search

CrowdStrike / psfalcon

PowerShell for CrowdStrike's OAuth2 APIs
The Unlicense
366 stars 69 forks source link

Last Logon timestamp of CS Falcon user #314

Closed simonjTMCZ closed 1 year ago

simonjTMCZ commented 1 year ago

Description of your question Would it be possible to include last logon date/time of a CS Falcon user in a result of Get-FalconUser call? We are trying to build some access management for one of our customers and "stale accounts" is one of their use-cases. (Apologies if some other PSFalcon command already provides such information)

Expected behavior Get-FalconUser will return something like this: uuid : d1111111111111111111b2 cid : 3b11111111111111111111184 uid : firstname.surename@t-mobile.cz first_name : Firstname last_name : Surename last_logon : YYYY-MM-DD

Environment (please complete the following information): OS: Windows 10 PowerShell: 5.1.19041.2673 PSFalcon: 2.2.4

bk-cs commented 1 year ago

Unfortunately, there is no API available that produces this information directly. As far as I can tell, it's only available within the Falcon UI.