Evidence Tab: Access Evidence
Access evidence information is
collected in a separate file (.swacc
) as a part of the
discovery and inventory process. This evidence identifies access to a
particular server application such as Microsoft SharePoint Server. When
linked to an application, the access evidence records any access to the
linked server application. In addition to the accessed application, an
access evidence record also records accessing user and accessing device.
Access evidence is collected through various services including User Access
Logging (UAL) and PowerShell scripts for some products.
- Examine details of the linked evidence: Select an item from the list of linked evidence, and click Open. Alternatively, use Ctrl-click (or your browser's alternative) on the hyperlinked evidence name to open the evidence properties in a new browser tab.
- Add more evidence: Optionally type some of the evidence name in the search field, and click Search. A list of matching evidence is displayed. Select the appropriate item from the search results (check that it is not already Assigned to a different application), and click Add evidence.
- Remove added evidence: You can only remove evidence that was previously linked within your enterprise (either the application source is shown as Local , or it is Flexera (Extended) and the Added evidence column displays Yes). Select this item, and click Remove to remove the link between the evidence and the application record (the evidence still exists within your computing estate).
The following table shows the columns (listed alphabetically) available in the evidence list. Some are displayed by default, and others are available in the column chooser (see Managing Columns in a Table).
Column name | Details |
---|---|
Added evidence |
This column displays Yes if an operator manually linked the evidence with the application. No displays if the evidence is unchanged, as provided through Application Recognition Library. This value is updated automatically when you link the evidence to the
application.
Note: To disassociate the evidence record added by an operator from
the application, select it, and click Remove. You cannot
remove evidence records stored in Application Recognition Library (the ones with
No displayed in the Added
evidence column).
|
Assigned |
Displays Yes when the evidence is matched to at least one application, and otherwise displays No. This assignment may have been done automatically through the Application Recognition Library rules, or manually by the operator. Not editable. |
Edition |
The edition of an application, as specified by the publisher of this
application.
Note: Many applications do not specify an edition.
Visible on the General tab of the application properties. It is editable only for applications with a Source value of Local. |
Ignored |
Displays Yes when the access evidence is ignored for application recognition purposes, and No when the access evidence may be used for application recognition. Ignored evidence remains linked to the application so that it does not clutter the list of unrecognized evidence. Can be edited by choosing from the Ignored options (on the General tab of the evidence properties). |
Matches |
Indicates the total number of times that this access evidence record was
matched by the most recent inventory import. For example, If two different instances of
Microsoft SQL Server (on different servers) were accessed (by one or more users through one
or more devices ) for 10 and 5 times each, and the access evidence in the imported inventory
matches this record, this field will display 15.
Note: A figure
displayed in the Matches column may not reflect the actual number
of access attempts. These figures may be different for the following reasons:
|
Name |
The name of the access evidence record, derived from (and often identical
to) the name of the application being accessed. Access evidence found in incoming inventory
that matches this evidence record count as access to the linked application.
Tip: Clicking the hyperlink on the Name value opens
the properties for that piece of access evidence. In those properties, selecting the
Devices tab lists all the inventory devices where that access
evidence has been reported in inventory.
Not editable. |
Overlapping evidence |
The Overlapping evidence column indicates whether the evidence assigned to an application has also been added to another application (if so, Yes is displayed). It can be due to an identical piece of evidence linked to both applications, or the use of wildcard characters (%) that results in the overlap. If so, the application recognition process produces confusing and unpredictable results. For example, all applications linked to the overlapping evidence are reported as installed on each computer where the evidence is found. If Yes is displayed in the Overlapping evidence column, you can manage this status in several ways:
Tip: If there is a special reason a local application record to overlaps
with the ARL one, you might consider sharing this information with Flexera. The overlapping record in Application Recognition Library might be
updated to meet your requirements, and thus eliminate overlaps in the future.
|
Publisher |
The name of the publisher of the accessed server application, as reported by the access evidence. |
Source |
Displays the origin of the access evidence, for
example:
|
Version |
The version of the accessed server application as reported by the access evidence. |
IT Asset Management (Cloud)
Current