# Investigation with packages with Finder (classic)

Nexthink simplified investigations that retrieve packages or include a condition on packages. The results take into account only those packages that are effectively installed, discarding uninstalled packages.

Nevertheless, it is still possible to find installations or uninstallations of packages by directly querying the installation events.

The following tables summarize the typical uses of investigations related to packages. [Download all the investigations](http://download.nexthink.com/doc/Investigations_with_packages.xml) and import them into Finder to try them out.

### Retrieving devices <a href="#investigationwithpackageswithfinder-classic-retrievingdevices" id="investigationwithpackageswithfinder-classic-retrievingdevices"></a>

| Investigation name                   | Condition                                                                                                                                                                                                                                                         | Aggregate condition    |
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- |
| Devices *with* a specific package    | Package Name is "abc"                                                                                                                                                                                                                                             | -                      |
| Devices *without* a specific package | Package Name is "abc"                                                                                                                                                                                                                                             | Number of packages = 0 |
| Devices *with* two specific packages | <p>Package Name is "abc", publisher is "ABC", version is "123", type "program"<br>or</p><p>Package Name is "xyz", publisher is "XYZ", version is "789", type "program"</p><p>NOTE: A package is uniquely identified by its name, publisher, version and type.</p> | Number of packages = 2 |

### Retrieving installation events <a href="#investigationwithpackageswithfinder-classic-retrievinginstallationevents" id="investigationwithpackageswithfinder-classic-retrievinginstallationevents"></a>

| Investigation name                   | Condition                                                    | Aggregate condition |
| ------------------------------------ | ------------------------------------------------------------ | ------------------- |
| Installation of a specific package   | Package Name is "abc" and Operation Type is "installation"   | -                   |
| Uninstallation of a specific package | Package Name is "abc" and Operation Type is "uninstallation" | -                   |

### Retrieving packages <a href="#investigationwithpackageswithfinder-classic-retrievingpackages" id="investigationwithpackageswithfinder-classic-retrievingpackages"></a>

| Investigation name                                                                | Condition | Aggregate condition                      | Order by                        |
| --------------------------------------------------------------------------------- | --------- | ---------------------------------------- | ------------------------------- |
| Least used packages                                                               | -         | -                                        | Number of devices is ascending  |
| Most used packages                                                                | -         | -                                        | Number of devices is descending |
| Packages installed on fewer than 5 devices (but at least installed on one device) | -         | Number of devices is fewer or equal to 5 | -                               |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.nexthink.com/platform/references/references-classic/database-information-and-organization-classic/investigation-with-packages-with-finder-classic.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.