Evidence Tab: Access Evidence

Access evidence information is collected in a separate file (.swacc) as a part of the discovery and inventory process. This evidence identifies access to a particular server application such as Microsoft SharePoint Server. When linked to an application, the access evidence records any access to the linked server application. In addition to the accessed application, an access evidence record also records accessing user and accessing device. Access evidence is collected through various services including User Access Logging (UAL) and PowerShell scripts for some products.

Available Actions

This list shows the access evidence associated with the application. For access evidence, the following actions are available:

Evidence Tab: Access Evidence Actions

Action

Description

Examine details of the linked evidence

Select an item from the list of linked evidence, and click Open. Alternatively, use Ctrl-click (or your browser's alternative) on the hyperlinked evidence name to open the evidence properties in a new browser tab.

Add more evidence

Optionally type some of the evidence name in the search field, and click Search. A list of matching evidence is displayed. Select the appropriate item from the search results (check that it is not already Assigned to a different application), and click Add evidence.

Remove added evidence

You can only remove evidence that was previously linked within your enterprise (either the application source is shown as Local, or it is Flexera (Extended) and the Added evidence column displays Yes). Select this item, and click Remove to remove the link between the evidence and the application record (the evidence still exists within your computing estate).

Evidence Tab: Access Evidence Properties

The following table shows the columns (listed alphabetically) available in the evidence list. Some are displayed by default, and others are available in the column chooser (see Managing Columns in a Table).

Evidence Tab: Access Evidence Properties

Column Name

Description

Added evidence

This column displays Yes if an operator manually linked the evidence with the application. No displays if the evidence is unchanged, as provided through Application Recognition Library.

This value is updated automatically when you link the evidence to the application.

Note:To disassociate the evidence record added by an operator from the application, select it, and click Remove. You cannot remove evidence records stored in Application Recognition Library (the ones with No displayed in the Added evidence column).

Assigned

Displays Yes when the evidence is matched to at least one application, and otherwise displays No. This assignment may have been done automatically through the Application Recognition Library rules, or manually by the operator.

Not editable.

Edition

The edition of an application, as specified by the publisher of this application.

Note:Many applications do not specify an edition.

Visible on the General tab of the application properties. It is editable only for applications with a Source value of Local.

Ignored

Displays Yes when the access evidence is ignored for application recognition purposes, and No when the access evidence may be used for application recognition. Ignored evidence remains linked to the application so that it does not clutter the list of unrecognized evidence.

Can be edited by choosing from the Ignored options (on the General tab of the evidence properties).

Matches

Indicates the total number of times that this access evidence record was matched by the most recent inventory import. For example, If two different instances of Microsoft SQL Server (on different servers) were accessed (by one or more users through one or more devices ) for 10 and 5 times each, and the access evidence in the imported inventory matches this record, this field will display 15.

Note:A figure displayed in the Matches column may not reflect the actual number of access attempts. These figures may be different for the following reasons:

• Multiple items within the same inventory can match one evidence rule. For example, if the version in a rule is generalized as "1.%", then the evidence for releases 1.0, 1.1, and 1.2 all count as separate evidence matches; but they may all resolve to the same accessed server application.
• While some inventory tools count duplicate computer records as having separate instances of evidence, IT Asset Management automatically merges duplicate records, and so will only count the application once.

Name

The name of the access evidence record, derived from (and often identical to) the name of the application being accessed. Access evidence found in incoming inventory that matches this evidence record count as access to the linked application.

Tip:Clicking the hyperlink on the Name value opens the properties for that piece of access evidence. In those properties, selecting the Devices tab lists all the inventory devices where that access evidence has been reported in inventory.

Not editable.

Overlapping evidence

The Overlapping evidence column indicates whether the evidence assigned to an application has also been added to another application (if so, Yes is displayed). It can be due to an identical piece of evidence linked to both applications, or the use of wildcard characters (%) that results in the overlap. If so, the application recognition process produces confusing and unpredictable results. For example, all applications linked to the overlapping evidence are reported as installed on each computer where the evidence is found.

If Yes is displayed in the Overlapping evidence column, you can manage this status in several ways:

• If the evidence was incorrectly associated with this application, select the overlapping evidence record, and click Remove.
• Delete one of the applications (for example, if you identified a locally created application that duplicates an Application Recognition Library entry).
• Open the evidence record, and edit the fields that contain wildcard characters (%) which might cause the overlap (for example, the Publisher, Version, or Name field).

Tip:You cannot remove an evidence record if No is displayed in its Added evidence column and Flexera in its Source column.

Important:Before deleting an application, it is best practice to check for any links to licenses, suite membership, or locally added evidence of different kinds. You must transfer all links from the application you are deleting to the one you will continue to track and manage. Links to the licenses are critically important for compliance calculations: open each license linked to the discarded application, and add that license to the correct one.

Tip:If there is a special reason a local application record to overlaps with the ARL one, you might consider sharing this information with Flexera. The overlapping record in Application Recognition Library might be updated to meet your requirements, and thus eliminate overlaps in the future.

Publisher

The name of the publisher of the accessed server application, as reported by the access evidence.

Source

Displays the origin of the access evidence, for example:

• Flexera—If the access evidence is included in Application Recognition Library (if this is the case, you cannot edit it)
• Flexera (Extended)—If the access evidence identified in Application Recognition Library has been linked to a different application by an operator
• Local—If an operator in your enterprise created the evidence for this application.

Version

The version of the installed application, as reported by the evidence.