Home    SecuLution Dokumentation back next
Welcome
SecuLution technique and terminology
Quick start
Test setup in 30 minutes
Best practice in everyday use
Full setup and deployment in 5 hours
Installation of components
Install Appliance
AdminWizard installation
Agent installation
Syslog server installation
Initial configuration tasks
Configure basic settings
Agent configuration
Configure automated tasks
Manage whitelist
Initial whitelist generation
Import trustworthy software
Learn mode
Check deployment and learning progress
Audit
Add entries to whitelist
Drag'n'drop
Individual lernmode
Import from directory
PermanentLernUser
Log alarms
Cleanup whitelist
Manually delete unused entries
Delete entries using a pattern
Clean up classifications
Managed Whitelist
Managed Whitelist
Actions
Actions
Referring rules to objects
Offline mode
Offline mode
Devices
USB device management
USB device encryption
RCM
Agent deployment (RemoteClientManagement)
ArpWatch
ArpWatch
Logs
Logs
FAQ
setup.ini

How do I clean up the classifications?

Problem:
Your ruleset contains unstructured classifications:

Solution:
Use "search/replace" in your whitelist to cleanup the classifications. The backup of the whitelist is a plaintext file and can be modified using text-tools (like notepad, grep, sed).

Example how to cleanup classifications in Notepad++:

  • Start the AdminWizard
  • Select menu "View/Rules/by classification" or click on the 4th radio button
  • Wait until database updates have been completed (if applicable)
  • Create a backup of the whitelist (menu "file/save as", filename "A.ssf")
  • Open "A.ssf" in Notepad++
  • Press CTRL-H or menu "Search/Replace"
  • Choose "Regular expression"
  • In "Find what" enter (including "^" and "$"):
    ^-204:0\.0\.0\.0\/0:0\.0\.0\.0\/0:text%20o%20search.*$
    
  • Geben Sie in "Ersetzen" / "Replace with" folgenden Text ein (incl "-" und "."):
    -204:0.0.0.0/0:0.0.0.0/0:text%20to%20replace.
    
  • Click on "Replace all"
  • Close the search/replace dialog
  • Save (Menu "File/Save as") filename "B.ssf"
  • Import file "B.ssf" into the Admin-Wizard, (Menu "File/open")
  • Select menu "View/Rules/by classification" or click on the 4th radio button
This way you can create a clean structure of all software in your Whitelist.


To modify other classifications, use shift/ctrl key and select the entries of which you want to change the classifactions, then right-click and choose "change classification":