# Fetch installed software details in Elasticsearch using elastic beats

**URL:** <https://discuss.elastic.co/t/fetch-installed-software-details-in-elasticsearch-using-elastic-beats/294527>\
**Category:** Beats\
**Tags:** elastic-stack-monitoring, beats-module, metricbeat, winlogbeat, auditbeat\
**Created:** [January 17, 2022, 5:44am UTC](https://discuss.elastic.co/t/fetch-installed-software-details-in-elasticsearch-using-elastic-beats/294527 "2022-01-17T05:44:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tirtharaj\_Karbotkar1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tirtharaj_karbotkar1/32/81695_2.png) [@Tirtharaj\_Karbotkar1](https://discuss.elastic.co/u/Tirtharaj_Karbotkar1)\
**Post date:** [January 17, 2022, 5:44am UTC](https://discuss.elastic.co/t/fetch-installed-software-details-in-elasticsearch-using-elastic-beats/294527/1 "2022-01-17T05:44:29Z")

</div>

Hi all,

I am trying to fetch installed software details from my system (windows) into the Elasticsearch. Does any one have idea how to do the same?  
I have tried using metricbeat but at most I can get the running process details. Is there any other elastic or community beat which can fulfill my requirements?

Also, is auditbeat able to detect installation of new software?

Thanks

---

<div class="post-metadata">

**Author:** ![miltonhultgren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miltonhultgren/32/100401_2.png) [@miltonhultgren](https://discuss.elastic.co/u/miltonhultgren)\
**Post date:** [January 18, 2022, 8:53am UTC](https://discuss.elastic.co/t/fetch-installed-software-details-in-elasticsearch-using-elastic-beats/294527/2 "2022-01-18T08:53:51Z")

</div>

Hi!

Perhaps our OSQuery integration for Elastic Agent is what you're looking for.  
It lets you run queries on the machines that have Agent installed, so you can ask for things like "which programs are installed on this machine".

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 20, 2022, 2:07am UTC](https://discuss.elastic.co/t/fetch-installed-software-details-in-elasticsearch-using-elastic-beats/294527/3 "2022-01-20T02:07:44Z")

</div>

For some more info on the osquery integration see [Osquery | Kibana Guide [7.16] | Elastic](https://www.elastic.co/guide/en/kibana/current/osquery.html).

I think you could query the programs table: [https://www.osquery.io/schema/5.1.0/#programs](https://www.osquery.io/schema/5.1.0/#programs)

---

<div class="post-metadata">

**Author:** ![Tirtharaj\_Karbotkar1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tirtharaj_karbotkar1/32/81695_2.png) [@Tirtharaj\_Karbotkar1](https://discuss.elastic.co/u/Tirtharaj_Karbotkar1)\
**Post date:** [January 25, 2022, 11:13am UTC](https://discuss.elastic.co/t/fetch-installed-software-details-in-elasticsearch-using-elastic-beats/294527/4 "2022-01-25T11:13:27Z")

</div>

Thanks @andrewkroh and @miltonhultgren I will try the OSQuery integration.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2022, 1:13pm UTC](https://discuss.elastic.co/t/fetch-installed-software-details-in-elasticsearch-using-elastic-beats/294527/5 "2022-02-22T13:13:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.