Searching for devices based on Last Check-In

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Provide guidance on searching using Last Check-In or last_contact_time timestamps

Environment

• Carbon Black Cloud Console: All Versions

Resolution

1. Log into the Carbon Black Cloud (CBC) Console
2. Go to Endpoints page
3. Enter search using epoch timestamp OR YYYY-MM-DD

Find Sensors which have checked in since the timestamp

last_contact_time:>{Epoch_Timestamp}
OR
last_contact_time:>YYYY-MM-DD

Find Sensors which have not checked in since the timestamp

last_contact_time:<{Epoch_Timestamp} 
OR
last_contact_time:<YYYY-MM-DD

 

 

 

 

Additional Information

• Example
  • To find devices which have checked in since 21-Apr-2021 at 12:00:00AM GMT

    last_contact_time:>1618963200000
    OR
    last_contact_time:>2021-04-21

  • To find devices which have not checked in since 21-Apr-2021 at 12:00:00AM GMT

    last_contact_time:<1618963200000
    OR
    last_contact_time:<2021-04-21