# Documentation Nexus IQ Server 1.26

## 9.9. Proprietary Component Configuration

Proprietary components are unique or internal to your organization. When you evaluate an application that uses proprietary components, IQ Server is unlikely to find data about those components; they are probably listed under “Unknown” on the “Policy Violations” tab in the Application Composition Report. However, you can configure IQ Server to recognize those components as proprietary.

When you configure proprietary components, you use system hierarchy levels to set the scope for identifying the components:

- Root Organization - Identifies proprietary components in every organization and application.
- Organization - Identifies proprietary components in a particular set of applications.
- Application - Identifies proprietary components in a single application.

You also specify a string search pattern called a _proprietary component matcher_ that IQ Server uses to find proprietary components. If matching components are found, they are displayed under _Proprietary_ on the _Policy_ _Violations_ tab in the Application Composition Report. There are two types of proprietary component matchers: _Package_ and _Regular Expression_, which are described below.

**Package Matchers**

For _Package_, you specify a package name, for example, `com.sonatype`. In this case, all components that contain a package `com/sonatype` will be marked as proprietary. You should be as specific as possible, for the provided package is compared greedily against your scanned binaries. For instance, `com.sonatype` will match all of the following content locations:

- com/sonatype
- com/sonatype/anything
- com/sonatype/anything/more
- shaded/and/relocated/com/sonatype
- shaded/and/relocated/com/sonatype/anything

On the other hand, the following locations will not be matched:

- org/sonatype
- com/sonatypestuff
- com/sonatypestuff/anything

**Regular Expression Matchers**

For _Regular Expression_, you specify a regular expression that will be compared against the paths of all files scanned. If a file is found in the path, it is flagged as proprietary. For example, `test\.zip` will recognize anything in the top level directory named test.zip as proprietary. If you wanted to find test.zip nested anywhere in the scanned binaries, use ".*/test\.zip".

| ![[Note]](https://books.sonatype.com/sonatype-clm-book/1.26/html/book/images/icons/note.png) |  |
| --- | --- |
| Occurrences inside an identified archive will make the binary proprietary as well. For example, if a proprietary `.zip` is found inside a `.jar`, the `.jar` is also considered proprietary. |

For more information on regular expressions, see [Oracle’s Java documentation](http://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html).

To configure proprietary components:

1. Click the _Organizations & Policies_ icon  
    on the IQ Server toolbar.
2. In the sidebar, select the desired organization or application.
3. In the _Policies_ section, under _Proprietary Component Configuration_, click the chevron next to the number of matchers (local and/or inherited).
4. In the Proprietary Component Configuration view, add or remove matchers as desired. To add, select a _Package_ or _Regular Expression_ matcher type and enter a string search value. To remove, click the Delete icon (looks like a trash can) for items in the _Local_ section.
5. Click _Update_ to modify IQ Server’s list of proprietary component matchers for the selected organization or application.

**Figure 9.13. Proprietary Component Configuration**

### Usage Suggestions for Proprietary Components

Once proprietary components are configured, you can use a policy to prevent them from triggering policy violations. There is an example of this in the [Sonatype Sample Policy Set](https://books.sonatype.com/sonatype-clm-book/1.26/html/book/policy-getting-started.html#sample-policy-set "9.2.1. Downloading the Sample Policy Set"); the _Component-Unknown_ policy has the following constraint:

The policy is in violation if _all_ of the following are true:

- _Match State_ is _Unknown_
- _Proprietary_ is _false_

This constraint excludes proprietary components from triggering policy violations.