Looking for the info (Last active) with API response

Hi Dante, thank you so much for your inquiry. We're happy to see that our APIs are being used.  I believe the parameter you are looking for in the API is named "last SeenAt"

Here is an example from a recent response:

Thank for your reply,but why mine 'lastSeenAT'  is different from 'Last Active'? 

Dear Sir , 

do you have any update ? 

Dante

Hi Dante, I believe this is because, for the moment, the API results are returned from a different data store than the UI for endpoint state fields.  These data stores can on occasion become out of sync for a short period of time.  Generally not more than a few hours of difference as observed here in your screenshots. 

Hi Dante, I believe this is because, for the moment, the API results are returned from a different data store than the UI for endpoint state fields.  These data stores can on occasion become out of sync for a short period of time.  Generally not more than a few hours of difference as observed here in your screenshots. 

Thank for you reply! 

Elias .. I am encountering the same issue as I attempt to put together a health check report and compare against another agent.  What I am finding is that there is often several days difference in what returns on the API json results and what shows in the console.  For example, I have agents that I have at least 20 agents right now where what shows in the Sophos Central web console has anywhere from a 3 to 7 day difference in timestamps returning.  A majority of the agents are spot on .. others are not regardless of force update or anything else I attempt to "wake it up".

Apologies .. please allow me to state that again as I should have edited the post before sending  ...    "For example, ... I have at least 20 agents right now where what shows in the Sophos Central web console has anywhere from a 3 to 7 day difference in timestamps returning from the API results." 

Just to add .. I am finding that this date stamp from the API appears to have a direct correlation to the last time the machine was rebooted .. regardless of activity that occurred since it has been up.

lastly .. rebooted a couple of the machines in the list I was referencing and the dates advanced on the API side.