last_login_timestamp not updated?

[copia-jstanley]

Hi,

Starting to experiment with the Python SDK and started off using the hosts_report.py script in the Samples folder (https://github.com/CrowdStrike/falconpy/blob/main/samples/hosts/hosts_report.py)

I'm trying to add in the last_login_user and last_login_timestamp fields and noticed that the latter seems to have bad info. For example, when looking at my own host (the one that I logged into this morning and am typing this question on), it says my last_login_timestamp was 4 days ago.

Wonder if I'm misunderstanding what that field is supposed to contain or if something else is happening?

[crowdstrikedcs]

Hi @copia-jstanley thanks for the question! Taking a look at the repsonse from this API I can see the data points of interest. Is the issue still occuring for you? Does the timestamp in the UI show the same as what is returned from FalconPy? Attaching some responses that I can see in my view. You can see as well that these times differ for me.

Also if you could share of the modified code snippet as well where the change was made.

[crowdstrikedcs]

I think the item to keep in mind here is that we return the last "interactive" login https://supportportal.crowdstrike.com/s/article/Release-Notes-Last-Logged-in-User-Account-in-Host-Management

I see this note as well on the release note:

Note: Interactive users are determined using heuristic models that may not be 100% accurate....