Get Host Zero Trust Assessment Scores
This query outputs a table with hosts including their zero trust scores
CQL · Falcon Next-Gen SIEMCopy query
event_type=ZeroTrustHostAssessment
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[scores.os, scores.sensor, scores.overall])]))
| join(query={#data_source_name=aidmaster }, field=[aid], include=[ComputerName, event_platform])get_host_zero_trust_assessment_scores.yml
CrowdStrike
Monitoring
Endpoint
Insight
2025-08-26
2025-10-29
