When you create custom signatures in SUA you can specify both file size and version. Is it better to use one or both attributes when I’m creating a signature? If I used both, wouldn’t it be the most accurate?
Hello jmatlock,
Here’s what I found out:
"If you use both - so have to file rules - one with size and one with version then they will be treated as alternative - so it will not narrow the result, but rather make signature more open.
Please take a look at:
https://www.ibm.com/developerworks/community/wikis/home?lang=en#!/wiki/Tivoli%20Endpoint%20Manager/page/Customizing%20the%20software%20catalog
You will found following note with current recommendation:
Note: The file size and version are pre-filled by default. However, if they do
not fulfill certain requirements, they might lead to false-positive discovery.
Specify the file version if it is in sync with the version of the product or is
changed with every release. Otherwise, specify only the file size.
You created a file-based signature that allows for discovering Live Project
Premium Viewer and measuring its usage.
Please check the version and sizes of that file across your environment - it will help to decide what is better size or version."
Hope this helps.