Custom report - List asset with specific software installed

Dear everyone,

Does anyone has a query to list all assets with a specific software installed ? My example here is to list all servers with Firefox installed on.

Regards,

Vincent

Vincent,

If you have the EET (Enhanced Endpoint Telemetry) portion of IDR, you could look under your “Endpoint Activity” log set for Process Start Events and use something like:

where(process.name=/firefox.exe/i)groupby(hostname)calculate(unique:hostname)limit(1000)

Put your time picker at 24 hours or whatever time range you are looking for.

Hi Vincent.
What you are looking for can be addressed with Query Builders within InsightVM. A Goal or SLA can be created to track assets with a specific software too. More details in my response a while back here Report to find out devices missing a particular software - #2 by jay_godbole
I hope this helps

Thanks

Hi Vincent,

This is one I use pretty regularly. You can modify the fields as needed.

SELECT DISTINCT ON (da.ip_address) da.ip_address AS “IP Address”, da.host_name AS “Hostname”, dos.NAME AS “OS”, ds.vendor AS “Software Vendor”, ds.family AS “Software Family”, ds.name as “Software Name”, ds.version AS “Software Version”, date(da.last_assessed_for_vulnerabilities) AS “Last Scan Date”
FROM dim_asset_software das
JOIN dim_software ds using (software_id)
JOIN dim_asset da on da.asset_id = das.asset_id
JOIN dim_operating_system dos USING (operating_system_id)
WHERE ds.name ~* ‘firefox’
ORDER BY da.ip_address, ds.version, da.last_assessed_for_vulnerabilities DESC

Best regards,
Scott

Thank you, I found my what I was looking for !

1 Like

Is the ~* a wildcard? search around firefox

Jumping on an older thread here, new to R7… is there a report that will show what EOL EOS software you have , not just OS but applications… Thanks in advance

I just put in a pull request to add a query to our public repo for this that will be named Obsolete-Software.sql

1 Like