Applications

Kind

State - something true when Signal read the host

Built-in rules reading it

4

app.name

string

The application's name as Windows displays it (DisplayName); a Store package's name when it has no display name.

app.publisher

string

The publisher as the application recorded it - written by its installer, not checked against any signature.

app.version

string

The version as the application recorded it (DisplayVersion).

app.location

string

The install folder as recorded (InstallLocation, a Store package's root folder); absent when the installer did not record one.

app.installed

time

The install date as recorded (InstallDate: a day in the host's local calendar, no time - written YYYY-MM-DD, never as a UTC time) - written by the installer, so it can be absent, wrong or changed; or, for a Store package, absent.

app.user

string

The user the application is installed for - the profile folder's name and SID - when it is in that user's registry; absent for the machine's.

app.key

string

The registry key's name the application is recorded under: a product code ({GUID}), an uninstall name, or a Store package's full name.

app.sources

string

Every place the application was read from (Uninstall key, Windows Installer, Store package), each with its registry key.

app.in_period

bool

true when the application was installed inside the period the analyst gave (the profile's window) - by its recorded install date, or the time of Windows Installer's event; absent when no period was given or the date is not recorded.
derived: set by the Applications module from app.installed or the event's time, and its since parameter

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

4

app.name

string

The application's name as Windows displays it (DisplayName); a Store package's name when it has no display name.

app.version

string

The version as the application recorded it (DisplayVersion).

app.publisher

string

The publisher as the application recorded it - written by its installer, not checked against any signature.

app.change

string

What Windows Installer recorded: installed (Application log 1033) or removed (1034).

app.status

string

The installation's status as Windows Installer recorded it: 0 succeeded; any other value is its error code (1602: cancelled by the user, 1603: failed).

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)

app.in_period

bool

true when the application was installed inside the period the analyst gave (the profile's window) - by its recorded install date, or the time of Windows Installer's event; absent when no period was given or the date is not recorded.
derived: set by the Applications module from app.installed or the event's time, and its since parameter