XQL query to get the list of new software/applications

[S.Ahmad]

Looking for help. I would like to come up with the query to find all new applications installed compare to the last month inventory. 

The logic would be what new application/software have been installed on the hosts this month.

[aspatil · Accepted solution]

Hello @S.Ahmad ,

Thanks for reaching out on LiveCommunity!

Please refer to below query:

preset = host_inventory_applications
| fields application_name , vendor , version , endpoint_name, install_date
| alter aa = parse_timestamp("%Y-%m-%d", format_string("%s",install_date ))
| alter diffdiff = timestamp_diff(current_time(), aa, "DAY")
| filter diffdiff <30

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

[S.Ahmad]

Worked and thank you very much.