We are pleased to announce that with the ARL Update #2702 Flexera's Agent inventory capabilities have been extended. Our agent can now  detect different Adobe Acrobat DC editions, such us Professional, Standard and Reader for the Acrobat DC unified installer versions 2021 (or later) on desktop machines. We have seen a high demand among our customers to enhance Adobe Acrobat DC edition recognition. The existing identification methods (e.g. swidtag information) do not work for the Acrobat DC unified installer versions 2021 (or later) and cannot distinguish between the Standard and Professional installations. With the content change in July 2022, we have unlinked and remapped Acrobat DC installer evidence to Acrobat Reader. However, we have received feedback from many customers that the edition is needed to get better transparency. This new functionality is only available for the Flexera Agent on Windows 10 and Windows 11 desktops. The enhancement has been added to the InventorySettings.xml file, which will be delivered to all customers by means of an ARL release. An agent update is not required. To take advantage of this enhancement, navigate to Data Collection > IT Assets Inventory Tasks > Inventory Settings, scroll down to the Inventory Extensions Version and select Always use the latest version (currently xx). This will automatically deploy the latest InventorySettings.xml file to the agent. Better transparency across Adobe estate The editions are determined from the logged-in user in Adobe DC. The agent generates e xtra installer evidence, which shows the specific Adobe Acrobat DC edition (Professional, Standard or Reader) in the NDI . In a scenario, where multiple users are sharing a desktop machine to run different Adobe Acrobat DC editions from the same installation, each edition of Adobe Acrobat DC will be recognized. If the file-based usage data for Arobat.exe is processed, this also will be displayed for the recognized editions.      ... View more

Spider 6.4.7 update is available Release Date: 2022-06-29 A new update has been released for Spider. Please see the included changes below.  To be notified of these kinds of product updates, please ensure that you have subscribed to the Spider Release blog. Highlights Legal Entities for Employees Employees can now also be assigned to a legal entity. This can be entered via the user interface on the edit form of an employee. Along with the change comes an improvement to software assignments: By default, the legal entity of soft-ware assignments is inherited from the parent object. Overriding the legal entity on the software assignment is allowed, but not recommended. Enforce Legal Entities Editing legal entities on spider objects can now be enforced using the configuration. To do this, the configuration key Spider.Core.Web.LegalEntity.EnforceLegalEntityRequired must be set to True. If the configuration key is set, fields for legal entities are marked in the user interface. Objects without a legal entity are prevented from being saved. Trends for cloud subscriptions For cloud subscriptions, consumption is logged daily in Spider. With this version, the evaluation of this was added to the Spider user interface. The trend column has been added to the search page of subscriptions, the trend refers to the last 60 days. The trend can also be seen on the detail page of a subscription. Furthermore, the course of the consumption over the last 180 days can be read in a line chart. Updated Browser Recommendations Since Microsoft Internet Explorer is not being developed anymore, the browser will no longer be supported in the future. We recommend using current versions (stable versions) of the browsers Microsoft Edge, Google Chrome and/or Mozilla Firefox. Accessibility Improvements Further improvements with a focus on accessibility have been added to the Spider user interface. The changes include functional enhancements, support for third-party programs and design adjustments. In table views of the Spider web interface, navigation using the keyboard has been made possible. The operation with keys is enabled with the focusing of the table views (click in the grid to select a cell). For example, the cell focus can be freely changed using the arrow keys and hyperlinks are triggered using the Enter key. Paging can be triggered using the Page Up and Page Down keys. Within a line, you can navigate to the first and last cell using the Home and End keys. The contrast ratios in controls and forms of the Spider web interface have been adjusted to output barrier-free contrast ratios. Keyboard operation of the backstage menu has been made possible. The HTML source code of the Spider user interface has been extensively revised to support the use of screen readers more comprehensively. Corrections Under certain circumstances, Legal Entity search filters could lead to a multiplication of search results. The synchronization of metering data between Spider Software Recognition and Spider Asset could be aborted due to a long processing time. Filters for SAM priorities could be set correctly in the compliance dashboard, but these were not preselected when the dialog was called up again. In date filters on search pages, the settings for "or older" and "or younger" were not persisted.   ... View more

