For Windows, I've been trying to track installs/removals. MSI was a breeze. I'm attempting now anything that isn't MSI. I'm tracking changes in the following paths:
Two issues arose:
Here's an example of my search for detecting installs.
index="winregmon" process_image!=*msiexec* registry_type="SetValue" *displayname*
| join type=left max=0 host data [
search index="winregmon" process_image!=*msiexec* (registry_type="CreateKey" OR registry_type="DeleteKey") latest=-16m
| dedup host
| rename registry_type as last_registry_type
| rename data AS deleted_data]
| dedup host data
| eval Date=strftime(_time, "%m-%d-%Y")
| eval Time=strftime(_time, "%H:%M:%S")
| table host data Date Time last_registry_type
In my various modifications of this search, either I detect installs + upgrades (i just want installs) or I miss data all together. I'm aware the search above isn't right, just for reference. My idea:
what is your question?
How to track software install/removal? If from the registry, how do I back-search? Given my OP, how do I make my existing search work to tell me when new software is installed?
Do you think may be monitoring WIndows event logs to this would be better?
https://support.solarwinds.com/Success_Center/Log_Event_Manager_(LEM)/Knowledgebase_Articles/Monitor...
That's MSI. As mentioned in my OP, I've already covered MSI (note I exclude msiexec in my search, too). Granted, I've encouraged everyone when installing to install by MSI (so it can be tracked). But I still want to catch non-MSI installs.
@tmontney how did you catch MSI installs? I am trying to create alerts to track MSI Installations and MSI Removals.
Thanks!