Blacklisted applications which have been removed

DavidH asked a question.

May 6, 2018 at 7:00 AM

We use blacklisting. So if something on our blacklist is detected by Snow, then we can remove it from the computer. However, there's a problem. After removing the blacklisted software, it continues to be reported by Snow, both in the SLM user interface, and on reports, like "Blacklisted applications per computer". Here is an example, where the blacklisted item was uninstalled a couple of months ago . It still shows in SLM, like this: ...and it also still appears in the "Blacklisted applications per computer" report. We think this happens because there is still metering data for this application. So we would need to wait until the metering period has expired before this blacklisted application disappears... Is this a common problem? With our example, we have made absolutely sure that the application has been removed, but Snow continues to report it two months afterwards. Unfortunately, this makes Snow appear to be inaccurate. For us, it's quite a big issue because we can't know if blacklisted software is installed or not. We think it would be better if Snow identified blacklisted applications that have been uninstalled . Is that possible?

PeteS
8 years ago
HI, yes I had the same issue and agree that it would be better if Snow was able to report on this better, so that we can focus solely on the actual installations. The way I have got around this to date is a little long winded, I run another report to list all removed applications and then vlookup these on my latest Blacklist report. The main attributes that form my "Removed Applications" report are as follows: Computer Name Most Frequent User Last User Organization Last Scanned Application Manufacturer Application Name Type (and filter "Removed") First Discovered Last Discovered As I say, it is not ideal, but it helps identify those that have been removed.
Expand Post
- DavidH
  8 years ago
  Thanks for those tips, and it's good to know that somebody else has the same problem. It's a shame to have to go to such lengths to filter out blacklisted items that have been uninstalled. But I appreciate your advice very much. Hopefully Snow might be able to improve this - both in the User Interface and in the reports section. Perhaps this can be picked up as a feature request?
  Expand Post
- Portal User
  8 years ago
  I was obviously very slow yeserday as I could not work out where you were getting this report. Today (now that I have recovered from the weekend sunshine) I have figured it out, and it is something that I will certainly benefit from, so thanks I had a thought that might help, but it doesn't look like it will. The thought was to add a custom field to "Application" called "Blacklisted" and make it a yes/no value with a default value of "No". Then you could update all blacklisted applications to "Yes" and add this custom field to the report and filter by that also. But alas, the report seems to be more Computer based than Application based, so this custom value does not appear. I guess that Snow, or your provider (if you are hosted) may be able to customise this report to add the custom field. It would certainly make reporting on removed blacklisted applications easier. Regards Greg
  Expand Post
Community Manager (Flexera Software)
8 years ago
Hi David, If you are open to running custom reports, then take a look at my post That report shows all blacklisted applications, the primary user of the computers, and the install status of the product. Regards, Mark.
Expand Post
- PeteS
  8 years ago
  Hi Mark, we don't have Snow on-prem, is this something I could email my service provider to set up, or is this something that can be run in Snow? Not sure if I need any special access. Such a shame these custom reports could not be shared externally in the tool like you can share with others on the same platform. Your link is very good as I have recently reached out to my Snow account manager asking for this exact report and was informed some work had to go into creating it.
  Expand Post
- DavidH
  8 years ago
  Hi Mark, Yes, we are open to custom reports, and what you describe sounds excellent! I will definitely look into that. Thank you so much. Regards, David
  Expand Post
Portal User
8 years ago
Hi, I believe, as you have eluded to, that this is due to the "METERING_HISTORY_MONTHS" configuration. As we are on a hosted platform I don't get access to this, but believe the default is 3 months. I don't believe that there is currently a way to delete metering history for a specific application, but you can for all via the "METERING_HISTORY_CLEANUP". From what I have read, this only clears history for all data prior to the number of days in the "METERING_HISTORY_MONTHS" setting. e.g. if period is 30 days then the clean-up will delete all data for 31 days and older. Setting the period to 0 or 1 day may get results in regards to blacklisted applications, but you will want the history of all the other applications. There should be a way to remove the history of individual applications I think. Regards Greg
Expand Post
- DavidH
  8 years ago
  Thanks for that confirmation about metering history. I'm not sure that we want to remove the metering data to solve this problem, but it is very useful that somebody else confirms our theory. I think that our metering history is kept for 3 months, which is probably the default. But as you can imagine, it's frustrating that we remove some malware and then have to wait 3 months before Snow stops reporting it. Regards, David
  Expand Post