The June 2022 update of the Spider Software Services version 1.2206.1.1957 is now available.  All components are available in our Product and License Center. Catalog Changes PicPick products moved from publisher NTeWORKS to NGWIN. Additional LMP Definitions for MS 365 Enterprise E3/E5 added. Additional LMP Definitions for Adobe Creative Cloud Enterprise added. Recognition Catalog The  Recognition Catalog contains normalization and recognition capabilities for more than 2.846.000 inventoried programs, 121.700 software publishers, and 6.844.100 inventoried files. For more details please check the change notes. Software and SKU Catalog The Software Catalog contains more than  1.146.800 relevant and normalized articles (SKUs)  of software licenses and maintenances  and more than 68.800 license-relevant product versions.  Summary of the supplemented catalog items: Articles (SKUs): 3.157 Versions: 487 Spider Data Collector The  Spider Data Collector (SDC) provides a set of connectors to 3rd party inventory for an out-of-the-box collection of computers, software, users, virtualization, and many more. Please check the Spider Data Collector User Manual for a full reference of all connectors. ... View more

The May 2022 update of the Spider Software Services version 1.2205.2.1944 is now available.  All components are available in our Product and License Center. Changes [Spider Inventory /Columbus Inventory] The edition detection for Microsoft SQL Server Reporting Services as a standalone installation has been improved. [Microsoft Configuration Manager connector] The edition detection for Microsoft SQL Server 2022 has been extended. Fixed a rare bug showing programs on a device that don't belong to the device. An error has been corrected that caused an import from the Spider Datacenter Connector to abort. Recognition Catalog The  Recognition Catalog contains normalization and recognition capabilities for more than 2.832.900 inventoried programs, 120.800 software publishers, and 6.818.100 inventoried files. For more details please check the change notes. Software and SKU Catalog The Software Catalog contains more than  1.143.900 relevant and normalized articles (SKUs)  of software licenses and maintenances  and more than 68.300 license-relevant product versions.  Summary of the supplemented catalog items: Articles (SKUs): 35.945 Versions: 80 Spider Data Collector The  Spider Data Collector (SDC) provides a set of connectors to 3rd party inventory for an out-of-the-box collection of computers, software, users, virtualization, and many more. Please check the Spider Data Collector User Manual for a full reference of all connectors. ... View more

The April 2022 update of the Spider Software Services version 1.2204.1.1920 is now available.  All components are available in our Product and License Center. Changes [VMWare connector] In some cases, an empty hostname was detected, causing the connector to abort. This has now been fixed. A guest's hostname is determined using a different method. Catalog Changes Extended Microsoft Dynamics 365 product portfolio Added new LMP definitions for Microsoft System Center Additional LMP definitions for Adobe Creative Cloud All Apps added All "Fenix Projektconsulting & Beteiligungsges. mbH" products, versions and sw-products moved to ProjectLibre All IDM software products moved to manufacturer UltraEdit All LogMeIn software products moved to manufacturer GoTo Sophos Lan Crypt software products moved to manufacturer conpal Recognition Catalog The  Recognition Catalog contains normalization and recognition capabilities for more than 2.825.700 inventoried programs, 119.200 software publishers, and 6.789.800 inventoried files. For more details please check the change notes. Software and SKU Catalog The Software Catalog contains more than  1.107.900 relevant and normalized articles (SKUs)  of software licenses and maintenances  and more than 68.200 license-relevant product versions.  Summary of the supplemented catalog items: Articles (SKUs): 6.397 Versions: 345 Spider Data Collector The  Spider Data Collector (SDC) provides a set of connectors to 3rd party inventory for an out-of-the-box collection of computers, software, users, virtualization, and many more. Please check the Spider Data Collector User Manual for a full reference of all connectors. ... View more

