wulf-pulse/lib/services/rmm/scripts/get-installed-software.ts
lorentz 1112a06afe feat: RMM Overshell, IT Glue audit/write-back, LogLift, link-aware bundles, dashboard overhaul
- RMM Overshell (migration 077): admin page, dispatch UI, executor/worker, target
  resolver, script registry (AD/DHCP/DNS/event-log/services/software/network/loglift)
- LogLift evidence pipeline (migration 078): upload webhook, B2 storage client,
  receiver/matcher, EventLogCollector PowerShell script
- IT Glue audit + write-back (migrations 075, 076): asset-audit runner, ticket
  xrefs, applications/configurations browse pages + apply/revert/audit endpoints
- Link-aware analyzer bundles (migration 073) + provider toggle (migration 074):
  link-discovery service, OpenRouter LLM provider, related-tickets/itglue-suggestion
  panels, analyze-bundle endpoint
- Endpoint data model + device-link reconciliation (migrations 079, 080): conflicts
  admin page, reconciler service, resolve endpoints
- Dashboard overhaul: integration-health service + alerts, overview/health endpoints
- Permissions: add itglue + rmm scopes; middleware: public /api/rmm/loglift route

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-03 07:13:18 -04:00

36 lines
1.2 KiB
TypeScript

/**
* get-installed-software — list installed Win32 + WoW64 applications.
* Asset-self. Useful for verifying app-version fields on Configuration
* records and for spotting unexpected installs.
*/
import { type RmmScript, parseJsonOutput } from './types';
export const getInstalledSoftware: RmmScript = {
id: 'get-installed-software',
name: 'Installed software',
description:
'Win32 + WoW64 uninstall registry — DisplayName, DisplayVersion, Publisher, InstallDate.',
target_type: 'asset_self',
expected_runtime_seconds: 20,
version: 1,
body: `
$ErrorActionPreference = 'Stop'
$paths = @(
'HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'
'HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'
)
$apps = foreach ($p in $paths) {
Get-ItemProperty $p -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName } |
Select-Object DisplayName, DisplayVersion, Publisher, InstallDate
}
@{
hostname = $env:COMPUTERNAME
captured_at_utc = (Get-Date).ToUniversalTime().ToString("o")
count = ($apps | Measure-Object).Count
apps = $apps | Sort-Object DisplayName -Unique
} | ConvertTo-Json -Depth 4 -Compress
`.trim(),
parseOutput: (stdout) => parseJsonOutput(stdout),
};