Last opened time for Windows software

[ddribeiro]

• @noahtalerman: User requested this because they want to avoid deploying another agent (Flexera) and instead hit Fleet's host vitals (GET /hosts/:id) to collect Windows software usage data, including last_opened_at to populate their asset management tool.
  • @noahtalerman: Eventually, enable collection of last_opened_at for Windows hosts and include it in the GET /api/v1/fleet/hosts/:id API response, similar to macOS.
• The Fleet team is exploring if the prefetch table on Windows can provide last_run_time timestamps for applications.
  • @allenhouchins: It looks like the last_run_time column tells us the last time the file was accessed. "This executable accessed this file at this time"
    • @noahtalerman: Sounds like Fleet would have to know which executables are tied to what software.
• @allenhouchins: We might not get this information for all Windows software. It's not required like it is for macOS apps.

---

[noahtalerman]

Gong snippet: Customer does not allow call recording (see meeting notes)

Problem

customer-numa uses Flexera to collect information about assets and software usage. Flexera has an agent that can run on a host that will collect relevant information, but numa thinks most of this information can already be obtained using Fleet. Rather than deploy another agent, they'd like Fleet to handle the data collection and build a connector to Flexera using the Fleet REST API.

One piece of information is last_opened_at for specific programs per host. Fleet collects this information for macOS hosts, and admins can retrieve it by calling the GET /api/v1/fleet/hosts/:id endpoint. However, this information is not collected on Windows, so it is not returned in the API response.

What have you tried?

We are currently exploring using the prefetch table on Windows to see if the last_opened_time is available there. Even if it is, numa would ideally like the GET /api/v1/fleet/hosts/:id endpoint to be updated to return a value for last_opened_at for Windows hosts.

Potential solutions

1. Find a way to collect last_opened_at time for programs on Windows hosts.
2. Return that information in the GET /api/v1/fleet/hosts/:id API response for Windows hosts, similar to how it is returned for macOS hosts today.

What is the expected workflow as a result of your proposal?

Numa would use the Fleet agent to collect relevant information to ingest into Flexera. They would not need to deploy a separate agent. They would build a Flexera connector using the Fleet API to ingest relevant information.