Jun 08 2020 03:06 AM
Can anyone tell me exactly how the software inventory is created in MDATP? We have about 600 packaged applications, but only 200 are shown in the software inventory. When I look at the software inventory directly on a client, everything is correct. But I noticed that the global software inventory only shows applications that have a "Product Code (CPE)". How is this product code generated or where does it come from? And why do only about one third of my applications have this code? Even many Microsoft products do not have this code.
Jun 08 2020 04:03 AM
@philippwreeI am not 100% sure about the functionality, so I also hope for a deep dive answer.
But as far as I understood from documentation and the last webinars is, that the software inventory depends on the EDR system.
Defender ATP is a discovery and not a scanning system, which means, that software can only be detected if the software produces an event in your logs.
The Docs also tell this a little bit, but not clear enough: https://docs.microsoft.com/de-de/windows/security/threat-protection/microsoft-defender-atp/tvm-softw...
So if you are missing a software maybe it was not used yet. But if you use the software on a daily basis, than Microsoft should clarify this.
Jun 08 2020 11:58 PM
@NiklasM Thanks, I'll check it out.
Jun 17 2020 04:13 AM
Unfortunately this was not the solution. I have used some of the missing applications extensively, but they were still not listed in the software inventory.
Additionally I noticed that the product code (CPE) in the individual software inventory of a device is set to "not available", but when I export the software inventory the product code is available.
Dashboard:
Export:
Jun 19 2020 01:48 AM
@Gilad_Mittelman @Tomer Teller @Efrat Kliger Maybe you can assist here? Or you have an Microsoft college with the appropriate information.
Jun 21 2020 03:34 AM
@philippwree - Thank you for the feedback. Your analysis is accurate.
We currently do not reflect Non-CPE products in the main software inventory page, this is planned to be fixed in the upcoming months.
Jul 14 2020 10:10 AM
@Tomer Tellersorry for chasing you, but can you please explain if few more sentences the ent-to-end process of https://securitycenter.microsoft.com/software-inventory and https://securitycenter.microsoft.com/vulnerabilities get collected? Frequency, timeouts, does it uses Windows Update or registry, etc.
Is there a blog or webinar from the Microsoft explaining this subject so you do not repeat the information? We have customer questions while official Microsoft documentation does not have any details at all. Best regards Serg.
Jul 07 2021 07:55 PM
Jul 13 2021 10:04 AM
Please find below the answers to the questions asked :
TVM Software Inventory data freshness is currently 3-4h (upper limit, can also be less).
Please refer the below screenshots for the information :
There is no command line or powershell or anything else to trigger an inventory scan/update.
In addition to that if you have any further queries regarding the issue, please let me know.
Appreciate your time and patience.
Awaiting your reply.
With Best Regards,
Truptesh Fulpagare | Microsoft Security
v-tfulpagare@microsoft.com | +1-425-704-3638 Ext: 2261221 | Mon-Fri: 07:30 PM – 05:00 AM IST
Backup Engineer: Hrudyesh Bagde | v-hrbagd@microsoft.com | Mon-Fri: 07:30 PM – 05:00 AM IST
Manager: Anirudh Palit | v-2anpal@microsoft.com | Mon-Fri: 05:00 AM – 02:30 PM EST
Team Callback Request email (monitored 24/7): secPro-EP@microsoft.com
Oct 05 2021 12:51 AM
Oct 05 2021 12:54 AM
@philippwree - While this capability was indeed deferred in previous releases the good news that it will land in this Q4.
Oct 04 2022 09:05 AM
@byertjames Where is the link to this screen shot?
Oct 05 2022 01:05 PM
That screenshot was from the old version of the website now rolled into Microsoft 365 Defender
Software inventory in Defender Vulnerability Management | Microsoft Learn
I believe this direct link can take you there
https://security.microsoft.com/vulnerability-management-inventories/applications
You now have to select the relevant row and in the side pane click on report inaccuracy as needed.