I know this has been raised in the past.
We have scripts that run to compare:
- Endpoint last active in RMM
- Endpoint last active in AD
- Endpoint last active in Sophos Central
This is useful to find exceptions or issues with software.
What has become clear is the API response lastSeenAt is very inaccurate compared to the Central Web Portal.
I understand the issue quoted elsewhere was 'sync' but we are seeing differences of days/weeks in some cases. If we log in to Central, the Last Active was within hours or minutes.
Are there any plans to fix this issue with the API?
The only alternative we would have is to access logfiles on the endpoints (i.e. MCS) to see if Sophos has reported back (which is a bit daft!)
Thanks
Joe
