Unable to find user details for software installation analytic rule

Occasional Visitor

Dear Community,

We have created a log analytic rule which tracks the software installations. 

Below is the KQL Query:


| where ConfigChangeType == "Software" | where ChangeCategory == "Added"
| extend AccountCustomEntity = Computer
| extend HostCustomEntity = SoftwareName
| extend IPCustomEntity = ConfigChangeType
| extend URLCustomEntity = PreviousAcls
| summarize count() by Computer, SoftwareType, SoftwareName, Previous, Current, Publisher
| summarize count() by SoftwareName, Publisher, Computer 


The issue is we are unable to identify the exact file path/the user details who installed this/unable to find it in control panel-->programs

Can someone help on this. @TomMcElroy 

0 Replies