Processing Whitelisting and Blacklisting

Sam90 asked a question.

June 29, 2018 at 7:00 AM

Hello All,

Can anyone please explain how does processing whitelisting <whitelist> and blacklisting <blacklist> works.

And also we want to restrict the processing of files. So, what all file extensions like .dll, .ps1, .exe must be included in the <whitelist> element and rest can be automatically excluded what all is not included in the <whitelist> element.

Data Services & Inventory

SamuelBaughan
8 years ago
Hi Sumit, The whitelist/blacklist is simply a way to flag applications on PCs as acceptable or not. It does not prevent users from installing or using them, it is just a category that Snow displays in the form of a colored background in SLM as follows: The Snow agent has the option to prevent some executable files from running. Please refer to the documentation for this feature called "Deny" in this document If you want to reduce the types of files that are scanned and reported by Snow, you must take into account that in general, only *.exe files are used (along with registry keys) to recognize an application. You can see the rules that apply to each recognition pattern from your SMACC. Regards
Expand Post
- Sam90
  8 years ago
  Hi Samuel, Thanks, but I guess you are mentioning about application whitelisting and blacklisting. My concern is the type of files which are processed by Inventory Server. Section 8.4 - Restrict Processing of Files in SI54_UserGuide_InventoryServer says that: By default, all types of files are processed by the Inventory Server. However, by using the whitelisting and blacklisting functionality in the configuration file of the server it is possible to control what type of files to process, or not to process. Use the <WhiteList> element to define file extensions of all file types to be processed, or use the <BlackList> element to define file extensions of all file types not to be processed. This example will only process files with extensions .exe and .txt: <Master> <DataProcessor> <ApplicationProcessing> <FileExtensions> <WhiteList> <Extension>exe</Extension> <Extension>txt</Extension> </WhiteList> </FileExtensions> </ApplicationProcessing> </DataProcessor> </Master>
  Expand Post
  - SamuelBaughan
    8 years ago
    Hi Sumit, I see, sorry I had completely misunderstood your question As far as I know, the agent will only scan for a very restricted set of files including exe files plus a handful of other file extentions that I have never seen ( wfd, wfi, wtd, wti, sys2, lnk ). See this post for a question on the subject. Since an unmodified agent config file will likely almost only find exe files during a scan (the agent analyses the exe files that the *. lnk files are pointing to, I have no clue what the other file formats are about), then I do not see why you would have to worry about limiting the processing of txt files for example because the default settings are set so that txt files are never reported back to the Inventory Server anyway. Regards
    Expand Post
    Sam90
    8 years ago
    Hi Samuel, Thanks, concepts are more clear now But do we have any reference document because the reference document which is attached with the post you referred is for Snow IDP (Inventory Data Processor). And we do not need Snow Inventory Data Processor explicitly for Inventory 5 or still can we refer the Snow IDP (Inventory Data Processor) document ???
    Expand Post
    SamuelBaughan
    8 years ago
    Hi Sumit, You're right, I'm not sure of how relevant this document is now ... but it contains the exact same list of scanned files as what we find in the default snowagent.config file under the IncludeCriteria XML tag: <IncludeCriteria> <FileType>exe</FileType> <FileType>wfd</FileType> <FileType>wfi</FileType> <FileType>wtd</FileType> <FileType>wti</FileType> <FileType>sys2</FileType> <FileType>lnk</FileType> </IncludeCriteria> WHen trying to understand the config file, I've been looking for information regarding those file formats and the only place I could ,find something related was this document. At least it tends to confirm that this is (or has been in the past) a well defined set of files that are (or have been) there for a specific reason. I have found so far no software recognition rule that would make use of files others that *.exe so I'm very much tempted to just remove them even from the scan. Hence my other question I referred to previously ... but no answer yet from the community Greetings
    Expand Post
Portal User
8 years ago
Also see: and
Expand Post

Related Product Forums

→ Flexera One

→ Snow Atlas

→ FlexNet Manager

→ Snow License Manager

→ App Broker

Need help finding an answer?

Ask a Question →