Synchronized App Control - Clean up / Delete Apps

Hi,

currently there is no way to remove an app. Even if you would remove it, the next time the endpoints sends information about this app, it would be added to the system again.

So you miss some kind of "ignore this app" functionality, so that this app is neither listed in webadmin nor the endpoints sends any more information about this specific app ?

Regards,

Holger

Hi Holger, 

Thanks for the Feedback.

Either way i would like to have the option to modify the applications in my network. 

If you run the SAC a long time, you will run into X.000 found Application and do not have any option to delete them? This can cause other issues like finding "new Applications" in the Dashboard. 

In my point of view, a "automatic Cleanup" after X Days without occurrence would help a lot. Or a "Flush Database of New Applications" Button. 

Just thinking about the big Appliances with SAC enabled in huge environments. 

Cheers. 

Hi,

so now we found an additional idea. Let me summarize my current understanding and let me share some own ideas.

• Forget function - after a period of time (mabye time-out should be configurable) without occurence, SAC should forget this application. If this application occures again, this app is listed again
• Ignore function - when you have apps that should not be handled by SAC, you want to be able to decide that SAC should ignore this app, regardless of the endpoint. In this case occurence of this app should not be reported to SAC. Maybe the ignored apps are listed somewhere (e.g. on a separate tab), so that you are able to remove them from the ignore list.

Do you think these improvements would increase the benefit of SAC for you?

Regards,

Holger

Hi Holger,

i agree with the first idea! Would be great to get this into the GA Release. 

Would like to see another way to clean up all "New Applications" and let the SAC start from fresh to gather new applications. This would help a lot, if you want to roll out a new Application in your network and don´t want to waste time to get through all Applications. Should be easily to do with a database flush and give a create value to the feature. 

The Second point about "Forgot" is a little bit tricky. I mean, it is basically the same to create a definition and to ignore a application, or do i miss something? Maybe a additional report feature, to keep reports clean from applications like "svchost" ;)

Cheers 

Hi,

so flushing all NEW apps is an additional idea .. also very interesting. It is unlikely that we can add new functionality to v17 GA, as this would cause a complete new testcycle and as we need some time to prepare, implement and test new features.

BTW: We are discussing internally how to identify windows services and either ignore them or list them in a separate list, to keep the list with NEW apps clean.

The "forget" idea would a self cleaning mechanism. But the main difference to the "ignore" idea is, that a forgotten app would still be reported from the endpoint and appear as NEW app if this app occurs again. A "ignored" app would not be reported by the endpoint at all and would neber re-appear. I think both is worth to be discusses as future improvements.

Anyway - I will discuss these ideas with team and our product managemt - so stay tuned and continue with you testing.

How do you like SAC in general? Do you think this brings a good benefit to your daily work?

Again .. thank you very much for your input.

Best regards,

Holger

Hi,

so flushing all NEW apps is an additional idea .. also very interesting. It is unlikely that we can add new functionality to v17 GA, as this would cause a complete new testcycle and as we need some time to prepare, implement and test new features.

BTW: We are discussing internally how to identify windows services and either ignore them or list them in a separate list, to keep the list with NEW apps clean.

The "forget" idea would a self cleaning mechanism. But the main difference to the "ignore" idea is, that a forgotten app would still be reported from the endpoint and appear as NEW app if this app occurs again. A "ignored" app would not be reported by the endpoint at all and would neber re-appear. I think both is worth to be discusses as future improvements.

Anyway - I will discuss these ideas with team and our product managemt - so stay tuned and continue with you testing.

How do you like SAC in general? Do you think this brings a good benefit to your daily work?

Again .. thank you very much for your input.

Best regards,

Holger