DiscoverProducts

Will attempt to discover and detect all known and unknown installed products on the endpoint. This product detection is independent from normal API detection, but results of this method will contain a mixture of known products and the generically detected ones.
Because a single product can come in many versions, installations and other variations, some products will have multiple definitions. Further, generically detected products do not have unique identifiers - and consequently cannot be querried for extraneous information using API methods.Note: this method requires the use of the 'Addon' library (libwaaddon.*).

Syntax

Method ID

#define WAAPI_MID_DISCOVER_PRODUCTS 100001

JSON Input Structure

{
  "input": {
    "method": 100001,
    "running_processes": boolean,
    "install_directories": boolean
  }
}

Input Properties

Parameter	Type	Description
`running_processes`	boolean	(optional) Indicate whether a list of running processes should be shown alongside each product. Default value is 'true'.
`install_directories`	boolean	(optional) Indicate whether a list of product install directories should be shown alongside each product. Default value is 'true'.

JSON Output Structure

{
  "result": {
    "method": 100001,
    "code": number,
    "timing": number,
    "timestamp": string,
    "detected_products": [
      {
        "signature": number,
        "sig_name": string,
        "categories": [
          number,
          ...
        ],
        "install_directories": [
          string,
          ...
        ],
        "running_processes": [
          {
            "process_id": number,
            "file_path": string
          },
          ...
        ],
        "version": string,
        "labels": {
          "<name>": boolean
        },
        "package_family_name": string,
        "product": {
          "name": string,
          "id": number
        },
        "vendor": {
          "name": string,
          "id": number
        }
      },
      ...
    ]
  }
}

Output Properties

Property	Type	Description
`result.method`	number	The method ID that generated this result.
`result.code`	number	The result code. See Result Codes.
`result.timing`	number	The measured time for the method call in milliseconds.
`result.timestamp`	string	The timestamp in seconds of when the call was made.
`result.detected_products`	array<object>	A list of all detected products. If no products are detected for the given category then this will be an empty array.
`result.detected_products.signature`	number	(optional) The unique identifier for a product signature; This key only exists if the product signature is known.
`result.detected_products.sig_name`	string	(optional) The name collected for this signature of the product; This key only exists if the product signature is known.
`result.detected_products.categories`	array<number>	(optional) The product categories identified for this signature of the product; This key only exists if the product signature is known.
`result.detected_products.install_directories`	array<string>	(optional) The product install directories; Only present on products whose directories are known.
`result.detected_products.running_processes`	array<object>	(optional) Running processes that are associated with the product. Only present on products whose installation directories are known.
`result.detected_products.running_processes.process_id`	number	The process id. NOTE: process ids only belong to a process while the process is running. Another process may be assigned this id after the process has been stopped, so this value should not be stored and used long term (at least not without validation).
`result.detected_products.running_processes.file_path`	string	The path to the binary file associated with the running process.
`result.detected_products.product.name`	string	The product name.
`result.detected_products.product.id`	number	(optional) The unique identifier for the product associated with this signature; This key only exists if the product signature is known.
`result.detected_products.vendor.name`	string	The vendor name.
`result.detected_products.vendor.id`	number	(optional) The unique identifier for the vendor of this product; This key only exists if the product signature is known.
`result.detected_products.version`	string	The product version.
`result.detected_products.labels`	object	(optional) The labels for the product. When present, this object MUST include the defined labels pua, toolbar, bloatware, adware, but additional labels may also be present; This key only exists if the product signature is known.
`result.detected_products.labels.<name>`	boolean	(optional) True if the product is classified under this label.
`result.detected_products.package_family_name`	string	(optional) (Windows only) The package family name for Universal Windows Platform (UWP) packages.

Result Codes

Code	Name	Description
0	`WAAPI_OK`	The operation completed successfully.

note

Other codes may be returned. See the full Result Codes reference for the complete list.

Remarks

Error Handling

The results of this function are determined by the error code returned by the call. If successful, WAAPI_OK or a special success code will be returned. Always check both the function return value and the result.code field in the output JSON.

Examples

Examples will be added here demonstrating the usage of this method.

Syntax​

Method ID​

JSON Input Structure​

Input Properties​

JSON Output Structure​

Output Properties​

Result Codes​

Remarks​

Error Handling​

Examples​

See Also​