Software Secure Workload
Activity Configure

Windows Packages and CVEs

Following section lists the behavior of Windows agent with regard to reporting package information to Secure Workload.

  • Windows applications, PowerShell, IE are reported as packages. .net framework is also reported as a package.

  • Other Windows applications like notepad.exe, cmd.exe, mstsc.exe, and so on are not reported.

  • Windows server configured roles and features are reported as packages but the version may be incorrect. For example: If the DNS server is configured, reported version will either 0 or 8.

  • Windows agent reports 3rd party products installed using MSI installer or exe installer:

    • For MSI installers, MSI APIs are used to retrieve package information. For example, version, publisher, package name.

    • If the exe installer is used to install the package, package information is retrieved from the registry.

    • Package installer fields like version, publisher is optional. If version is missing, the package will not be reported.

    • If a product is extracted from zip file or installed as an app, it will not be reported in the package list.