OS Platform ratio
This query aggregates SensorHeartbeat events by operating system platform to show the relative distribution of endpoints per OS. It is well suited for visualization as a pie chart, providing a quick overview of platform coverage and identifying imbalances or unexpected OS presence in the environment.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName = SensorHeartbeat
| groupBy(aid,event_platform)
| groupBy([event_platform])os_platform_ratio.yml
ByteRay GmbH
Monitoring
Endpoint
Insight
2025-08-26
2026-02-13
