We have scripts that run to compare:
This is useful to find exceptions or issues with software.
What has become clear is the API response lastSeenAt is very inaccurate compared to the Central Web Portal.
I understand the issue quoted elsewhere was 'sync' but we are seeing differences of days/weeks in some cases. If we log in to Central, the Last Active was within hours or minutes.
Are there any plans to fix this issue with the API?
The only alternative we would have is to access logfiles on the endpoints (i.e. MCS) to see if Sophos has reported back (which is a bit daft!)
Thanks for reaching out to us.
I have reached out internally to help answer your question, I will update this thread as more information becomes available.
The feedback I've received is as follows.
The underlying design differences mean the 2 data sources can vary and that making them both as accurate as we’d like would be a significant piece of work that we don’t currently have planned. We haven’t previously identified a simple improvement that would help when we have looked at this before, but we are discussing again to see if there are any options we have.