Automatic Install needs a detection query that recognises your software once it is installed. This guide shows how to find the exact name Windows or Linux uses for it, so the query works.

Feature/Functionality

Overview

When you turn on Automatic Install for a custom package (.exe, .ps1, .deb, .rpm, .sh or .tar.gz), Factorial IT pre-fills an osquery based on the software name you entered. It is a best guess.

The rule is simple: when the software is installed, the query must return at least one row. If it returns nothing, the agent thinks the software is missing and installs the package again at every check.

To fix that, change the value inside LIKE '%...%' so it matches the name the operating system reports for the installed software, not the installer's name.

How to use

1. Open the custom package and turn on Automatic Install.
2. Look at the pre-filled query.
3. Find the exact installed name with the method for your package type (below).
4. Replace the value inside LIKE '%...%' with that name.
5. Target a small device group first and check the install behaves as expected.
6. Roll it out to the rest of the fleet.

Windows (.exe, .ps1)

Pre-filled query:

SELECT 1 FROM programs WHERE name LIKE '%<software name>%'

Where to find the exact name:

• The installed software list in Fleet host details
• Apps & features in Windows Settings
• PowerShell: Get-Package | Where-Object Name -Like '*<name>*'

Example: the installer is FalconSensor_Windows.exe, but Windows lists the software as CrowdStrike Windows Sensor. The query becomes:

SELECT 1 FROM programs WHERE name LIKE '%CrowdStrike Windows Sensor%'

Linux .deb

For Debian and Ubuntu packages.

Pre-filled query:

SELECT 1 FROM deb_packages WHERE name LIKE '%<software name>%'

Where to find the exact name:

• Run dpkg -l | grep <name>. The package name is in the first column.
• Use the package name (for example google-chrome-stable), not the friendly display name.

Linux .rpm

Pre-filled query:

SELECT 1 FROM rpm_packages WHERE name LIKE '%<software name>%'

Where to find the exact name:

• Run rpm -qa | grep <name>.
• Keep only the bare package name, without version or architecture suffix.

Scripts and archives (.sh, .tar.gz)

For Linux installer scripts and archives, what ends up on disk depends on the script. Read the script, or its README, to find out:

• Whether it registers a package in deb_packages or rpm_packages. If it does, query that table.
• If not, which binary or directory it creates. Query for that with file or osquery_info.

Troubleshooting and FAQ

Troubleshooting

• The package reinstalls at every check. The query returns no rows, so the software is never detected. You are probably using the installer file name. Replace it with the name the operating system reports.
• Detection fails after an update. The wildcards may be missing. An exact match breaks when a version suffix appears.
• Devices show the software as installed when it is not. The pattern matches other software. Tighten it or use =.

FAQ

1. Why does the query have to return a row?
   That is how Automatic Install knows the software is present. No row means "not installed", so it installs again.
    
2. Can I keep the query Factorial IT pre-filled?
   Only if it already matches the name the operating system reports. It is a best guess based on the name you typed, so check it.
    
3. On Linux, should I use the display name?
   No. Use the package name, such as google-chrome-stable, without version or architecture.
    
4. What about .sh and .tar.gz installers?
   Check what the script installs. Query deb_packages or rpm_packages if it registers a package; otherwise look for a file or folder it creates.