Evidence not linked to Application

[scsharath2]

Hi,
we've around 17k evidence that is not linked to any application or unrecognized evidence, I know that we can open a case to add them to ARL but since it's a huge number not sure if it is a valid case to ask to add. Is there any alternative way to handle these records?

[tblock]

Good question, we have the same issue. We will match them up if we are working a specific publisher or product, but the volume of discovered evidence not matched to applications is quite large, even for more "common" applications.

Also, when new versions or updates come out and are discovered before being added to the ARL, it forces a decision. Should I wait for the next ARL or open a content case? The ARL releases are well documented, but I wonder if there is a way to tell what is being worked on for the next release so I don't feel like I may be wasting my time with a case.

[shuduguru]

Hi @scsharath2 , @tblock  Please go ahead and open a new case, we will gap-fill the evidence. 

[bfaller]

Of course, you can open a case with your data.

Nevertheless, if you don't want to wait or if you are so happy with ARL way of dealing, you can do some local work, at least for evidences / applications that are important for you, in adding local evidences & applications. For instance, if you don't want to wait for Adobe 2024 products in ARL (Flexera delay after Adobe GA is about 2 months), it is easy to add relevant evidences and applications locally. If you have homemade applications, it is better to deal them locally and not to put them in ARL, which will impact all other customers.

Regards.

[scsharath2]

thank you, we've opened a case to handle the unrecognised data 

[mschwach]

Hi,

Just as a side-note:
It's a pitty that ARL will roughly identify only 5%-10% off an Application, based off scanned FileEvidences. But main cirtieria within ARL is not focus on FileEvidences and therefore is following other rules discovering Application such like files ending with *swidtags*, registry Entries in Windows (Uninstall a Programm in ControlPanel for e.g) or on Unix/Linux reading the Package-Registry.
And as forespeakers in this thread already said, you can create your own Application locally. And of course, the possibility to open a Case to add a "critical" comerzial Application, which is not covered so far.

regards

[JeffVoss]

Keep in mind even when you submit evidence, anything that is a Driver will be ignored.