Home    SecuLution Dokumentation back next
Welcome
SecuLution technique and terminology
Quick start
Test setup in 30 minutes
Best practice in everyday use
Full setup and deployment in 5 hours
Installation of components
Install Appliance
AdminWizard installation
Agent installation
Syslog server installation
Initial configuration tasks
Configure basic settings
Agent configuration
Configure automated tasks
Manage whitelist
Initial whitelist generation
Import trustworthy software
Learn mode
Check deployment and learning progress
Audit
Add entries to whitelist
Drag'n'drop
Individual lernmode
Import from directory
PermanentLernUser
Log alarms
Cleanup whitelist
Manually delete unused entries
Delete entries using a pattern
Clean up classifications
Managed Whitelist
Managed Whitelist
Actions
Actions
Referring rules to objects
Offline mode
Offline mode
Devices
USB device management
USB device encryption
RCM
Agent deployment (RemoteClientManagement)
ArpWatch
ArpWatch
Logs
Logs
FAQ
setup.ini

Delete entries using a pattern

Sometimes you may want to temporarily add hashes to the whitelist that should be removed later. Use the classification to define a unique tag that can later be used to delete all hashes that contain this tag.

For example use an ISO date format (YYYYMMDDHHMM):



Because all hashes learned during this learn mode will have the classification string "201405161301", you can remove any entry containing this string by using the function "delete hashes by pattern":


You can full text-pattern search (option "all") or only delete hashes where the search string is part of a certain property:


After hashes have been deleted from your whitelist, a list of removed entries will be shown. Carefully look through that list. In case there were more entries deleted than you wanted, don't worry; as long as you don't press the "activate" button, you can still discard your changes by clicking the arrow down button (reload whitelist from server) and start over: