Creating signatures from scanned file data

You can use File Evidence to expand your custom catalog. You can add signatures for software products that are installed in your infrastructure but are not present in the HCL catalog. You identify the file name, or another item of information that can be used to identify the software and add the signature.

Before you begin

Notice: Scanned File Data renamed to File Evidence and moved under Software section (placed after Application Evidence)

An icon representing a user. You must have the View Endpoints and Manage Catalogs permissions to perform this task.

Procedure

  1. Log in to BigFix Inventory.
  2. In the left navigation bar, click Software > File Evidence.
  3. To filter the report data, hover over the Manage Report View icon Manage Report View icon, and click Configure View. Then, specify the appropriate filtering options.
    1. Optional: Select the Recognized checkbox to add these two columns to the view of scan data.
      Note: To find a file or a package that can be used as a signature, filter the report to the data from the computer on which the particular software product is installed. To further narrow down the results, specify the whole or part of the path to the directory where the software is installed. Then, look at the following columns.
      • Recognized - the column shows whether the package data and/or file was recognized as part of an existing signature.
      • Removed since 10.0.4: Caused Detection - the column shows whether the file contained enough information to cause detection of the related software. The Caused Detection column is removed since BigFix Inventory version 10.0.4. You must re-create your saved reports in case you had used the Caused Detection column.
      If the value in both columns is No, the file is not used for software detection and you can use it to create a new software signature.
  4. Optional: In the File Path column, look for the location where the missing software title is installed.
  5. Click the arrow on the right from the File Name that you want to use as a signature, and click Classify.

    Image that shows how to locate a file name in the File Evidence report.
  6. In the Create Catalog Entry window, provide the publisher name, product name, and release number. Further select the component that is found.

    9.2.11 Starting from application update 9.2.11, the File Evidence report provides full versions of discovered files. However, best practices of creating software signatures recommend that file version that is specified in the signature is limited to the release number, for example, 9.0. When you specify a more detailed version of the file such as 9.0.7, the signature does not detect all patches or mod-releases of the software component. When you create a signature from the File Evidence, the pre-filled version of the file is limited to the release number according to the best practices.

    10.0.9To create a template signature with auto-detectable version of the file, you may choose the File Template Signature type and copy data from the Package or File Signatures tab to the template type. For more information, see Creating signatures.


    Create Catalog Entry window.
  7. To save the catalog entry, click Submit.
    Important: If you create an entry that exists in the software catalog, an information message is displayed, and both signatures are saved in the catalog.
  8. To make the signatures available for software detection, click Reports > Import Now, or wait for a scheduled import.

Results

You added a software signature to your custom catalog, and it can now be used to detect software or its usage. When you create signatures from File Evidence, the custom content version of the software catalog remains the same, because the signatures are matched on the server side, and no new catalog needs to be created.

You can view the audit trail of the changes on the Catalog Audit report.

What to do next

You can edit the details of the signature and delete a custom catalog entry on the Catalog Customization panel.