column allows you to focus on the “in scope of licensing activities” installer evidence. |
| Version | The version of the unrecognized raw evidence. |