Search for oldest devices
A query to get the age of devices that have the falcon sensor installed.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName = SensorHeartbeat
| in(field=event_platform, values=[?Platform])
| ComputerName like ?ComputerName
| aid = ?aid
| groupBy([aid, ComputerName], function=session([max(@timestamp),min(@timestamp)]))
| "Last seen" := formatTime("%d-%b-%Y %H:%M:%S", field=_max)
| "First seen" := formatTime("%d-%b-%Y %H:%M:%S", field=_min)
| "Age in h" := _duration/3600000
| age := formatDuration(_duration, precision=2)
| "Age in h" := format(format="%.2f", field=["Age in h"])
| sort(field=_duration)
| drop([@timestamp,_duration,_max,_min])device_age.yml
ByteRay
Monitoring
Endpoint
Insight
2025-09-01
2025-09-01