FlexNet Mananager Suite on-Premises 2022 R1 is available We are proud and excited to announce the FlexNet Manager Suite on-Premises 2022 R1 release! This new version follows the 2021R1 on-premise version and brings a number of new features and enhancements. For more information please see the Futures by Release documentation. [more] In addition to the new features, extensive work to fix known bugs and security-related changes are also included. The following link will provide a list of issues fixed in the 2022 R1 (On Premises) release: [more] This article will briefly highlight the most important changes and refer to further documentation. Let's start with an overview of the highlights structured in the FlexNet Manager Suite value drivers: Key Vendor License Optimization View Microsoft Windows Server and SQL Server optimization reports View IBM RedHat optimization report View further Oracle optimization reports Automate exclusion of Oracle Java embedded instances Hybrid IT View IBM licensing for PVU and VPC across traditional and container environments Comprehensive Data For Licensing Gather VMware Horizon inventory for non-persistent VDIs Gather BMC Discovery inventory in a new lightweight way Lightweight Kubernetes agent reduces footprint and further updates Auto-cleanup of obsolete FlexNet inventory File replication captures beacon uploads for review Fractions of points supported for IBM PVU license calculations   Key Vendor Optimization: Microsoft, Oracle and IBM In complex licensing situations, high saving can be reached either by counting consumptions a more sophisticated way or identifying areas of optimizations. Counting consumptions a more sophisticated way This 2022 R1 version brings three new optimizations reports, that anticipate the enhanced calculation logic of the license that compute the optimal license consumptions for Microsoft Windows Server, Microsoft SQL Server and Red Hat Enterprise Linux (RHEL). Each product has a slightly different story but there is a common pattern: FlexNet Manager allows you to make the best licensing decision and not choose the easy but expensive option of licenses ESX servers (and their installed VMs) with the expensive with unlimited virtualization rights options (Data Center edition for Windows, Enterprise Edition for SQL or Virtual Data Center edition for RHEL).   Microsoft Windows Server Optimization The Microsoft Windows Server Optimization Report computes the optimal license needs based on the 90 day peak number of Windows Server VMs, host per host. It also identifies when CIS is required. The report gives the total true up as well as the savings, host per host but also globally of the optimal license (when it is Standard edition) versus the classical and easy "Data Center" edition choice. [more] The savings - through subscriptions downsizing (EASL contracts), non-renewal of Data Center edition SA or true up - can be in millions for large organizations.   Microsoft SQL Server Optimization The Microsoft SQL Server Optimization Report computes the optimal license needs evaluating host per host the "everything in Enterprise editions versus each VM licensed separately with the installed edition". The report gives the total true up as well as the savings, host per host but also globally of the optimal license (when it is Standard edition) versus the classical and easy "Enterprise". [more]   IBM Red Hat Enterprise Linux Optimization The Red Hat Enterprise Linux Optimization Report compares for each cluster the cost of using one or the other option, computes the optimal cost and provides the saving when the optimal license for a host is Server Node edition. [more] Identifying areas of saving: Oracle Optimization Oracle can cost millions with the so-called "soft partitioning rule" if the mistake was made of having a VM with an expensive option in a large cluster. Two reports  were released with 2021 R1 introduced the Oracle optimization analysis: Oracle Optimization on Clusters [more] Oracle License Consumption Details And Optimizations [more]  This version contains more. The ideal Oracle VMWare architecture is when all VMs with consistent installed and used options are regrouped in specialized clusters. The Optimum Virtualized Target Architecture for Oracle Options Report provides the full details of this target architecture along with the consumption saving. [more] Two other reports on Oracle provide simulations on the consumption and financial impact for the database and options licenses on the various soft partitioning levels (e.g. Cluster, vCenter, all vCenters): Oracle Processor Licenses: Consumption Summary Across Rules Report [more] Oracle Processor Licenses: Comparison Across Partitioning Rules Report [more] Automated exemption of Java embedded instances The license exemption by file path automates exemptions for Java installations recognized based on file evidences on exempted paths. [more] This feature introduces an application transparency report that links the dots between raw evidence and recognized applications. The report “deconstructs” the suites and shows recognized components.   Hybrid IT: IBM View IBM licensing for PVU and VPC across traditional and container environments The IBM license consumption in containers  is now managed in FlexNet Manager and integrated into the on-premise / Cloud license consumption for PVU and VPC licenses. The FlexNet Kubernetes agent collects from the IBM license server the cluster license consumption that is integrated and mixed in the other sources of license consumptions in the licenses consumption tabs and PVU consumption reports. [more]   Comprehensive Data For Licensing Gather VMware Horizon inventory for non-persistent VDIs The new VMware Horizon adapter collects non-persistent VDI data from VMware Horizon and import it into FlexNet Manager Suite. Collected VDI data consists of (1) existing VDI devices and templates, (2) existing desktop pools where these VDI devices and templates are installed and (3) what user groups have access to these desktop pools.   