Collecting and analyzing installed programs | Docs

Kabeen automatically inventories the installed programs across your entire fleet — workstations and servers alike — through its agents. With no manual entry, you get a complete software inventory: which software, in which version, on which machine. This collection also feeds the automatic discovery of your application inventory.

Overview

An installed program is a piece of software present on a machine, as it would appear in "Add/Remove Programs" on Windows or in the Applications folder on macOS. Kabeen collects them through two agents:

the user agent, for workstations (Windows and macOS);
the server agent, for servers (Windows and Linux).

Each program is then deduplicated, historized, and tied to its machine, then made available in the interface: an Installed programs tab on every workstation and server record, a global view on the workstations dashboard, and a CSV/XLSX export.

No manual entry. The software inventory is entirely agent-driven. Kabeen is not a software-distribution tool: it observes what is installed — it neither installs nor uninstalls anything.

Prerequisites

The relevant agent must be deployed and active on the machines to inventory: the user agent on workstations, the server agent on servers.
The agent must be a recent version: installed-programs collection is only available from the agent versions that support it. Keep your agents up to date.

How collection works

On workstations

The user agent inventories software from the operating system's native sources:

Windows: the uninstall registry entries (those listed in "Apps & features") and Microsoft Store apps (AppX/MSIX). Start-menu shortcuts are also used to complete the list.
macOS: installed applications (.app bundles), along with their metadata (publisher, version, identifier).

On servers

The server agent inventories software depending on the operating system:

Windows Server: the uninstall registry entries and Store apps, just as on a workstation.
Linux: packages from the system's package managers — APT/dpkg (Debian, Ubuntu…), Snap and Flatpak — as well as applications installed outside a package manager (archives, AppImage…). Support for RPM (Red Hat, Rocky, SUSE…) is being rolled out; depending on the agent version, RPM packages may not yet be reported.

Collecting installed programs on macOS servers is not supported.

Automatic noise filtering

Not every component is relevant to a software inventory. The agent automatically discards noise before sending:

system components and updates (patches, hotfixes) that are not standalone software;
technical libraries and runtimes (frameworks, redistributable runtimes);
on Linux, hidden or non-interactive entries, and duplicates across package managers.

Fields collected for each program

Field	Description
Name	The software name, cleaned up (version numbers and architecture mentions removed)
Publisher	The software's publisher or maintainer, when available
Version	The installed version, when available
Install date	The estimated installation date, when available
Package ID	The package's technical identifier (registry key, bundle identifier, package name)
Location	The installation path on the machine

When a piece of information is not exposed by the system, the corresponding field stays empty (- in the interface).

Frequency and transmission

Collection runs when the agent starts, then every 24 hours. The software inventory is therefore not a real-time feed: a program installed or removed appears or disappears at the next cycle.
Data is sent to the Kabeen backend over an encrypted channel (gRPC over TLS).

Analysis and processing by Kabeen

On receipt, Kabeen consolidates each machine's reports:

Deduplication: identical programs (same publisher, same name, same package ID) are merged for each machine.
Current state and history: Kabeen keeps the current state of each machine's inventory (one snapshot per machine) as well as a history of reports. A report older than an already known state is ignored, and an unchanged inventory is not rewritten needlessly.
Workstation / server distinction: each program knows whether it comes from a workstation or a server, which allows the two populations to be counted and filtered separately.

Matching against the application inventory

On workstations, installed programs feed the automatic discovery of your application inventory: when an installed program matches an application known to the Kabeen catalog, the application is automatically suggested in your inventory (with its publisher, category, and icon). This is one of the signals — alongside web browsing — that reveal Shadow IT. See Application auto-discovery.

This automatic catalog matching applies to workstations. For servers, installed programs are inventoried and viewable, but do not create an application in the inventory.

Reviewing installed programs

On a workstation or server record

Open a workstation record (menu Inventory → Infrastructure → Workstations) or a server record (menu Inventory → Infrastructure → Servers).
Select the Installed programs tab.

The list shows three columns, all sortable:

Column	Content
Name	The program name, with the publisher shown below it (or `-`)
Version	The installed version (or `-`)
Install date	The estimated installation date (or `-`)

You can:

Search for a program by name;
Filter by Publisher (multi-select) and by Install date, with a Before or After condition;
Sort by name, version, or install date.

Finding which machines have a program installed

Click a row to open the Installed on panel. It shows on how many workstations and servers the program is present, with three tabs — All, User workstations, and Servers — and lets you jump to each machine's record.

Global view on the workstations dashboard

The workstations dashboard includes an Installed programs indicator that totals all detected programs. Clicking it opens a consolidated view of your entire fleet, grouped by program:

Column	Content
Name	The program name and its publisher
Version	The version, or the label "n versions detected" when the same program exists in several versions (expandable row)
User workstations	The number of workstations on which the program is installed
Servers	The number of servers on which the program is installed

This view respects the team filter active on the dashboard and lets you expand a program to see the breakdown version by version.

Empty states

If no program has been detected on a machine, Kabeen prompts you to check that the agent is up to date and running.
On a server in manual collection (no active agent), a message reminds you that the feature requires an active agent.

Exporting installed programs

From the list (both the machine record and the global view), you can export the inventory to CSV or XLSX (Export to CSV / Export to XLSX):

exporting a machine includes the Name, Publisher, Version, and Install date columns;
exporting the global view includes the name, version, and the number of workstations and servers involved.

The export reflects the active search and filters.

Archive regularly. A machine that stops sending data for an extended period eventually disappears from the list. To keep a record of its software inventory, export your data regularly.

Limitations to be aware of

Not real time. The inventory reflects the last collection (at most once every 24 hours), not the machine's instantaneous state.
Agent dependency. With no active, up-to-date agent, no program is reported. A - field may mean "not exposed by the system" rather than "absent".
No end-of-life or vulnerability analysis on installed programs. The installed-programs list is an inventory; at this stage it does not compute end-of-support (EOL) or vulnerabilities (CVE) per program. Obsolescence tracking relies on the application inventory and the technology catalog.
Catalog matching limited to workstations. Only workstation programs feed application discovery; servers are inventoried but do not create applications.