Creating a baseline to monitor for unapproved software