Application evidence can then be collected from each of the VDI devices by the FlexNet inventory agent or any other supported third party inventory solution. The use of other third-party inventory solutions is new and also available to work with other non-persistent VDI data such as Citrix.   Imported VDI data alongside the application evidence will give full IT visibility of inventory running on the VMware Horizon platform, and provide licensing capabilities for all applications used by end-users on non-persistent VDIs. [more] Two additional tabs (VDIs, AD Groups) have been added to the Virtual Desktop Template Properties page. The VDIs tab displays a list of deployed VDIs from a template as reported in the most recent software inventory. The AD Groups tab displays a list of Active Directory groups and users who have been given access to a desktop pool. [more]   Two reports are available to view the data: The Virtual Desktops File Evidence Report and Virtual Desktops Installer Evidence Report. These reports were formerly known as the Citrix Virtual Desktops File Evidence Report and Citrix Virtual Desktops Installer Evidence Report. With the introduction of the new VMware Horizon adapter, these reports have been updated to now report on file and installer evidence found on both Citrix Virtual Desktop Infrastructure (VDI) servers associated with Citrix delivery groups, and VMware Horizon non-persistent virtual desktop infrastructure(s) (VDI) delivering Desktops to end-users. [more]   Gather BMC Discovery inventory in a new lightweight way With this version a new BMC Discovery adapter is available. What is new? Using this adapter, running on an appropriate inventory beacon, simply connects to the RESTful APIs provided by BMC Discovery, is a much lighter mechanism for collecting the relevant data. There is no need for an intermediary staging database or a separate processing executable, as was the case with the previous mechanism. [more] Lightweight Kubernetes agent reduces footprint and further updates This light version of the Kubernetes agent  requires lass space, lower user privileges and no requirement to in injected in the containers.  [more] Furthermore, there are several updates to the   Flexera Kubernetes inventory agent, used to help gather inventory from containers in Kubernetes clusters. [more] Auto-cleanup of obsolete FlexNet inventory The Auto Cleanup  setting allows to define a deletion mechanism from Inventory Manager based on the last inventory date of the devices. This mechanism allows to avoid devices merge issues (that can cause false positives in recognized applications) and decreases the quantity of data (files evidence for instance) stored for “useless” computers. [more] File replication captures beacon uploads for review The File Replication on Beacons  feature allows to easily set up a local copy mechanism for selected inventory files types (e.g. .ndi, .disco) that transit on the beacon. This allows to understand the files flows and troubleshoot inventory issues. Note that this local copy is also possible on the application server (web.config setting). [more] Inventory from POWER architecture running Linux The  FlexNet inventory agent  collects inventory from a wide range of Linux platforms, but until now, those distributions have been supported only when running on Intel 32-bit or 64-bit architectures. With this release, the  FlexNet inventory agent  also supports a range of Linux distributions running on POWER8 (and later) processors. For more details, see the Agent Change Log. Fractions of points supported for IBM PVU license calculations Points tables in FlexNet Manager Suite have long supported decimal fractions of points used for calculating consumption in points-based licenses. From this release, when FlexNet Manager Suite is in PVU mode (responsible for sub-capacity consumption calculations for IBM PVU licenses), it correctly uses any fractional points values in calculating both current and historical peak consumption values. [more]     ... View more

Spider 6.4.6 update is available Release Date: 2022-03-30 A new update has been released for Spider. Please see the included changes below.  To be notified of these kinds of product updates, please ensure that you have subscribed to the Spider Release blog. Highlights Recurring reminders make sending reminder emails easier. New setting options allow reminders to be sent on a recurring basis. Intervals from yearly to daily are supported (e.g. every 3 months or at the end of the year). The extension can be used in all editions without further configuration. Visit the Flexera Community online for more information: https://community.flexera.com/t5/Spider-Knowledge-Base/Recurring-Reminders-Email/ta-p/228374 Spider has fewer accessibility barriers: Various improvements make working with Spider easier and more accessible. Operation with the keyboard has been improved in some places, tabular views work with higher contrast rates and the application name is also stored in page titles. Screen readers are almost fully supported in