Is there a way we can detect is someone uninstalle...
# fleet
o
Is there a way we can detect is someone uninstalled or stopped the osquery agent on a host?
l
One easy way I can think of is: In the
Hosts
tab, select
Edit columns
, select only
Last fetched
, then click on
Export hosts
, and finally filter the exported CSV by inspecting. the "Last fetched" timestamp. "Last fetched" is the last time Fleet was able to ingest data from the host.