Solved: In FNMS Apple OS X Apps recognized as commercial products of other publishers?

weskus · ‎Oct 15, 2020

I have hit with unpleasant phenomenon that FNMS reports applications that are unmanaged and recognized for certain commercial publisher like IBM. There are Mac installs and type is OS X App.

When I investigate the app that have been installed in the device, software cannot be found.

Os X App evidence where the installs are recognized do not have publisher as filter. I Think these are recognized using too generic terms and leads to a false positives. I tried to find if IBM has ever published Document Manager 1.0 to OSX, and I failed. I doubt that.

Any ideas how to address this, since its quite clear that OS X App recognition will need extra design in the future due missing publisher information in the OS level.

These are under suspicion:

IBM Document Manager 1.0

Visara Icon 5

Sentry 1

kclausen · ‎Oct 15, 2020

@weskus - If you go to the Evidence tab off the Inventory Device where one of these suspect applications is installed, you can filter on the Recognized Application name, and then see the raw installer evidence (Raw Publisher, Raw Version, Raw Name, Raw Evidence Type) and verify the data.

If you think that this is a false positive, a Support Ticket could be submitted and perhaps the Flexera Content team can remove this specific recognition pattern.

View solution in original post

kclausen · ‎Oct 15, 2020

@weskus - If you go to the Evidence tab off the Inventory Device where one of these suspect applications is installed, you can filter on the Recognized Application name, and then see the raw installer evidence (Raw Publisher, Raw Version, Raw Name, Raw Evidence Type) and verify the data.

If you think that this is a false positive, a Support Ticket could be submitted and perhaps the Flexera Content team can remove this specific recognition pattern.

weskus · ‎Oct 16, 2020

Hi.

This is exactly what I did. Raw evidences where certain software are "attached" to a commercial products are very generic. If you think that name = "icon" and version = "5" are only terms that should match for an application. I guess there can be even several mac applications to have that and they all are linked to a wrong appl. Including what might come with OSX itself.

Point here is not to do local fixes, but raise awareness of the challenges around Mac application detection, since publisher data is not there. And hope development will invent more means to address OSX evidences (wink, wink, nudge, nudge).

I have set ignore on these evidences already...