the suite and many of the controls are linked to labels in the frontend. A special focus was on the Login, AccountRecovery and MainMenu pages and the recurring controls that are visible on all pages. The table views (grids) have also been revised and offer better contrast and a new design. Furthermore, the Excel export has been completely revised. The results are now returned as a formatted table, so that working with a screen reader and direct filtering is also possible here. Improvements The Info page has been redesigned to show links to the Flexera Community. The edit forms for objects that support reminders now provide a link to directly create a reminder. Corrections Subscription licenses are handled like licenses with valid maintenance (e.g. Software Assurance). The license maintenance wizard also considered subscription licenses. When it comes to the question of whether a license may remain in the "+ Software Assurance" product versions, subscription licenses are also accepted in addition to licenses with valid maintenance. Previously, searching for a date on a specific day was only possible indirectly (larger and smaller). Searching for a specific day is now supported. Under certain circumstances, products from the product catalog could not be transferred after selecting a manufacturer. This has been corrected. Manufacturers that were created without a name could not be classified in SAM priorities. This has now been fixed. It is now possible to start multiple changes for search results where the number of hits could not be determined. The report "Procurement cost per manufacturer (Software)" incorrectly showed inactive elements. This has now been fixed. It was not possible to trigger the search using the Enter key on reports that are based on procedures. This has been added. Furthermore, discarding search filters was not functional on reports based on procedures. This has been fixed. On the Item Catalog page, the tab order was not as expected. This has been fixed. Previously, when an asset's type differed from the inventoried device's type, a message was displayed in the asset's edit form. This message has now been removed. Under certain circumstances, the Spider Admin Tool could not be updated during a setup. This has been corrected. ... View more

The March 2022 update of the Spider Software Services version 1.2203.1.1900 is now available.  All components are available in our Product and License Center. Changes [SCCM connector] Improved edition detection when only SQL Server standalone components such as Reporting Server are installed. [VMWare connector] When reading out the assigned ESX license, improved version information, e.g. 6.5 or 6.7, is now read out. [VMware connector] Problems occurred during import with non-integer values of the CPU or cores. The connector now always returns the next larger number as an integer. Catalog Changes Improved Microsoft Dynamics 365 product portfolio. Recognition Catalog The  Recognition Catalog contains normalization and recognition capabilities for more than 2.811.700 inventoried programs, 116.800 software publishers, and 6.756.500 inventoried files. For more details please check the change notes. Software and SKU Catalog The Software Catalog contains more than  1.101.500 relevant and normalized articles (SKUs)  of software licenses and maintenances  and more than 67.900 license-relevant product versions.  Summary of the supplemented catalog items: Articles (SKUs): 3.296 Versions: 162 Spider Data Collector The  Spider Data Collector (SDC) provides a set of connectors to 3rd party inventory for an out-of-the-box collection of computers, software, users, virtualization, and many more. Please check the Spider Data Collector User Manual for a full reference of all connectors. ... View more

The February 2022 update of the Spider Software Services version 1.2202.1.1875 is now available.  All components are available in our Product and License Center. Changes [Spider Data Collector] Machine-dependent encryption has been introduced in addition to the existing encryption of connector credentials. Existing credential files will continue to work. If the new machine-dependent encryption is to be used, the credentials would have to be encrypted again. The implementation was inspired by the following idea: Data Collector: Encrypted Passwords only valid on a single system Catalog Changes Sapien Concurrent-User products have been removed (correct - Named-User); LMP definitions for Desktop Enterprise Platform and Desktop Professional Platform have been added; Recognition Catalog The  Recognition Catalog contains normalization and recognition capabilities for more than 2.802.100 inventoried programs, 113.000 software publishers, and 6.703.500 inventoried files. For more details please check the change notes. Software and SKU Catalog The Software Catalog contains more than  1.099.400 relevant and normalized articles (SKUs)  of software licenses and maintenances  and more than 67.800 license-relevant product versions.  Summary of the supplemented catalog items: Articles (SKUs): 5.628 Versions: 103 Spider Data Collector The  Spider Data Collector (SDC) provides a set of connectors to 3rd party inventory for an out-of-the-box collection of computers, software, users, virtualization, and many more. Please check the Spider Data Collector User Manual for a full reference of all connectors. ... View more

