I’m using the Software Inventory API and noticed that events with an is_present=0 are only generated as part of a software upgrade - the older version is deleted/is_present=0 event produced and then newer version is installed/is_present=1 event is produced. However I’m also looking for when a software has been completely removed/uninstalled from a machine.
To test this, I first upgraded, and then deleted Firefox.
My query criteria:
{“and”:[[“discovery_end”,“starting”,"-P180D"],[“computer_name”, “=”, “my-comp-name”]]}
Portion of response shows Firefox is upgraded, but no delete event after. Also, note the timestamp for the install event.
{
“computer_name”: “my-comp-name”,
“computer_bigfix_id”: 8000001,
“product_name”: “Firefox”,
“product_release”: “60.4”,
“is_present”: 0,
“discovery_start”: “2018-12-25T03:00:00Z”,
“discovery_end”: “2019-02-06T03:00:59Z”
},
{
“computer_name”: “my-comp-name”,
“computer_bigfix_id”: 8000001,
“product_name”: “Firefox”,
“product_release”: “60.5”,
“is_present”: 1,
“discovery_start”: “2019-02-06T03:00:59Z”,
“discovery_end”: “9999-12-31T23:59:59Z”
}
My assumption is that deleted software would fit the criteria {“and”:[[“is_present”,"=",0],[“discovery_end”,"=",“9999-12-31T23:59:59Z”]]}
However, that query returns no results.
{
“total”: 0,
“rows”: []
}
Is there a way I can retrieve software removal events that aren’t part of an upgrade?