Manually Created File Evidence (Source: Local) Not Getting Matches Even After 2 Weeks

[sourav_sengupta]

Hi Team,

Need your expert assistance with this issue. Please note the details below:

1. Application Name: Zplusviewer 2.5
2. Publisher: LHP Software
3. Executable Filename: szplusviewer.exe
4. SCCM Rule: Yes (recently created with "szplusviewer.exe")
5. Devices Discovered: 178
6. File Evidence Matches: 0 (None)
7. Last Used Date: 0 (None)

We have been trying to gather "Last Used Date" information for Zplusviewer from 'All Applications'>Zplusviewer>Application Properties>Devices.

Recently we created SCCM Rule with "szplusviewer.exe" and also manually created a "File Evidence" in FNMS with the same .exe filename i.e. "szplusviewer.exe" as there was no match found for this application under File Evidence items.

However, neither any matches found against the added File Evidence nor any Last Used Date information is being reflected against any device. Please assist us.

Thanks & regards,

Sourav Sengupta

[ChrisG]

File evidence rules are matched using the following 5 properties:

1. File name
2. File version
3. Company
4. Description
5. Size (if specified in the recognition rule)

One possible explanation for why you are not seeing your manually created rule matching the data is that you have left the "File version", "Company" and/or "Description" fields blank in the rule, while the data being imported from SCCM for those fields is not blank.

To avoid problems from this, it is often easier to create a file recognition rule from unrecognized file evidence that has already been imported rather than manually creating a recognition rule from scratch.