The January 2022 update of the Spider Software Services version 1.2201.2.1859 is now available.  All components are available in our Product and License Center. Changes [Spider  Data Collector] Delivery of version 12.4 for the data center inventory components [Spider Data Collector] The vCenter connector did not submit the hosts for guests with a Windows client operating systems. This has been fixed. Important Catalog Changes Additional rules for Techsmith and Adobe CC components Additional LMP Definitions for Suse Linux Enterprise Server and Microsoft Office Professional Recognition Catalog The  Recognition Catalog contains normalization and recognition capabilities for more than 2.794.000 inventoried programs, 112.700 software publishers, and 6.651.200 inventoried files. For more details please check the change notes. Software and SKU Catalog The Software Catalog contains more than  1.096.200 relevant and normalized articles (SKUs)  of software licenses and maintenances  and more than 67.740 license-relevant product versions.  Summary of the supplemented catalog items: Articles (SKUs): 11.893 Versions: 81 Spider Data Collector The  Spider Data Collector (SDC) provides a set of connectors to 3rd party inventory for an out-of-the-box collection of computers, software, users, virtualization, and many more. Please check the Spider Data Collector User Manual for a full reference of all connectors.   ... View more

Spider 6.4.5-R8 and Software Service 1.2201.1 are available Release Date: 2022-01-10 Due to the scope and criticality of the Log4j vulnerability, we have extended a way how Spider can gather and  process log4j-jar files for a new vulnerability report.  Therefore we have released new versions of Spider and Software Services.  All components are available in our Product and License Center. For further information please see our knowledge base article: Spider-Knowledge-Base: Log4j vulnerability report: How can Spider gather and report log4j*.jar files?  Software Service 1.2201.1 - Spider Recognition module The Spider Recognition module can now p rocess log4j*.jar files so that they are stored as file evidence (file scan) in addition to the .exe files. We decided that only log4j*.jar files will be processed and saved. Other jar files are discarded during import so that the file scan is not unnecessarily enlarged and arithmetic operations are not unnecessarily slowed down. If no jar files are delivered, there will be no changes. No further settings are required in the recognition module. In addition, we have included a bug fix. With the device detection only via hostname and domain name, the device data records could be duplicated. If other identification fields such as UUID or URN are used, this error did not occur. The bug has been fixed. We kindly ask customers who have observed the problem to contact the support team. Upgrading to this version does not change the contents of the catalog. All changes will also be included in the next monthly release for January.  Software Service 1.2201.1 - Spider Data Collector The Spider Data Collector contains the connector to the Microsoft Endpoint Configuration Manager (former SCCM). This connector has been expanded with this version. If it is set in the Configuration Manager that *.jar files should also be collected, log4j*.jar files are exported for Spider. Other jar files are skipped and are not exported. The effects on the generated export files are therefore limited to the additional log4j-jar files. If the Configuration Manager does not collect any jar files, there is no difference to the previous version. Customers who do not want to use this functionality or who do not use a Microsoft Endpoint Configuration Manager (SCCM) do not need to import this version of the Spider Data Collector. Spider 6.4.5-R8 - Log4j vulnerability report Spider delivers a new vulnerability report "Vulnerability Report for Log4j". The report shows gathered log4j*.jar files on the scanned devices for authorized legal entities. Jar file gathering has to enabled. This is possible with Spider Inventory (former Columbus Inventory) and with Endpoint Manager Configuration Manager (former SCCM). The report is pre-authorized for the role "Asset Manager". Other roles have to be authorized via Spider Admin Tool. For further information please see our knowledge base article: Spider-Knowledge-Base: Log4j vulnerability report: How can Spider gather and report log4j*.jar files? ... View more

