RocketCyber Apps

RocketCyber Application Inventory

Overview

RocketCyber tracks applications detected across managed endpoints through its agent telemetry. The application inventory provides visibility into what software is installed and running in customer environments, supporting security compliance, threat investigation, and software governance.

Key capabilities:

• Application Discovery - Automatic detection of installed and running applications
• Categorization - Applications categorized by type and risk level
• Compliance Monitoring - Track approved vs unapproved software
• Threat Context - Application data provides context during incident investigation
• Per-Account Inventory - Software inventory scoped to individual customer accounts

Anti-triggers

• Installed-software inventory for patching or licence counts — the RMM audit is the fuller inventory; use datto-rmm-audit.
• Whether the sensor reporting the apps is healthy — use rocketcyber-agents.
• An application the SOC has acted on — that is an incident; use rocketcyber-incidents.

Key Concepts

Application Detection

RocketAgent continuously monitors endpoints and reports detected applications back to the RocketCyber platform. Detection covers:

• Installed applications - Software present on the system
• Running processes - Active applications and services
• Browser extensions - Web browser add-ons (verify against API docs)
• Services - Windows services and daemons (verify against API docs)

Application Categories

Applications may be categorized by type (verify categories against API docs):

Security Relevance

Application inventory matters for security because:

• Unauthorized remote access tools (e.g., unexpected TeamViewer) may indicate compromise
• Missing security software (e.g., no AV present) indicates coverage gaps
• Shadow IT applications may introduce vulnerabilities
• Outdated software may have known CVEs

Field Reference

Note: Field names are inferred from common SOC platform conventions. Verify exact field names against RocketCyber API responses.

API Patterns

List Applications by Account

# Applications for a specific customer
curl -s "https://api-${ROCKETCYBER_REGION:-us}.rocketcyber.com/v3/apps?accountId=12345" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Response (verify against API docs):

{
  "data": [
    {
      "id": 7001,
      "name": "TeamViewer",
      "version": "15.40.0",
      "publisher": "TeamViewer GmbH",
      "category": "Remote Access",
      "accountId": 12345,
      "hostname": "WORKSTATION-01",
      "detectedAt": "2026-01-15T08:00:00Z",
      "lastSeen": "2026-02-23T09:00:00Z"
    },
    {
      "id": 7002,
      "name": "Windows Defender",
      "version": "4.18.24010",
      "publisher": "Microsoft",
      "category": "Security",
      "accountId": 12345,
      "hostname": "WORKSTATION-01",
      "detectedAt": "2025-06-15T09:00:00Z",
      "lastSeen": "2026-02-23T09:00:00Z"
    }
  ],
  "totalCount": 150,
  "page": 1,
  "limit": 50
}

List All Applications (Provider-Wide)

# All applications across all customer accounts
curl -s "https://api-us.rocketcyber.com/v3/apps" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Common Workflows

Unauthorized Software Audit

1. List all applications across accounts (or for a specific account)
2. Filter for remote access tools -- TeamViewer, AnyDesk, LogMeIn, Splashtop, etc.
3. Cross-reference against approved remote access policy
4. Flag unauthorized remote access tools for investigation
5. Check incidents -- correlate with any security incidents on the same endpoints

Security Software Coverage

1. List all agents for a customer account
2. List all applications for the same account
3. For each agent/endpoint, check for required security tools:
   • Antivirus / EDR present
   • Backup agent present
   • Patch management agent present
4. Report gaps where required software is missing

Application Inventory Report

1. Query applications by account
2. Group by category
3. Count unique applications per category
4. Identify most common applications
5. Flag any known-vulnerable software versions

Incident Investigation Context

When investigating a security incident:

1. Get the affected device hostname from the incident
2. Query applications for that endpoint
3. Check for suspicious applications:
   • Unexpected remote access tools
   • Hacking tools or penetration testing software
   • Cryptocurrency miners
   • Unauthorized VPN software
4. Note recently detected applications (may correlate with incident timeline)

Error Handling

Common Errors

No Applications Found

No applications found for account ID 12345.

This could mean:
- Agents have not yet reported application data
- No agents are deployed to this customer
- The account ID is incorrect (verify with /accounts endpoint)

Related Skills

• api-patterns - Authentication, pagination, error handling
• agents - Agents that report application telemetry
• incidents - Application context during incident investigation
• accounts - Account scoping for application queries