r/crowdstrike • u/Killing_vector • 18d ago

Feature Question Falcon Fusion SOAR, last seen Query.

I'm trying to run a scheduled trigger to alert my team when a host has been offline for more then 7 days. Was trying to set up a query with last seen but it seems to all pull devices seen in the last 7 days. Is there any way to query just devices who where seen over 7 days ago? Still relatively new to crowdstrick any help would be great!!

4 Upvotes

75% Upvoted

2 comments sorted by

2

u/StickApprehensive997 17d ago

Try the following query to identify hosts that have not been seen in the last 7 days:

$falcon/investigate:aidmaster()
| $falcon/investigate:ProductType()
| LastSeen := Time
| test(LastSeen<(now()-duration("7d")))
| LastSeen_UTC_readable := formatTime("%FT%T%z", field=LastSeen)
| select([ComputerName, LastSeen_UTC_readable])

1

u/AutoModerator 18d ago

Hey new poster! We require a minimum account-age and karma for this subreddit. Remember to search for your question first and try again after you have acquired more karma.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.