Searching for devices based on Last Check-In

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Provide guidance on searching using Last Check-In or last_contact_timelast timestamps

Environment

• Carbon Black Cloud Console: All Versions

Resolution

1. Log into the Carbon Black Cloud (CBC) Console
2. Go to Endpoints page
3. Enter search using epoch timestamp

   Find Sensors which have checked in since the timestamp
   last_contact_time:>{Epoch_Timestamp}
   
   Find Sensors which have not checked in since the timestamp
   last_contact_time:<{Epoch_Timestamp}

Additional Information

• Example
  • To find devices which have checked in since 21-Apr-2021 at 12:00:00AM GMT

    last_contact_time:>1618963200000

  • To find devices which have not checked in since 21-Apr-2021 at 12:00:00am GMT

    last_contact_time:<1618963200000