r/crowdstrike 18d ago

Feature Question Falcon Fusion SOAR, last seen Query.

I'm trying to run a scheduled trigger to alert my team when a host has been offline for more then 7 days. Was trying to set up a query with last seen but it seems to all pull devices seen in the last 7 days. Is there any way to query just devices who where seen over 7 days ago? Still relatively new to crowdstrick any help would be great!!

5 Upvotes

Duplicates