Benefits of using templates to define content fingerprinting criteria

Prev Next

An application template controls specific applications using properties such as product or vendor name, executable file name, or window title.

An application template can be defined for a single application, or a group of similar applications. There are built in (predefined) templates for several common applications such as Windows Explorer, web browsers, and email clients.

The application template definition includes a field with a checkbox for operating system. Analyzing memory mapped files is a Windows-only feature, and is disabled automatically when you select macOS applications.

Application templates for Microsoft Windows can use these parameters:

  • Command line — Allows command-line arguments, for example: java-jar, that can control previously uncontrollable applications.

  • Executable directory — The directory where the executable is located. One use of this parameter is to control U3 applications.

  • Executable file hash — The application display name, with an identifying SHA-2 hash.

  • Executable file name — Normally the same as the display name (minus the SHA-2 hash), but could be different if the file is renamed.

  • Original executable file name — Identical to the executable file name, unless the file has been renamed.

  • Product name — The generic name of the product, for example, Microsoft Office 2012, if listed in the executable file's properties.

  • Vendor name — The company name, if listed in the executable file's properties.

  • Window title — A dynamic value that changes at runtime to include the active file name.

All parameters except the SHA-2 application name and the executable directory accept substring matches.

Application templates for macOS can use any of the following parameters:

  • Command line

  • Executable directory

  • Executable file hash

  • Executable file name