XQL query to find agents seen in the last 30 days

[MartinCimone]

Hi,

I am looking to create a report that will list all endpoints seen in the last 30 days.

I have created an XQL query that will return all endpoints but I am not able to filter this query to limit the scope to agents that have been seen in the last 30 days ONLY.

-------------------------------

config case_sensitive = false
| dataset = endpoints
| fields endpoint_name , endpoint_type , endpoint_status , last_seen

--------------------------------

Does anyone know how I can achieve this?

Thanks.

#Cortex XDR 

[tyler_bailey · Accepted solution]

See if this query gets what you are after.

config case_sensitive = false

| dataset = endpoints
| fields endpoint_name , endpoint_type , endpoint_status , last_seen
| alter last_seen_days = timestamp_diff(current_time(), last_seen, "DAY")
| filter last_seen_days <= 30

[MartinCimone]

Working like a charm ... !  Thanks @tyler_bailey 

[NitinYadav]

Hi Can you suggest on below cmd

| alter last_seen_days = timestamp_diff(current_time(), last_seen, "DAY")

how to use these with an example