Signature Repository

Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Application Signatures uses a repository of signatures stored in a configuration file called applicationsSignature.xml. This XML file contains a number of Application-Component elements, each describing a signature for specific application or flavor of application. For example, the signature for Microsoft IIS Web server may look as follows:

Microsoft IIS Web server signature

<Application-Component name="Microsoft IIS WebServer" ci_type="iis" category="Web Server" 
     vendor="microsoft_corp" installedSoftwareName="\s*IIS\s+.*" supported_versions="5.1, 6.0, 7.0">
          <process name="inetinfo.exe" ports="all,None" cmdline="" 
          description="Microsoft Internet Information Service process." />     
          <process name="w3wp.exe" ports="None" cmdline="" 
          description="Microsoft Internet Information Service worker process." /> 
</Application-Component>