Jump to content

Getting Automate to show Palo Alto Traps as AV

Recommended Posts

Hello, sorry for my ignorance... I'm new to Automate....  The attached is my config for TRAPS AV.... the Monitors showing NO AV...

Does all the fields have to match in order for a good detection?  Basically what if I just check to see if the process is running, if it runs, monitor should display "Palo Alto AV"

any help would be greatly appreciated... ty


Name:  Palo Alto Traps

Program Location:       "%programfiles%\Palo Alto Networks\Traps\cytool.exe"

Def Location:  {%-HKLM\SOFTWARE\Cyvera\Client:Product Version-%}

Update cmd:  "%programfiles%\Palo Alto Networks\Traps\cytool.exe"   (couldn't find it, so I put the same as program location...)

version check:  {%-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\E5DA19C5737C8344D9FE02D6D5808099\InstallProperties:DisplayVersion-%}

AP Process:   cyserver*

Date Mask:  (.*)



Share this post

Link to post
Share on other sites
Posted (edited)

Here's my definition (any fields which aren't mentioned below are left as blank):

  • Name: Palo Alto Traps
  • Program Location: %programfiles%\Palo Alto Networks\Traps\CyveraService.exe
  • Definition Location: %programdata%\Cyvera\LocalSystem\ClientPolicy.xml
  • Version Check: {%-HKLM\SOFTWARE\Cyvera\Client:Product Version-%}
  • AP Process: CyveraService*
  • Date Mask: (.*)
Edited by zfx0

Share this post

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...