trigger new item discoverd by Discovery rule

[Nel23FX]

hello, I'm looking for having a trigger that will set on when a discovery rule discover a new item for a specific item prototype.
For example, I have a discovery rule that create new item for Installed software on windows 10. I have now a lot of Item which represent the name of my software installed. When I install a new Software, a new item is created (norma it's the way of item prototype). But I don't see where to specify a trigger that trigger the event that the software name XXX has been added by the Discovery Rule and its name
All I see is that for each Item created by the Item prototype of the discovery rule, I can trigger if the value of the item change or if it bypass a threshold or have no change since X time. But no trigger for new Item creation.

If you a have a way to do that I will be interrested.

[Nel23FX]

like triggering the 'not enough data' event but I don't see too this fonction . Or "previous value is null" . Wich syntax if exist

[frater]

I have, for already a long time, a discovery rule which detects processes that are running for a long time.
My goal is to detect the services running on a system...
When that program is not running anymore I will get a warning.....

The way I detect these "services" create a lot of false positives, but using a filter over the years in the discovery of that, it now only detects "real services".

The way I wrote it also means it will detect viruses...
One such process was running on a QNAP and it was added as an item in Zabbix.
But because I only used it for legitimate services, there was only a trigger going off when the process stopped.

So yes, now I'm also interested in having a trigger that will show up when that item is new, just like you.


If I can think of one, I will post it here.

[frater]

I think this would work:

last(/Template_Linux_Services/proc.num[{#SERVICE}])=1 and last(/Template_Linux_Services/proc.num[{#SERVICE}],#1:now-3d)<1

EDIT:

No it doesn't...
Because the value 3 days ago did not exist (which was the whole idea was based upon), the complete trigger becomes unavailable

It would be nice to have a time shift on "nodata"
It only takes a perion now

nodata(/Template_Linux_Services/proc.num[{#SERVICE}],1h:now-3d)=1

Maybe there's another method....