Calculate Last Windows Boot Time
Outputs the last reboot timestamp and calculates the time elapsed since then.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=AgentOnline event_platform=Win
| groupBy([aid], function=([selectLast([BaseTime])]))
| LastReboot_milli:=(BaseTime/1000*1024)+978307200
| round("LastReboot_milli")
| LastRebootAgo:=now()-(LastReboot_milli*1000)
| formatDuration("LastRebootAgo", precision=2)
| LastReboot:=formatTime(format="%F %T %Z", field="LastReboot_milli")calculate_last_windows_boot_time.yml
CrowdStrike
Monitoring
Endpoint
Insight
2025-08-26
2025-10-29
