The software usage metrics 'last_used' is not being collected for all the software installations - Known Error

The software usage metrics 'last_used' is not being collected for all the software installations Description The software usage metrics 'last_used' is not being collected for all the software installations.

Steps to Reproduce

Run 'Installed Software' check on the Agent Observe that the last_used field is not populated for all the Software Installation records returned in the input.

Workaround The root cause of this can be the inconsistency of the software names in OSQuery tables.

From the ACC-V Nov 2024 release, we provide an option to add mappings of such software's names (actual name -> name in OSQuery table). To update this mapping follow the below steps:-

Go to the 'sn_agent_configuration_file' table, open the 'SoftwareNameMapping.json' record, and download the file 'SoftwareNameMapping.json' attached to this record. In your local, you can update this file with the mappings of the software you are facing issues. Format of the file:-

{ "Visual Studio Professional 2022": "VisualStudio", "Visual Studio Professional 2019": "VisualStudio", " ": " " }

To find the mapping, you can use the 'Display name' field's value in the Software Installations table and the software name found in the OSquery command's output.

OSQuerycommand:- osqueryi.exe --config_path "" --json --logger_min_status 1 "select p.path, p.last_execution_time, p.count, u.username from users u CROSS JOIN userassist p on p.sid=u.uuid order by p.last_execution_time desc;"

3. After updating file in your local, delete the previous file and upload the file from your local with new mappings.

4. Automatically this new file will be synced to all agents and last_used will start coming in ecc queue.