https://github.com/osquery/osquery logo
Title
o

Ojas

06/15/2022, 8:52 AM
Is there a way we can detect is someone uninstalled or stopped the osquery agent on a host?
l

Lucas Rodriguez

06/15/2022, 3:19 PM
One easy way I can think of is: In the
Hosts
tab, select
Edit columns
, select only
Last fetched
, then click on
Export hosts
, and finally filter the exported CSV by inspecting. the "Last fetched" timestamp. "Last fetched" is the last time Fleet was able to ingest data from the host.