Forum Discussion
How is the software inventory created in MDATP?
philippwreeI am not 100% sure about the functionality, so I also hope for a deep dive answer.
But as far as I understood from documentation and the last webinars is, that the software inventory depends on the EDR system.
Defender ATP is a discovery and not a scanning system, which means, that software can only be detected if the software produces an event in your logs.
The Docs also tell this a little bit, but not clear enough: https://docs.microsoft.com/de-de/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory#funktionsweisehow-it-works
So if you are missing a software maybe it was not used yet. But if you use the software on a daily basis, than Microsoft should clarify this.
NiklasM Thanks, I'll check it out.
Unfortunately this was not the solution. I have used some of the missing applications extensively, but they were still not listed in the software inventory.
Additionally I noticed that the product code (CPE) in the individual software inventory of a device is set to "not available", but when I export the software inventory the product code is available.
Dashboard:
Dashboard
Export:
Export
Gilad_Mittelman Tomer Teller Efrat Kliger Maybe you can assist here? Or you have an Microsoft college with the appropriate information.
