https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-software-inventory/m-p/571787#M5838 <P>Hello,</P> <P>I am curious as to what data Cortex XDR pulls to put together a software inventory list. I am trying to create a script to uninstall a program on an endpoint and the last resort method the script does is deleting all program files (both in Program files folder and the user's appdata folders) and deleting all registry keys in the HKEY_LOCAL_MACHINE tree. When I run this on Zoom, however, the program still shows up in Cortex's software inventory for that endpoint, so I am wondering what data Cortex looks at to put together that list so I can delete the program from that list with this script. Thanks for any information!</P> Thu, 04 Jan 2024 15:21:03 GMT TylerAtkinson 2024-01-04T15:21:03Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-software-inventory/m-p/571787#M5838 <P>Hello,</P> <P>I am curious as to what data Cortex XDR pulls to put together a software inventory list. I am trying to create a script to uninstall a program on an endpoint and the last resort method the script does is deleting all program files (both in Program files folder and the user's appdata folders) and deleting all registry keys in the HKEY_LOCAL_MACHINE tree. When I run this on Zoom, however, the program still shows up in Cortex's software inventory for that endpoint, so I am wondering what data Cortex looks at to put together that list so I can delete the program from that list with this script. Thanks for any information!</P> Thu, 04 Jan 2024 15:21:03 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-software-inventory/m-p/571787#M5838 TylerAtkinson 2024-01-04T15:21:03Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-software-inventory/m-p/571898#M5841 <P>Hi Tyler</P> <P>&nbsp;</P> <P>I guess Cortex uses the same as Windows itself:</P> <P><SPAN>HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall</SPAN></P> <P><SPAN>HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall</SPAN></P> <P><SPAN>HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall</SPAN></P> <P><SPAN>HKCU\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall</SPAN></P> <P>&nbsp;</P> <P><SPAN><A href="https://support.microsoft.com/en-au/topic/how-to-manually-remove-programs-from-the-add-remove-programs-list-49494159-d215-07b2-e4c7-050457b38352" target="_blank">How to Manually Remove Programs from the Add/Remove Programs List - Microsoft Support</A></SPAN></P> <P>&nbsp;</P> <P><SPAN>I hope that helps. Best Regards</SPAN></P> Fri, 05 Jan 2024 09:48:34 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-software-inventory/m-p/571898#M5841 Rocky-25 2024-01-05T09:48:34Z