Visibility
Endpoint software inventory
Know what software is actually installed on endpoints and servers, with scan evidence you can inspect—not a spreadsheet of last quarter’s guesses.
Collect package and SBOM evidence from eligible agents into a living software inventory on each device—bounded scans, fleet profiles, and a Software tab operators can trust for remediation.
Collection is separate from vulnerability matching
Agents and inventory scanners own package and SBOM collection. Vulnerability intelligence producers own feeds and advisory normalization. The control plane owns matching, risk scoring, and how findings show up next to inventory. That split keeps scanners simple and lets threat feeds evolve without rewriting collection.
- Bounded inventory payloads submitted through the edge agent path
- Package rows and optional CycloneDX SBOM artifacts retained as evidence
- OCSF scan activity for audit and diagnostics
- Matching runs centrally—agents do not download CVE feeds
Fleet profiles instead of one-off agent chores
Endpoint inventory profiles use SRQL to define which agents should run software collection. Reconcile the profile and ServiceRadar assigns the inventory capability to eligible connected agents—so operators are not hand-wiring every host after a cohort change.
- Target cohorts with SRQL (whole fleet or a narrow hostname pattern)
- Reconcile once; assignments follow connected eligible agents
- Manual assignment remains available for break-glass testing
- Device Software tab shows latest scan, packages, diagnostics, and artifact hashes
Evidence you can debug when counts look wrong
If a scan reports many packages but few rows load, operators need to tell “scanner found nothing” from “scanner found packages but persistence did not keep them.” ServiceRadar surfaces source diagnostics, package-set hashes, artifact hashes, and upload reasons so inventory problems are operable.
- Source diagnostics for failed package managers or truncated output
- Package-set and artifact hashes to confirm new evidence
- Scan summaries next to current package rows
- Durable SBOM objects with content-addressed storage for re-inspection
Ready for security workflows
Software inventory is useful on its own for asset truth. It is also the input to vulnerability matching: once packages are current, threat-intelligence feeds can score high-risk software without a second discovery pass.
- Device-scoped package coordinates for accurate matching
- Feeds and matching covered on the threat intelligence solution
- Works alongside container and detection findings in the security experience
- Open-source platform you can inspect and self-host
FAQs
Do agents download NVD or other CVE feeds?
No. Agents collect inventory only. Vulnerability feed download, validation, and matching run as separate intelligence producers and control-plane matching—not on every endpoint.
How do we choose which hosts get scanned?
Create an endpoint inventory profile with an SRQL target query, enable it, and reconcile. Eligible connected agents receive the inventory assignment automatically.
Where do operators look at results?
Open a device Software tab for packages, scan evidence, and vulnerability matches. Security dashboards and findings views provide fleet triage.
Where are the technical docs?
Data path, profiles, feeds, and matching are documented in the Endpoint Software Security docs .