Cortex XDR Software Inventory

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Cortex XDR Software Inventory

L0 Member

Hello,

I am curious as to what data Cortex XDR pulls to put together a software inventory list. I am trying to create a script to uninstall a program on an endpoint and the last resort method the script does is deleting all program files (both in Program files folder and the user's appdata folders) and deleting all registry keys in the HKEY_LOCAL_MACHINE tree. When I run this on Zoom, however, the program still shows up in Cortex's software inventory for that endpoint, so I am wondering what data Cortex looks at to put together that list so I can delete the program from that list with this script. Thanks for any information!

1 REPLY 1

L2 Linker

Hi Tyler

 

I guess Cortex uses the same as Windows itself:

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall

HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall

HKCU\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall

 

How to Manually Remove Programs from the Add/Remove Programs List - Microsoft Support

 

I hope that helps. Best Regards

  • 210 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!