FNMS recognition rules (file-evidence)

[matthias_van_b_1]

When multiple recognition rules apply for certain evidence - for instance "at-least-one" as well as "required"), which one prevails? How is the sequence being set-up? Or do both rules apply simultaneously and will this situation result into conflicts? 

So in short, we are looking for some detailed information on how FNMS handles all recognition rules. 

BR, Matthias van Beeren

[ChrisG · Accepted solution]

An application will be recognized as installed on a device based on file evidence if:

• The application has at least one recognition rule marked as "required" or "at least one".
• All file recognition rules (if any) that are marked as "required" are matched by file evidence from the device.
• At least one file recognition rule (if any) that is marked as "at least one" is matched by file evidence from the device. (*)
• None of the file recognition rules marked as "not allowed" are matched by file evidence from the device.

(*) I'm not sure of the exact behavior if the application has recognition rules marked as "required" and rules marked as "at least one". I suspect the logic will still require at least one of the "at least one" rules to be matched, but it's possible they will effectively be ignored.

[kclausen]

@matthias_van_b_1  - To follow up on what Chris stated, you should not see both types of File Evidence rules for the same application.  It would either be a list of EXEs with "At least one of the following", or 1 or more EXEs with the rule "Required".

My educated guess would be that if you were to find both types of rules for an application, then both conditions would need to be true.  For example:

AA.EXE is required.

At least one of the following is required:
(BB.EXE, CC.EXE, DD.EXE, EE.EXE)

If only AA.EXE is found, then the application would not be recognized.  If only CC.EXE is found, the application would not be recognized.  However, if AA.EXE and CC.EXE are both found, then the application would be recognized.