4.10.5 Ignore Rules

4.10.5 Ignore Rules

The Ignore Rules tab is used to configure a rule to ignore applications that are considered unimportant, so they do not appear in any results. 
Applications that match an Ignore Rule are excluded from the results in all pages, including the Dashboard page, and the weekly pdf report. Ignored Applications cannot be updated with Approvals, and they will not trigger 0-Day alerts. 
The tab shows the List of Ignore rules and also: 
  1. Enabled
    1. The Ignore Rule is Enabled and will be applied
    2. The Ignore Rule is Enabled but has Expired and will not be applied.
    3. The Ignore Rule is Disabled and will not be applied
  2. Name, Ignore Rules given name
  3. Expiry, Ignore Rules has 90-day expiry date that can be extended
  4. Group
  5. Host
  6. Rule, application that targeted and installation path. 


Ignore Rules Action 

On the Ignore rules tab a user can:
Create a New Ignore Rules, Edit Selected Ignore Rule and Renew Selected Ignore Rules.

Create New Ignore Rule 

You can Create a New Ignore Rule to do so:
  1. On the Ignore rule tab, Click Create new Ignore Rule 
  2. A menu will pop up 
  3. Give it a proper name, description is optional
  4. Ignore Path, please read the section below: 
Ignore Rules can have a filesystem path as part of their definition. 
The path can be a plain filesystem path, but it can also have environment variables and special patterns to improve the filtering capabilities. 
Environment variables are defined on each Host, and are expanded to fill part of the path. Environment variables are names enclosed in percent-signs (%). 
Some examples of useful environment variables, with typical values that they are expanded to: 

Environment Variable
 Typical Value: 
%ProgramFiles% 
C:\Program Files (x86)
%ProgramFiles(x86)%  
C:\Program Files (x86) 
%ProgramW6432% 
 C:\Program Files 
%SystemRoot%
 C:\Windows 
%SystemDrive%
 C:\ 

Notes
Note that some environment variables may vary between different processes running on the same host. Also note that environment variables are relative to the Agent, which is a 32-bit application. 
Additionally, paths support the following special patterns: 
? - A question mark matches a single character in a folder name or filename. 
* - An asterisk matches 0 or more characters of a folder name or filename. The asterisk is the only element of a path section, then that path section matches a single folder with any name. 
** - Two asterisks, as the only element of a path section, match 0 or more folders and any trailing file name. 

For example: 
The path %SystemDrive%\Users\*\Downloads\** matches all files in Downloads folders of all users and includes all subfolders. 
The path %SystemDrive%\Users\B*\Downloads\**\*.exe matches all executable files in Downloads folders of users whose names begin with "B", and includes all subfolders. 

Notes
Note that partial paths will not match any results. To match a path and all its subdirectories, append the ** pattern: 
C:\temp will not match any results 
C:\temp\** will match all files in the folder C:\temp and all its subfolders. 
Paths are not case-sensitive, so e.g. C:\TEMP\** and c:\temp\** are equivalent.
     
      5.  Create the ignore rule 


Edit Selected Ignore Rule

It is also possible to Edit an ignore rule 
To do so: 
  1. On the ignore rule tab, mark the ignore rule to be edited 
  2. When rule is marked the Edit ignore rule can be used 
  3. Press the button and a pop up menu will appear 
  4. Make the wished changes and save. 

Renew Selected Ignore Rules 

Ignore Rules are active for 90 days at a time, and then they must be renewed for another 90 days. 
Expired Ignore Rules have no effect, ignored Applications will reappear in results on the next inspection. Ignore Rules will be automatically disabled if they have been expired for more than 14 days, and have not been renewed 
To renew  ignore rule(s) 
  1. On the ignore rules tab, mark ignore rule(s) 
  2. When marked, button Renew Selected Ignore Rules can be used 
  3. Press the button Renew Selected Ignore Rules 
  4. Expiry date of selected Ignore rules would be update and active again. 
  5. Hold mouse of the expiry date label for specific date/time