Thread Info
  • State Not Answered
  • Replies 7 replies
  • Subscribers 8 subscribers
  • Views 4419 views
  • Users 0 members are here
Options
Suggested

LastSeenAt <> Last Active

Axnfell

We have scripts that run to compare:

  • Endpoint last active in RMM
  • Endpoint last active in AD
  • Endpoint last active in Sophos Central

This is useful to find exceptions or issues with software.

What has become clear is the API response lastSeenAt is very inaccurate compared to the Central Web Portal.

I understand the issue quoted elsewhere was 'sync' but we are seeing differences of days/weeks in some cases. If we log in to Central, the Last Active was within hours or minutes.

Are there any plans to fix this issue with the API?

The only alternative we would have is to access logfiles on the endpoints (i.e. MCS) to see if Sophos has reported back (which is a bit daft!)

Thanks

Joe

Parents
  • 0

    Hello,

    By comparing the results returned by the API and the csv exports done manually from Sophos Central > Devices > Computers & Servers, the data from the API seems to match with the "Logs and reports" and the csv exports to match with actual data.

    Do you think we can fill in options during the API request to target "Devices"?

    Thanks 

  • 0 in reply to emin balci

    Emin,
       as you can see from this stale post, I don't believe the Sophos Dev team believes this to be a priority. they recommend to me in a support case to query the Live Response APIs (if you have that feature/license) but would require the devices to be online... Not really helpful. They posted this same solution here as well if you are curious. 

    Get last update from Central API

    They also recommend putting in a feature request... may be worth doing and opening up a support case.. show them this is important to you...

    Personally, I wouldn't hold my breath hoping they address; nor would I build processes around data from the APIs if you need accurate "last online time" data.

    Respectfully, 
    Jay

Reply
  • 0 in reply to emin balci

    Emin,
       as you can see from this stale post, I don't believe the Sophos Dev team believes this to be a priority. they recommend to me in a support case to query the Live Response APIs (if you have that feature/license) but would require the devices to be online... Not really helpful. They posted this same solution here as well if you are curious. 

    Get last update from Central API

    They also recommend putting in a feature request... may be worth doing and opening up a support case.. show them this is important to you...

    Personally, I wouldn't hold my breath hoping they address; nor would I build processes around data from the APIs if you need accurate "last online time" data.

    Respectfully, 
    Jay

Children
Unfiltered HTML