Fetch installed software details in Elasticsearch using elastic beats

[Tirtharaj_Karbotkar1 (Tirtharaj)]

Hi all,

I am trying to fetch installed software details from my system (windows) into the Elasticsearch. Does any one have idea how to do the same?
I have tried using metricbeat but at most I can get the running process details. Is there any other elastic or community beat which can fulfill my requirements?

Also, is auditbeat able to detect installation of new software?

Thanks

[miltonhultgren]

Hi!

Perhaps our OSQuery integration for Elastic Agent is what you're looking for.
It lets you run queries on the machines that have Agent installed, so you can ask for things like "which programs are installed on this machine".

[andrewkroh]

For some more info on the osquery integration see Osquery | Kibana Guide [7.16] | Elastic.

I think you could query the programs table: https://www.osquery.io/schema/5.1.0/#programs

[Tirtharaj_Karbotkar1 (Tirtharaj)]

Thanks @andrewkroh and @miltonhultgren I will try the OSQuery integration.