Getting Automate to show Palo Alto Traps as AV

[yosinyc 0]

Hello, sorry for my ignorance... I'm new to Automate....  The attached is my config for TRAPS AV.... the Monitors showing NO AV...

Does all the fields have to match in order for a good detection?  Basically what if I just check to see if the process is running, if it runs, monitor should display "Palo Alto AV"

any help would be greatly appreciated... ty

 

Name:  Palo Alto Traps

Program Location:       "%programfiles%\Palo Alto Networks\Traps\cytool.exe"

Def Location:  {%-HKLM\SOFTWARE\Cyvera\Client:Product Version-%}

Update cmd:  "%programfiles%\Palo Alto Networks\Traps\cytool.exe"   (couldn't find it, so I put the same as program location...)

version check:  {%-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\E5DA19C5737C8344D9FE02D6D5808099\InstallProperties:DisplayVersion-%}

AP Process:   cyserver*

Date Mask:  (.*)

 

[zfx0 0]

Here's my definition (any fields which aren't mentioned below are left as blank):

• Name: Palo Alto Traps
• Program Location: %programfiles%\Palo Alto Networks\Traps\CyveraService.exe
• Definition Location: %programdata%\Cyvera\LocalSystem\ClientPolicy.xml
• Version Check: {%-HKLM\SOFTWARE\Cyvera\Client:Product Version-%}
• AP Process: CyveraService*
• Date Mask: (.*)

Edited August 30 by zfx0

[yosinyc 0]

Sorry for the late response, thank you for sharing I will give it a shot & give feedback... ty