detection.wiki

MsiInstaller › Event 1036

Event ID 1036 — Windows Installer installed an update.

Provider
MsiInstaller
Channel
Application
Level
Informational

Description

Product: . Version: . Language: . Update: . Update installation completed with status: . Manufacturer: .

Message #

Product: %1. Version: %2. Language: %3. Update: %4. Update installation completed with status: %5. Manufacturer: %6.

Fields #

NameDescription
Data—
Binary—

Example Event #

{
  "system": {
    "provider": "MsiInstaller",
    "guid": "",
    "event_source_name": "",
    "event_id": 1036,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2013-10-23T18:31:57+00:00",
    "event_record_id": 268,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE8Win7",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data": [
      "Microsoft .NET Framework 4 Client Profile",
      "4.0.30319",
      "0",
      "KB2789642",
      "0",
      "Microsoft Corporation"
    ],
    "Binary": "ezNDMzkwMUM1LTM0NTUtM0UwQS1BMjE0LTBCMDkzQTUwNzBBNn0wMDAwZDJlYmY0NjgzMWQyY2IzMjlhZjc2NzI5M2ViMjBjZmQwMDAwMDAwMA=="
  },
  "message": "Windows Installer installed an update. Product Name: Microsoft .NET Framework 4 Client Profile. Product Version: 4.0.30319. Product Language: 0. Manufacturer: Microsoft Corporation. Update Name: KB2789642. Installation success or error status: 0."
}

References #