Skip to content
Lockstep VM Docs

Software inventory

Software inventory rolls every installed application discovered across your sources into one per-tenant list. It lives at Inventory → Software (/applications); clicking a row opens the application detail at /application/<name>.

How software is grouped

The list is a rollup built from inventory_items. Rows are grouped by application name, and for each group the backend computes a distinct device count, per-version device counts (for version tracking), the set of observed platforms, and the set of sources the software was seen from (SentinelOne / Intune / Rapid7 / CSV). The displayed vendor is the dominant one — the vendor spelling seen on the most devices.

Per-install instance-id normalization

Some agents append a per-install id or hash to the application name, which would otherwise create one software row per machine. The rollup strips trailing hexadecimal / GUID parentheticals so those variants merge into a single group:

ScreenConnect Client (51a7836ecd7be670)  →  ScreenConnect Client
ConnectWise Control (a1b2c3d4-....)       →  ConnectWise Control
7-Zip 22.01 (x64)                         →  7-Zip 22.01 (x64)   ← kept: "x64" is not a hex id

Meaningful parentheticals like (x64), (en-us), or (64-bit) are deliberately preserved.

The Software list

Columns: Name (links to the detail page), Asset Count, Vendor, Product, Version (shows the first version, plus +N when several exist), and Site.

  • The search box matches software groups by name (Enter or Search).
  • Query builder filters on an allow-listed field set: General (name, vendor, product, version, device_count, site) plus Intune-sourced metadata (publisher, platform, size_bytes, category, install_status). See the Frontend reference.
  • Results paginate (20 / 50 / 100 / 200 per page); search/page/query are synced to the URL and shareable via Copy query URL.
  • Import / Integrate menus deep-link to the Upload Data flow and the source integration pages.

The application detail page

Summary cards

Total Versions, Devices (installations), Most Common version, and Vulnerabilities (known CVEs — links through to Vulnerabilities). A row of Discovered via chips shows which integrations reported the app (SentinelOne, Rapid7, Microsoft Intune, ConnectWise, CSV Import, Jamf).

Version distribution & version tracking

A highlighted band surfaces the three tracked versions from the rollup’s version_tracking:

FieldMeaning
NewestHighest version string observed
Most CommonVersion installed on the most devices
OldestLowest version string observed

Below it, a Version table lists every installed version with a status badge (Most Common / Newest / Oldest / Active). Select one or more versions and click Scan to launch a per-version CVE scan (POST /vulnerabilities/scan with enrichment enabled).

Recent scans, linked devices & platforms

  • Recent Vulnerability Scans — prior scans for the app, each showing the scanned version, date, total vulnerabilities, and Critical/High counts; clicking one opens the scan detail.
  • Installed on Devices — the machines carrying the app (from /devices/by-application), with user, version, OS, and source chips; each device name links to its asset detail.
  • Platforms — the operating systems the app was observed on.