| name | audit-software |
| disable-model-invocation | true |
| argument-hint | [software_name] [location_or_department] |
| description | Audit software inventory across devices using ZDX data for compliance and vulnerability assessment. |
Audit Software Inventory
Audit software: $ARGUMENTS
Step 1: Parse Input
Extract:
- Software name (optional -- list all if not provided)
- Filter: location, department, or user (optional)
Step 2: List Software Inventory
zdx_list_software()
```text
If a specific software was requested, filter the results.
## Step 3: Drill Into Specific Software
For targeted investigation:
```text
zdx_get_software_details(software_key="<software_name_and_version>")
```text
Check version distribution across devices.
## Step 4: Check Device Details
For devices with outdated or concerning software:
```text
zdx_list_devices(search="<filter>")
zdx_get_device(device_id="<id>")
```text
## Step 5: Present Report
**ALWAYS present data in HTML tables** in the chat response using `<table>`, `<thead>`, `<tbody>`, `<tr>`, `<th>`, `<td>` tags with inline styling. Use color-coded rows: green (current), yellow (one version behind), red (EOL/vulnerable).
Include:
1. **Software inventory table** (software name, version(s), device count, status, risk level)
2. **Compliance summary table** (up to date count/%, one version behind count/%, EOL count/%)
3. **Detailed analysis** explaining the compliance posture, version distribution patterns, and geographic concentration of outdated software
4. **Security assessment** for each EOL/vulnerable entry with risk explanation
5. **Next steps / resolution** prioritized by risk:
- Critical (EOL): immediate upgrade plan, MDM push, maintenance windows
- High (known CVEs): cross-reference with CVE data, prioritize sensitive departments
- Medium (one version behind): schedule automated updates
- Low (current): verify auto-update policies
## Step 6: Generate Downloadable Artifacts — MANDATORY
**You MUST create BOTH files. Do NOT skip the HTML page.**
1. **Word document** (`software_inventory_audit_<date>.docx`): Executive summary, full inventory table, security findings, prioritized recommendations.
2. **Interactive HTML page** (`software_inventory_audit_<date>.html`): Use the complete HTML template from the `zdx-audit-software-inventory` skill. The file must be fully functional with working search bar, sortable columns, filter dropdowns, color-coded rows, summary dashboard, and CSV export button. All CSS and JavaScript inline — no external dependencies. Populate the `<tbody>` with one `<tr>` per software entry from the collected data.
**Write both files to disk and provide the file paths to the user.**
