3 of 3 people found this helpful
Pulling back a registry key is easy enough. However you then need to deal with the registry key going away. It is much easier if possible to use something which will allow aging (and removal) of an SI directly, for example a running service or process.
the reason i was looking at this was because we have a number of business apps which don't have running processes or services to use, not many, but i still want to capture them all.
2 of 2 people found this helpful
You can do it but you will need to manage the removal within the pattern.
You can trigger off scanning of the Windows host
on host := created, confirmed Host where os_class = "Windows";
Then you can pass host to discovery.registryKey as the target. You should look at this for choosing appropriate SoftwareInstance key values. There are several example templates for building SoftwareInstances.