Summary Which Log4j versions are installed in your own IT landscape? And which tools can help with transparency? SAM tools use inventory solutions to gather programs and files. Can't they just take on this task too? This article describes how Spider can support the transparency of which Log4j versions are installed via jar archive files in the IT landscape. Learn more about our January 2022 expansion of the Spider suite. Why did we decide to expand Spider with a Log4j vulnerability report? First of all, there is a particular criticism of Log4j vulnerability. We understood from discussions with customers that it is not easy  to achieve transparency about the Log4j versions used in a IT landscape. There are different strategies which are needed for the detection of Log4j.  Windows Add And Remove Programs often does not go far enough. Instead, the specific JAR files and their locations are asked more often. Because a SAM tool is based on inventory data, which also includes files, the question arises whether it might not be possible to collect and evaluate the "log4j*.jar" files. The Spider Recognition module was previously only able to process exe-files. The amount of exe-files in itself is a particular challenge in the recognition process. What would it mean if the log4j jar files are now also processed? This has been investigated and a report has been developed. Only a few settings have to be made,  to collect log4j.jar files and to get the report up and running about which jar file and which version are found on which system. The collection can be done with the inventory solution Spider Inventory (former Columbus Inventory) as well as with the Microsoft Endpoint Configuration Manager (formerly SCCM). The report on all file evidence (file scan) is often very time-consuming and slow, which is why we worked on a good solution so that a quick report can be created and also be exported. These extensions are possible with the first January release 2022. What does this extension include? Existing Spider Inventory (Columbus Inventory) already supports that multiple file extensions can be gathered. According to this, the .jar file extension can be added by changing the configuration of the config files (cfg-file). No new Spider Inventory version is required. Only the configuration changes need to be rolled out. If Microsoft Endpoint Configuration Manager is used, the collection of *.jar files for log4j can be added there. The connector has been extended so that these "log4j*.jar" files can also be exported and processed in Spider, if they occur.  In order to use the new connector version, the Spider Data Collector has to be updated. The Spider Recognition module (release January 2022 and above) processes log4j*.jar files so that they are stored as file evidence (file scan) in addition to the .exe files. We have decided that only log4j*.jar files will be processed and saved. Other jar files are discarded during import so that the file scan is not unnecessarily enlarged and arithmetic operations are not unnecessarily slowed down. To take advantage of this, the Spider Recognition module has to be updated. Spider delivers a new vulnerability report for Log4j. The report shows gathered log4j*.jar files on the scanned devices for authorized legal entities.  The following fields are available in the report so that there is a good overview of where which Log4J Jar files are installed: AsssetNo, hostname, status, last scan date , legal entity, filename of the log4j-jar file, the installation path, the Log4j version extracted from the filename.  In order to use the new report, Spider has to be updated. What steps are required? Update of the Recognition module with version 1.2201.1 or higher. If Spider Inventory is used, roll out the configuration change so that * .jar files are also gathered. For this, the file extension .jar must be added as the file extension in the configuration file (cfg file).   For using the Microsoft Endpoint Configuration Manager (former SCCM) connector, the update of Spider Data Collector to version 1.2201.1 or higher is required. The collection of .jar files must be expanded in the Configuration Manager. In addition to the exe files, the connector only exports files that match the pattern log4j*.jar. Update Spider to version 6.4.5-R8 or higher to get the new fast running vulnerability report based on log4j.jar file evidence. By default, the report is authorized for the Asset Manager role. The report can be found under the Vulnerability Reports group. A few words about the report: The report shows log4j jar files including the file path. The version is extracted from the file name during processing and enables a targeted search for specific versions. Assets are shown with the columns AssetNo, Hostname, Status, Last Scan Date and Legal Entity. Only authorized assets via Legal Entities are visible. The report was implemented as a procedure-based report and enables a quick response, even in large environments for which many files are processed (e.g. 1 million data records). The following screenshot shows an example of a data record for the report.   What if a different connector is used? If another connector or inventory system is used, that provides file scan, we can check whether it is possible to collect and export log4j*.jar files here. If you are interested, we look forward to a comment or an email. For Spider Datacenter Inventory for Linux / Unix this functionality is currently not available. If Spider Datacenter Inventory is used and the collection and processing of jar files for Log4j is an important requirement for you, we look forward to an email for further coordination.       ... View more