updated

docs/ninjaone/automations/installed-remote-tools-audit.md

@@ -9,7 +9,7 @@ tags: ['windows', 'auditing', 'security']
 draft: false
 unlisted: false
 last_update:
-  date: 2026-06-24
+  date: 2026-07-23
 ---
 
 ## Overview
@@ -72,7 +72,8 @@ Tool display names supported by this script:
 ## Dependencies
 
 - [Solution - Installed Remote Access Tool Audit](/docs/eae2fab9-4697-4e1e-ad8f-93f8a09d7056)
-- [Custom field - cPVAL Installed Remote Access Tools](/docs/62487ab1-8f55-426d-8127-f0ba0fcf4f66)
+- [Custom field - cPVAL Installed Remote Access Tools](/docs/62487ab1-8f55-426d-8127-f0ba0fcf4f66)'
+- [Custom field - cPVAL Detected Remote Tool Names](/docs/6238b6b2-1e19-4840-8f54-0d952a694c8a)
 
 ## Parameters
 
@@ -91,6 +92,11 @@ Tool display names supported by this script:
 
 ## Changelog
 
+### 2026-07-23
+
+- Added a new Multi-Line Text Custom Field `cPVAL Detected Remote Tool Names` to store only the names of detected remote access tools as a simple list.
+- Updated the PowerShell script to extract tool names and populate the new text field, enabling the data to be used for dynamic grouping and exports (which is not possible with the existing WYSIWYG field).
+
 ### 2026-06-24
 
 - Added more remote tools for detection and updated the powershell script to check processes, services and executable paths along with registries for remote tools.

docs/ninjaone/custom-fields/cpval-detected-remote-control-names.md

@@ -0,0 +1,42 @@
+---
+id: '6238b6b2-1e19-4840-8f54-0d952a694c8a'
+slug: /6238b6b2-1e19-4840-8f54-0d952a694c8a
+title: 'cPVAL Detected Remote Tool Names'
+title_meta: 'cPVAL Detected Remote Tool Names'
+keywords: ['installed-tools', 'remote-access', 'remote-access-tools-auditing']
+description: 'This custom field stores the remote management applications list.'
+tags: ['windows', 'auditing', 'security']
+draft: false
+unlisted: false
+last_update:
+  date: 2026-07-23
+---
+
+## Summary
+
+This custom field stores the remote management applications list names gathered by the script [Installed Remote Tools Audit](/docs/8111fecc-61de-4c72-933c-b719351b7a1e).
+
+## Details
+
+| Label | Field Name | Definition Scope | Type | Required | Default Value | Available Options | Technician Permission | Automation Permission | API Permission | Description | Tool Tip | Footer Text | Custom Field Tab Name |
+| ----- | ---- | ---------------- | ---- | -------- | ------------- | --------------------- | --------------------- | -------------- | ----------- | -------- | ----------- | ----------- | ----------- |
+| cPVAL Detected Remote Tool Names | cpvalDetectedRemoteToolNames | `Organization`, `Location`, `Device` | Multi-Line | False | False | | Editable | Read_Write | Read_Write | Shows detected remote access tool names. | This field is automatically populated by the Remote Tool Audit script. It contains a list of remote control software names (e.g., AnyDesk, TeamViewer) detected on this device. It can be used for dynamic grouping and exports. | Populated automatically during the Remote Access Tool audit. | Remote Access Tools |
+
+## Dependencies
+
+- [Solution - Installed Remote Access Tool Audit](/docs/eae2fab9-4697-4e1e-ad8f-93f8a09d7056)
+- [Script - Installed Remote Tools Audit](/docs/8111fecc-61de-4c72-933c-b719351b7a1e)
+
+## Custom Field Creation
+
+- [Custom Field Configuration](https://github.com/ProVal-Tech/ninjarmm/blob/main/custom-fields/cpval-detected-remote-control-names.toml)
+
+## Sample Screenshot
+
+![Sample Screenshot](../../../static/img/docs/6238b6b2-1e19-4840-8f54-0d952a694c8a/remote.webp)
+
+## Changelog
+
+### 2026-07-23
+
+- Initial version of the document

