Getting Automate to show Palo Alto Traps as AV

[yosinyc 0]

Hello, sorry for my ignorance... I'm new to Automate....  The attached is my config for TRAPS AV.... the Monitors showing NO AV...

Does all the fields have to match in order for a good detection?  Basically what if I just check to see if the process is running, if it runs, monitor should display "Palo Alto AV"

any help would be greatly appreciated... ty

 

Name:  Palo Alto Traps

Program Location:       "%programfiles%\Palo Alto Networks\Traps\cytool.exe"

Def Location:  {%-HKLM\SOFTWARE\Cyvera\Client:Product Version-%}

Update cmd:  "%programfiles%\Palo Alto Networks\Traps\cytool.exe"   (couldn't find it, so I put the same as program location...)

version check:  {%-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\E5DA19C5737C8344D9FE02D6D5808099\InstallProperties:DisplayVersion-%}

AP Process:   cyserver*

Date Mask:  (.*)