HI, I want to use API to know Last active time .
But when I used this API to get the endpoint info, this API didnt response the Last active data which like picture2
I want to know is there any Sophos API can response Last Active time?
Thank!
Hi Dante, thank you so much for your inquiry. We're happy to see that our APIs are being used. I believe the parameter you are looking for in the API is named "last SeenAt"
Here is an example from a recent response:
Thank for your reply,but why mine 'lastSeenAT' is different from 'Last Active'?
Dear Sir ,
do you have any update ?
Dante
Hi Dante, I believe this is because, for the moment, the API results are returned from a different data store than the UI for endpoint state fields. These data stores can on occasion become out of sync for a short period of time. Generally not more than a few hours of difference as observed here in your screenshots.
Thank for you reply!
Elias .. I am encountering the same issue as I attempt to put together a health check report and compare against another agent. What I am finding is that there is often several days difference in what returns on the API json results and what shows in the console. For example, I have agents that I have at least 20 agents right now where what shows in the Sophos Central web console has anywhere from a 3 to 7 day difference in timestamps returning. A majority of the agents are spot on .. others are not regardless of force update or anything else I attempt to "wake it up".
Apologies .. please allow me to state that again as I should have edited the post before sending ... "For example, ... I have at least 20 agents right now where what shows in the Sophos Central web console has anywhere from a 3 to 7 day difference in timestamps returning from the API results."
Just to add .. I am finding that this date stamp from the API appears to have a direct correlation to the last time the machine was rebooted .. regardless of activity that occurred since it has been up.
lastly .. rebooted a couple of the machines in the list I was referencing and the dates advanced on the API side.