Configuring the discovered software rule

The Discovered Software rule provides a signature-based software discovery mechanism for Windows and UNIX managed servers to help you audit and snapshot applications and software that are not managed by SA.

The Discovered Software rule can:

  • Discover unregistered software that is not currently managed by SA.
  • Create an inventory of software that is not installed as part of an OS-registered application or that was custom built.
  • Give you the ability to create snapshots of the discovered software on a server and then periodically audit against the snapshots.
  • Enable you to track in-house or custom-built software.

To configure the discovered software rule:

  1. Create a new audit using one of the methods in Creating an audit . (If you want to create this rule for a snapshot specification, see Creating a snapshot specification .)
  2. Select an Audit Source: Server, Snapshot, Snapshot Specification, or No Source.
  3. In the Audit window, from the Views pane, select Rules > Discovered Software.
  4. In the content pane of the Audit window, in the Available for Audit section expand the Software icon.

    This may take a few moments to load if this is the first time you are loading the rule and you have selected a source for the audit or snapshot.
  5. Select an element from the list and then click the right arrow button to move the rule object into the Selected for Audit section, which enables you to create a rule for the element.
  6. For each check you want to configure in the rule, in the lower section of the Audit window you can select one of the following rule criteria types:
    • Property Values: A values-based check that checks individual properties of the target object. For this type of check, each object requires that you build an expression that defines properties related to the object using the drop down lists at the bottom of the rule window. You can specify a unique operator which, depending on the type of object, can be a String, a Number (integer or float), Boolean (comparing values of ‘true’ and ‘false’), Date (a date compare, not a time of day compare), or an Array.
    • Equivalent to source: A comparison check that performs a one to one comparison between the object on the source vs. the target servers. In this type of check, the values of each property selected from both the source and target servers must match exactly for the object to be compliant.
    • Non-existence: A rule that checks for the non-existence of an object to determine if it exists on the target server. If the object exists on the target server, the user or group rule is out of compliance. Note that, at runtime, the source server, if any, is not queried.  Also, if a Wildcard rule object is selected, it will only apply to the target server.
  7. You can also configure the rule based on a wildcard search by selecting the Wildcard rule object . When you select this object, in the rule configuration section at the bottom of the window displays a Name field, into which you can type a name (primary key) that will be searched on the target server.

    For example, you could enter simply * which would match everything on the target, P* would match all objects that begin with a capital P, while *P would match all elements ending with uppercase character 'P'.

    After you enter a name or wildcard string, you can configure the rule parameters as you did in step 6.

    It is important to notice that when using wildcard, all matching objects are restricted by the rule configuration. This type of audit rule is considered compliant if all found objects match the rule parameters.
  8. To finish configuring the audit, set the target servers, any rule exceptions, the schedule, and the notification for the audit.
  9. To save the audit, from the File menu, select Save. You can also save the Audit as a policy, which enables other users to access the rule set you create in the audit. For more information, see Saving an audit or a snapshot specification as an audit policy.
  10. To run the audit, from the Actions menu, select Run Audit.

For more information about running an audit, see Running an audit .