Home    SecuLution Dokumentation back next
SecuLution technique and terminology
Quick start
Test setup in 30 minutes
Best practice in everyday use
Full setup and deployment in 5 hours
Installation of components
Install Appliance
AdminWizard installation
Agent installation
Syslog server installation
Initial configuration tasks
Configure basic settings
Agent configuration
Configure automated tasks
Manage whitelist
Initial whitelist generation
Import trustworthy software
Learn mode
Check deployment and learning progress
Add entries to whitelist
Individual lernmode
Import from directory
Log alarms
Cleanup whitelist
Manually delete unused entries
Delete entries using a pattern
Clean up classifications
Managed Whitelist
Managed Whitelist
Referring rules to objects
Offline mode
Offline mode
USB device management
USB device encryption
Agent deployment (RemoteClientManagement)

Manually delete orphaned hashes

SecuLution keeps track of the last date a hash was used. Over time your whitelist will grow and contain hashes that are not needed anymore, because the software has been replaced by newer versions or deleted.

To delete orphaned hashes from your whitelist:


More about the Usage property

Delete hashes automatically

Remember to activate the whitelist afterwards.

This function can (and should) be automatically performed by an automated task. Only hashes that have an "Allow" rule will be deleted.

Sort whitelist view by date of last usage and manually delete hashes

Right-clicking on a folder always offers the option to bulk delete all contained hashes:

Usage property

Importing a hash into the whitelist will set the date of the "usage" property:

In the above example, this version of ieinstal.exe was automatically imported from a WSUS server. During this import, the "usage" property was added and set to the date of the import. Any time the hash is checked (whenever the program is started at a later date than the date in the "usage" property), the "usage" property will be modified with a new date. So in case the hash was never used by anybody, this hash will still have the same "usage" date that it had when the file was added to the whitelist.