This article provides a quick reference to filtering your endpoints.
Estimated reading time: 2 minutes
To assess your inventory of systems and take actions on multiple endpoints at once, you can filter endpoints by their attributes.
- In Red Canary, click Endpoints.
- Enter attributes in the Endpoint inventory filter bar, and then hit Enter or Return.
Supported filter attributes
Attribute | Description | Example |
Hostname | Hostnames the endpoint has held over time. |
|
MAC address | MAC addresses the endpoint has used over time. |
|
IP address | IP addresses the endpoint has used over time. |
|
Reporting tag | Current "key":"value" reporting tags applied to an endpoint. |
|
Operating system | An endpoint's current operating system. |
|
End-of-life operating system | A boolean that indicates whether the endpoint's operating system has reached its end of life. | end_of_life_operating_system:true |
Endpoint type | The type of endpoint, for example, "workstation" or "server." |
|
Sensor ID | The underlying EDR product's sensor ID. | abcd1234-abcd-1111-2222-4321dcba1234 |
Sensor version | The underlying EDR product's sensor version, as reported by the sensor. |
|
Sensor health issues | A boolean that indicates whether the sensor is reporting serious health issues that affect performance. |
|
Monitoring status | An endpoint's monitoring status, for example, "unmonitored." |
|
Enrolled | A boolean that indicates whether a sensor is active on an endpoint. |
|
Isolated | A boolean that indicates whether an endpoint is isolated from its network by the underlying EDR product. |
|
First seen time | The time when Red Canary first saw the endpoint via discovery or sensor installation. | first_seen_at:2022-02-01.. |
Decommissioned time | The time when an endpoint was last decommissioned. | decommissioned_at:2022-02-01.. |
Latest detection time | The last time when Red Canary identified a threat on an endpoint. | latest_detection_at:2022-02-01.. |
Last check-in time | The last time when an endpoint communicated with Red Canary or its EDR platform. | last_checkin_time:2022-02-01.. |
Uncommunicative endpoints | Endpoints that no longer communicate with Red Canary or their EDR platforms. |
|
Dates are specified using from..to
syntax, where from
and to
are date-times or ISO 8601 dates. You can omit either from
or to
to filter for unbounded times.
Comments
0 comments
Please sign in to leave a comment.