There's a Template rule for Windows Update Failure that you might want to look at. The LEM normalizes a class of events as "SoftwareInstall" so looking for those events ought to show you installs. This is contingent on those events being logged, however, which in Windows means "Using the MSI installer service." If someone is using an app that doesn't need an install (Like PuTTy or Notepad++ with the right options selected) you won't see that as a "SoftwareInstall," and neither would you get 100% capture of software using other means of installation (like older legacy apps that don't know about MSI or registry changes).
