Get host connection status

[alexgumo7]

Hello again!

After identifying hosts with the QueryDeviceFilter I need to get certain information from the hosts. In order to do that, I'm using the GetDeviceDetails function, however it doesn't display the Connection Status parameter to check if the host is online/offline. I know that this parameter exists as it can be seen in the filters provided in the Crowdstrike console as showed in the following image:

Then, how can I obtain de connection status parameter using falconpy? (The GetDeviceDetails currently shows a status parameter that is associated to the Containment status but not the Connection status)

[jshcodes]

Hi @alexgumo7 -

The Connection Status value is calculated dynamically and then shown. It does not align to an attribute directly, but you can filter results to get a close approximation using the last_seen value.

falcon.query_devices_by_filter(filter="last_seen:>='now-10m'+last_seen:<'now'")

I would recommend not searching for a value lower than 5m here.

What information are you wanting to retrieve from the hosts? The host doesn't need to be online for you to retrieve data from the API, but would need to be if you are wanting to run RTR commands against it (and get the results back, you would still be able to queue the command).

[alexgumo7]

Thanks!
In this case I need to make a characterization of the hosts. The objective of getting the Connection status is in fact to know if the host is online to run RTR commands.

I will try this approximation.