Get-FalconHost query #160
-
|
Hey folks, Do you know if there is a parameter which can be used to PSFalcon query looking for hosts members of an specific dynamic group with assessement rule = "applied", so not only "targeted"
|
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
As far as I understand, a device is "targeted" when it's subject to a rule, but it won't be "applied" until that device has connected to the cloud and acknowledges that it's in the group. Besides looking at the list of members of the group, you could compare the |
Beta Was this translation helpful? Give feedback.
-
|
This makes sense, thanks. |
Beta Was this translation helpful? Give feedback.
As far as I understand, a device is "targeted" when it's subject to a rule, but it won't be "applied" until that device has connected to the cloud and acknowledges that it's in the group.
Besides looking at the list of members of the group, you could compare the
created_timestampormodified_timestampof a group with thelast_seenof the devices that you expect to be subject to the dynamic rule and infer which devices haven't been added yet.