Need to know about the falconpy.io api response .

[Rohan-Kar]

Hello everyone I just try with the falconry and got the device details. so inside the device details
1> i got like this "modified_timestamp": "2023-06-09T18:06:07Z", "meta": { "version": "12345", "version_string": "2:15895456484651"

explain to me what is this mean is this related to the endpoint security update?

2 > one more thing is the last seen in the api response. Is this thing related to the user's last login time?

Thank you

[crowdstrikedcs]

Hi @Rohan-Kar Thanks for the question!

modified_timestamp represents the zulu time at which the device record was updated on the CrowdStrike side. For example say we update a devices prevention policy. This update would cause the modified_timestamp to be updated. Typically this timestamp is used to pull delta changes between integration runs so that initially one may pull in all device details and then moving forward use the modified_timestamp as part of an FQL filter. For example:

response = falcon.QueryDevicesByFilter(
                                       filter="modified_timestamp:>'2023-06-08T15:13:22Z'"
                                       )

The last_seen timestamp indicates the zulu time at which the device was last connected by the CrowdStrike cloud. Indicating the devices last online state. This updated about every 15 minutes and can additionally be used as an FQL filter.

Let us know with any more questions 😄

[Rohan-Kar]

Hello @crowdstrikedcs Thanks for the valuable information. I have one more question some of the api i got the 200 status code and some of the api got the 403 status code . let me know which api have what kind of permission needed also i need specific api crowdscore and getdetectsummaries what kind of permission need from the admin portal .

Thank you

[crowdstrikedcs]

For this you will need read permissions for the Detections and Incidents scopes.

[Rohan-Kar]

@crowdstrikedcs Thanks for the guide