Is there a way to look at only the endpoints that have not been scanned in certain amount of time?
I know I can view all the have been scanned in the last day/week/month etc, but I want to look at the devices that have NOT been scanned.
I need a "does NOT equal" button, on the Endpoint Administration tab.
Yes, the assigned prevention policy is set to scan all of these endpoints on a weekly basis. But we have several thousand endpoints that have not had a successful scan in months, and those are the endpoints I am interested in looking at.
I am less concerned about endpoints that "Aborted" their last scan, but had a successful scan a couple weeks ago, and more concerned about endpoints that haven't successfully scanned in several months.
Hello Pdysart,
For monitoring, you can generate a Custom Dashboard by navigating to Reporting>Dashboards Manager+ New Dashboard.
You may build the report by creating a Custom XQL Widget and build an XQL query filtering on the last_succesful_scan attribute:
dataset = endpoints |fields last_successful_scan, endpoint_name
Your query can have a specific time range such as an endpoint last scanned in 24H (hours), last 7D (days), last 1M (month), or select a Custom time period. Save and Run to review the results.
Please reference for assistance with creating XQL queries.