docs/solutions/installed-remote-tools-audit-ninja.md

@@ -63,6 +63,7 @@ Tool display names supported by this script:
 | [cPVAL Enable Remote Tools Detection](/docs/175e9426-65df-4a50-a0d6-e134fa9d9651)  | Custom Field | Custom field to select the required platform to start detecting Unauthorized remote tools. |
 | [cPVAL Whitelisted Remote Access Tools](/docs/d345df22-5ef0-4da0-8d71-bcfe53c2fe47)  | Custom Field | Custom filed to define an optional comma-separated list of remote access tool display names to exclude from detection. |
 | [cPVAL Installed Remote Access Tools](/docs/62487ab1-8f55-426d-8127-f0ba0fcf4f66)  | Custom Field | Custom field stores the remote management applications list gathered by the script [Installed Remote Tools Audit](/docs/8111fecc-61de-4c72-933c-b719351b7a1e). |
+| [Custom field - cPVAL Detected Remote Tool Names](/docs/6238b6b2-1e19-4840-8f54-0d952a694c8a)  | Custom Field | Custom field stores the remote management applications list names gathered by the script [Installed Remote Tools Audit](/docs/8111fecc-61de-4c72-933c-b719351b7a1e). |
 | [Installed Remote Tool Audits](/docs/8111fecc-61de-4c72-933c-b719351b7a1e)  | Automation | Script to audit Windows endpoint for known remote access tools using multiple detection methods. |
 | [Unauthorized Remote Tools](/docs/d733a553-e69b-4c4e-b209-f05102bae6e5)  | Ticket Template | This ticket template configures how a ConnectWise Manage ticket will be generated in response to the [Audit Installed Remote Tools - Workstation](/docs/05f4af3f-1f26-4080-aec5-fc9bbc0df5fc) and [Audit Installed Remote Tools - Server](/docs/3ed66f5a-e52f-4f79-a8c0-783597a4d439) compound conditions. |
 | [Audit Installed Remote Tools - Workstation](/docs/05f4af3f-1f26-4080-aec5-fc9bbc0df5fc)  | Compound Condition | Triggers the [Installed Remote Tools Audit](/docs/8111fecc-61de-4c72-933c-b719351b7a1e) automation on Windows workstations where deployment is enabled. |
@@ -77,6 +78,7 @@ Tool display names supported by this script:
     - [cPVAL Enable Remote Tools Detection](/docs/175e9426-65df-4a50-a0d6-e134fa9d9651)
     - [cPVAL Whitelisted Remote Access Tools](/docs/d345df22-5ef0-4da0-8d71-bcfe53c2fe47) 
     - [cPVAL Installed Remote Access Tools](/docs/62487ab1-8f55-426d-8127-f0ba0fcf4f66)
+    - [Custom field - cPVAL Detected Remote Tool Names](/docs/6238b6b2-1e19-4840-8f54-0d952a694c8a)
 2. Create the [Automation - Installed Remote Tool Audits](/docs/8111fecc-61de-4c72-933c-b719351b7a1e) 
 3. Create the Ticket template: [Unauthorized Remote Tools](/docs/d733a553-e69b-4c4e-b209-f05102bae6e5)
 4. Create the below Compound Conditions using the implementation instruction provided in the documents.
@@ -93,6 +95,11 @@ Tool display names supported by this script:
 
 ## Changelog
 
+### 2026-07-23
+
+- Added new Multi-Line Text field `cPVAL Detected Remote Tool Names` to store only the detected tool names.
+- Updated script to populate this new field, allowing results to be used in dynamic groups and exports.
+
 ### 2026-06-24
 
 - Initial version of the document