Is it possible with the Windows Add-on to pull the setup.evtx log?
I guess you could, I've done something similar with other evtx files just add a new input stanza in your local directory, like so.
sourcetype = WinEventLog
source = WinEventLog:Setup
index = <your_index>
disabled = 0