Cortex XDR Software Inventory

[TylerAtkinson]

Hello,

I am curious as to what data Cortex XDR pulls to put together a software inventory list. I am trying to create a script to uninstall a program on an endpoint and the last resort method the script does is deleting all program files (both in Program files folder and the user's appdata folders) and deleting all registry keys in the HKEY_LOCAL_MACHINE tree. When I run this on Zoom, however, the program still shows up in Cortex's software inventory for that endpoint, so I am wondering what data Cortex looks at to put together that list so I can delete the program from that list with this script. Thanks for any information!

[Rocky-25]

Hi Tyler

I guess Cortex uses the same as Windows itself:

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall

HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall

HKCU\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall

How to Manually Remove Programs from the Add/Remove Programs List - Microsoft Support

I hope that helps. Best Regards