Teaching an Unidentified Application

1. Open Analysis Workbench and select the Application Teaching mode from the Quick Config dialog box.
2. Load the scan file with the application in question.
3. If you already know the main directory where the unidentified application resides, tag a directory and skip the next three steps.
4. Sort files by the Status column, so that <Unknowns> and <Checkvers> are near the beginning of the list.
5. Looking through the list of Unknown files try to find files that belong to the unidentified application that needs to be taught.

Sometimes you can search for clues in the Version Data columns in the Details windows on the left side and in the Directory Window. In many cases the directory name can be very descriptive.

6. If you have now identified the directory, set a Global tag for the directory.
7. Set a directory filter in the Files window. You will now see only the files belonging to that specific directory.
8. Check whether all the files in the Files Windows belong to the application. Set Global tags for these files.

1. In the Tag menu of the File window select Add to SAI. The New Publisher/Application/Version Setup dialog box is displayed.
2. Now choose the appropriate Publisher, Application, Release, Version, Operating system and language details.
3. Select a publisher from the Publisher drop-down list, or specify a new one by clicking the New button next to the field. This will display a New Publisher dialog box.
4. Fill in the Publisher Name (the Description field is optional) and click the OK button.

The new application publisher will now appear in the Publisher drop-down list.

5. After a publisher has been selected or a new one created, the Application field becomes enabled. Select an application from the Application drop-down list box or specify a new one by clicking the New button next to the field. This will display the New Application dialog box.
6. Fill in the Application name (the Description field is optional) and click the OK button.

The new application now appears in the Application drop-down list.

7. If you have created a new publisher or application, the Application Type field becomes enabled (otherwise the field automatically preselects a type for the application). From the Application Type drop-down list box, select a predefined type for the application.
8. Select a Release from the Release Label drop-down list, or specify a new one by clicking the New button next to the field. This will display a New Release dialog box.
9. Fill in the Release Name and click the OK button.

When a publisher releases updates for an existing version of one of their products, they typically don't change the name of that version. Any particular version of a product could have several updates to it. In this scenario, the umbrella version is referred to as the Release Label, or simply as Release. It is not necessary that every version of software has a release label. In fact, most of them do not. Every version without a release label is associated to a virtual Stand-alone Releases label.

10. Select a software version identifier from the Version Identifier drop-down list box, or specify a new one by clicking the New button next to the field. The New Version dialog box is displayed.
11. Fill in the Version Name field.
12. In the Description field, type in a brief description of the application selected for the existing Version. This field is optional.
13. Select the checkbox next to the install strings that apply. Install strings are added to the list in Control Panel > Add/Remove programs (prior to Windows Vista) or Control Panel > Programs and Features (Windows Vista and above) when a program gets installed. The list of install strings is taken from the scan data loaded into Analysis Workbench. The install string match will be done during software application recognition if all of the selected install strings are available in the scan file.
14. Click the OK button. The new version data now appears in the Version Identifier, Version Install Strings, and Version Description fields.

A version is defined by its name, application, language and operating system. So, for one application, it is possible to have many different versions with the same name, provided that they have different combinations of Operating System and Language.

15. Select the operating system that the application works under, from the Version OS drop-down list.
16. Select the language of the application, from the Version Language drop-down list.

1. Click on the Files tab.
2. Select (check) the files that are to be included. When a file is selected, the bottom pane displays the Machines and Directories that the file is located on.
3. If you want to disregard the file size when the file is taught click Ignore file size. The Size and Signature fields become disabled. Otherwise:
4. Specify the size of the selected file if needed. Enter the value in the Size field.
5. Specify file Signature by typing directly into the Signature field.
6. Specify the type of executable file by selecting a predefined type from the Exe Type drop-down list box.
7. Go through the list of files and check file characteristics. Make sure that the correct files are labelled as ‘Main’.
8. Double check files that are given status ‘Main’ by default; they might be carrying this status from previously taught applications.
9. You can change the status of the files (if required) by selecting the file and then selecting one of the option buttons in the Relation to Application group:
• Main - This is a key application file, that is, it is a file without which the application could not be running. It should always be present whenever the application is installed regardless of whether it is a minimum or complete installation.
• Associated - This is a non-key file that is part of the application and is written by the publisher that developed the product.
• 3rd party - This is a file written by another Publisher (3rd Party) and is used in the current application. An example of a 3rd party files is some DLL files that are technically used by the application, but are also distributed freely and can be used by other applications.

The VerDLL field shows a concatenation of a set group of version data fields. Do not change the entry in this field unless absolutely necessary.

The drop-down lists are produced from a combination of data in both Master.zsai and User.zsai. Before an entry is committed to the User.zsai a number of options are available. These can either be set up under options and selected as default, or the default setting can be left off and you will be prompted each time to select the information. See Step 5: Set Teaching Options.

1. Click on the SAI Selection tab.

This tab page shows a list of User SAI files available for teaching applications to. A file can be either or both of the following:

• Selected - Any changes made to the SAI are saved to the Selected file only - not the Default file.
• Default - The Default file is automatically selected when the dialog box is next opened. You can set a file to be Default and specify another one to be Selected.
2. To change the automatically selected SAI file, select another one from the list and click the Select button. The status in the Selected column is shown as Yes.
3. To change the default SAI to use, select the SAI file and click the Set Default button. The status is shown as Yes in the Default column.
4. Confirm your choices by clicking OK. You are prompted to set SAI teaching options. See Step 5: Set Teaching Options.

When you have done this, the information in the Software Application Index file is updated. You can view the newly added application by using the SAI Editor. See the SAI Editor Chapter for more information on how to do this.

1. Select the Options button in the New Publisher/Application/Version Setup dialog box. The SAI Teaching Options dialog box is displayed.
2. Set the options as follows:

• Recognition
  • Directory Level: teaching a single file will cause all files in all directory/ machine combinations where the file occurs to be re-recognized
  • Use Level 3 heuristics: teaching a single file will reprocess all files on all machines on which the file occurs
  • No recognition: No re-recognition will be performed. The recognition status of the added files will not be changed.

In most cases, the Directory Level setting is appropriate as it is the best compromise between the accuracy of recognition results and the speed of re-recognition.

The No Recognition setting should only be used in special cases when working with a very large number of scan files at the same time. In these cases the re-recognition time may be very high even if the Directory Level setting is used.

To initiate up to date recognition of all files and applications when using the No Recognition setting (and to see the effect of the application teaching) is to reload all scan files.

This setting should be set to the same as when the scans were loaded. If the scans are loaded with Level 3 heuristics enabled and re-recognition after teaching is done without it, recognition results can change significantly.

• Save changes to SAI
  • When AW exits: Any changes to the SAI are saved when you exit from the Analysis Workbench application.
  • Immediately: Any changes to the SAI are saved immediately.
• Tag changed items

Selecting this option enables the following further options:

• Files - Any files that are affected by the SAI teaching are tagged.
• Applications - Any applications that are affected by the SAI teaching are tagged.
• Directories - Any directories that are affected by the SAI teaching are tagged.
• Machines - Any machines that are affected by the SAI teaching are tagged.
• Set Local Tags - If this option button is selected, then Local Tags are used for the operations.
• Set Global Tags - If this option button is selected, then Global Tags are used for the operations.
• Set options as default

Select this check box to retain these settings as the default.