Unrecognized Installer Evidence Analysis Report

The Unrecognized Installer Evidence Analysis report retrieves all unrecognized installer evidences and returns prioritized mapping suggestions to existing applications or to be created applications in the Application Recognition Library (ARL).

Installer evidence is generally the most reliable way to recognize installed applications. In an ITAM environment, the number of unrecognized installer evidence can be in the thousands, either because the evidence has no interest (for example, drivers), the evidence is the result of renamed packages, or because the ARL is lacking signatures of applications worth being recognized.

Thanks to a matching logic that looks for “similar” evidence, this report can help you analyze unrecognized evidence, with the goal of linking retrieved evidence with commercial applications to be monitored by a license.

The report sets a priority for processing based on the fact that the “matched raw evidence” (“brother” evidence), is a “Managed vendor” (other signatures with the same raw publisher are linked to licensed applications).

From the report, you can open the installer evidence and do the following:

•

Ignore it if there is nothing of interest.

•

Modify it and link it to an existing application in the ARL.

•

Modify it and link it to a previously created application not in the ARL. Ensure to pay attention to the application version numbering and be consistent with already existing applications.

Tip:In order to prevent unrecognized evidence false positives, it is good practice to delete any raw evidences that may overlap with evidence you create or modify. For example, if you create or modify the following evidence: 'Application X Publisher Y', overlapping raw evidence, such as 'Application X.1 Publisher Y inc.' and 'Application X.2 Publisher Y incorporated' should be deleted.

Generating the Report

To generate the report, perform the following steps.

To generate an Unrecognized Installer Evidence Analysis report:

1.

Go to the Unrecognized Installer Evidence Analysis page (Reporting > Operations Reports > Unrecognized Installer Evidence Analysis). You can also access this report by going to the Saved Reports page (Reporting > Saved Reports & Views > Saved Reports), navigating to the SAM Operations folder, and clicking Unrecognized Installer Evidence Analysis.

2.

Click Run report.

Reading the Report

This report combines properties of:

•

Matched Raw Evidence Properties

•

To Be Assigned Application Properties

•

To Be Created Evidence Properties

•

Unrecognized Raw Evidence Properties

To clarify the report, the properties are grouped under headers that identify their underlying database object. Similarly, this list of properties is grouped first by the database object (alphabetically ordered), and then the related properties (also sorted alphabetically). Some of these columns are not displayed by default; however, you can make them visible by moving them out of the column chooser.

Matched Raw Evidence Properties

The following Matched Raw Evidence properties are displayed.

Property	Description
ARL publisher	The publisher of the ARL evidence linked to the matched raw evidence.
ARL version	The version of the ARL evidence linked to the matched raw evidence.
Assigned application	The application that the matched raw evidence recognizes.
Assigned application Classification	The application classification that the matched raw evidence recognizes.
Assigned application edition	The application edition that the matched raw evidence recognizes.
Assigned application License	The active license that monitors the application recognized by the matched evidence.
Assigned application normalization level	The normalization level of the matched application. Is calculated according to the pattern of the version number.
Assigned application version	The application version that the matched raw evidence recognizes.
Display name	The display name of the matched raw evidence that maps to the recognized application.
Publisher	The publisher of the matched raw evidence.
Version	The version of the matched raw evidence.

To Be Assigned Application Properties

The following To Be Assigned Application properties are displayed.

Property	Description
Name	The recommended application to be linked to evidence still to be created. Note: Use you judgement carefully on linking to an existing application or creating a new one.
Product	The recommended linked product.
Publisher	The recommended linked publisher.
New	This Yes/No flag that shows Yes if the version of the recommended linked application looks to be new. Given the complexity of versioning (commercial versus technical versions), it is recommended that this decision is to be made carefully.
Other recognized versions for recognized product	Other versions recognized for the matched application.
Other evidences already linked to recommended application	A list of other raw installer evidence already linked to the matched application.

To Be Created Evidence Properties

The following To Be Created Evidence properties are displayed.

Property	Description
Display name	The display name of the recommended evidence to be created that will make the raw evidence disappear from this report the following day.
Publisher	The publisher for the installer evidence to be created.
Version	The recommended version name for the installer evidence to be created.

Unrecognized Raw Evidence Properties

The following Unrecognized Raw Evidence properties are displayed.

Property	Description
Clean name	The clean name is the display name without version information. It is built on the unrecognized and recognized raw evidence. Note:A clean name with 3 letters or less is ignored by unrecognized evidence false positives.
Comment based on analysis	A summary of analysis and needed actions.
Display name	The display name of the unrecognized raw evidence that maps to the recognized application.
Evidence type	The type of the unrecognized raw evidence reported by the inventory source.
Inventory source	The inventory Source that has reported the unrecognized raw evidence.
Matches	The number of devices (from the same inventory source) that have exactly the same unrecognized installer evidence.
Priority	The priority (1, 2, 3 or 4) allows you to work in a phased approach: • Priority 1: the matched evidence is linked to a commercial and licensed application. A new application needs to be created (new version). • Priority 2: the matched evidence is linked to a commercial and licensed application. The evidence can be linked to an existing evidence. • Priority 3: matched evidence is linked to commercial application. • Priority 4: need to link to an non-commercial application.
Publisher	The publisher of the unrecognized raw evidence.
Publisher is licensed	This flag is set to Yes if another installer evidence with the same raw publisher name is currently mapped to an application linked to a license. Filtering this column allows you to focus on the “in scope of licensing activities” installer evidence.
Version	The version of the unrecognized raw evidence.