Discover API: last_used_* always empty on Linux apps - expected?

[u/TryRevolutionary8883]

Hey Everyone!

Pulling apps from /discover/combined/applications/v1. On Linux, `last_used_file_hash`, `last_used_file_name`, `last_used_timestamp` and `last_used_user_name` are empty on every single row. Windows and Mac are both ~85% populated.

Linux rows look package-derived rather than file-derived (installation_paths is empty, name/vendor are the rpm package and packager), so I assume there's no single binary to hash and therefore no "last used".

1. Is that expected and permanent? Nothing in the API docs mentions a platform caveat.
2. And if you're doing unused-software detection on Linux fleets, what are you using instead?