Unrecognized Installer Evidence Analysis Report

IT Asset Management 2024 R1.4 (Cloud)

The Unrecognized Installer Evidence Analysis report retrieves all unrecognized installer evidences and returns prioritized mapping suggestions to existing applications or to be created applications in the Application Recognition Library (ARL).

Installer evidence is generally the most reliable way to recognize installed applications. In an ITAM environment, the number of unrecognized installer evidence can be in the thousands, either because the evidence has no interest (for example, drivers), the evidence is the result of renamed packages, or because the ARL is lacking signatures of applications worth being recognized.

Thanks to a matching logic that looks for “similar” evidence, this report can help you analyse unrecognized evidence, with the goal of linking retrieved evidence with commercial applications to be monitored by a license.

The report sets a priority for processing based on the fact that the “matched raw evidence” (“brother” evidence), is a “Managed vendor” (other signatures with the same raw publisher are linked to licensed applications).

From the report, you can open the installer evidence and do the following:

Ignore it if there is nothing of interest.
Modify it and link it to an existing application in the ARL.
Modify it and link it to a previously created application not in the ARL. Ensure to pay attention to the application version numbering and be consistent with already existing applications.

Tip: In order to prevent unrecognized evidence false positives, it is good practice to delete any raw evidences that may overlap with evidence you create or modify. For example, if you create (or modify) the following evidence: '

Application X Publisher
                    Y'.

Overlapping raw evidence, such as '

Application X.1 Publisher
                        Y inc.

' and '

Application
                        X.2 Publisher Y
                    incorporated.

' should be deleted.

Generating the report

Go to the Unrecognized Installer Evidence Analysis page (Reporting > Operations Reports > Unrecognized Installer Evidence Analysis). You can also access this report by going to the Saved Reports page (Reporting > Saved Reports & Views > Saved Reports), navigating to the "SAM Operations" folder, and clicking Unrecognized Installer Evidence Analysis.
Click Run report.

Reading the report

Columns in the report are grouped under the following headers that identify their underlying database object:

Matched raw evidence
To be created evidence
To be assigned application
Unrecognized raw evidence.

The following table lists all the columns that are available in the report. Some of these columns are optional and are not displayed by default; however, you can make them visible by moving them out of the column chooser.

Column name	Description
Matched raw evidence
ARL publisher (Optional)	The publisher of the ARL evidence linked to the matched raw evidence.
ARL version (Optional)	The version of the ARL evidence linked to the matched raw evidence.
Assigned application	The application that the matched raw evidence recognizes.
Assigned application Classification	The application classification that the matched raw evidence recognizes.
Assigned application edition (Optional)	The application edition that the matched raw evidence recognizes.
Assigned application License	The active license that monitors the application recognized by the matched evidence.
Assigned application normalisation level (Optional)	The normalization level of the matched application. Is calculated according to the pattern of the version number.
Assigned application version (Optional)	The application version that the matched raw evidence recognizes.
Display name	The display name of the matched raw evidence that maps to the recognized application.
Publisher	The publisher of the matched raw evidence.
Version	The version of the matched raw evidence.
To be assigned application
Name	The recommended application to be linked to evidence still to be created. Note: Use you judgement carefully on linking to an existing application or creating a new one.
Product (Optional)	The recommended linked product.
Publisher (Optional)	The recommended linked publisher.
New	This Yes / No flag that shows Yes if the version of the recommended linked application looks to be new. Given the complexity of versioning (commercial versus technical versions), it is recommended that this decision is to be made carefully.
Other recognized versions for recognized product	Other versions recognized for the matched application.
Other evidences already linked to recommended application (Optional)	A list of other raw installer evidence already linked to the matched application.
To be created evidence
Display name	The display name of the recommended evidence to be created that will make the raw evidence disappear from this report the following day.
Publisher (Optional)	The publisher for the installer evidence to be created.
Version	The recommended version name for the installer evidence to be created.
Unrecognized raw evidence
Clean name	The clean name is the display name without version information. It is built on the unrecognized and recognized raw evidence. Note: a clean name with 3 letters or less is ignored by unrecognized evidence false positives.
Comment based on analysis	A summary of analysis and needed actions.
Display name	The display name of the unrecognized raw evidence that maps to the recognized application.
Evidence type	The type of the unrecognized raw evidence reported by the inventory source.
Inventory source	The inventory Source that has reported the unrecognized raw evidence.
Matches	The number of devices (from the same inventory source) that have exactly the same unrecognized installer evidence.
Priority	The priority (1, 2, 3 or 4) allows you to work in a phased approach: Priority 1: the matched evidence is linked to a commercial and licensed application. A new application needs to be created (new version). Priority 2: the matched evidence is linked to a commercial and licensed application. The evidence can be linked to an existing evidence. Priority 3: matched evidence is linked to commercial application. Priority 4: need to link to an non-commercial application.
Publisher	The publisher of the unrecognized raw evidence.
Publisher is licensed	This flag is set to Yes if another installer evidence with the same raw publisher name is currently mapped to an application linked to a license. Filtering this column allows you to focus on the “in scope of licensing activities” installer evidence.
Version	The version of the unrecognized raw evidence.

IT Asset Management (Cloud)

Current