Which report in the CrowdStrike Falcon platform is most suitable for reviewing host activity to ensure inactive hosts are appropriately monitored or removed?

The Sensor Last Seen Report is specifically designed to provide visibility into host connectivity. It lists hosts and the last time their Falcon sensor communicated with the CrowdStrike cloud. This report is the most direct and efficient tool for identifying inactive or "stale" hosts that have not checked in for a specified period. Security administrators use this information to investigate potential issues with the sensor, confirm if a host has been decommissioned, and maintain a clean and accurate inventory, thereby ensuring all active assets are appropriately monitored.

B. Host Audit Report: This report tracks configuration changes and administrative actions performed on host records within the Falcon console, not the operational connectivity status of the sensor itself.
C. Host Group Membership Report: This report is used for managing and verifying which hosts belong to specific policy groups. It does not provide data on host activity or last seen status.
D. Application Inventory Report: This report provides a list of installed applications across the host environment for inventory and vulnerability management purposes, not for tracking host activity.

1. CrowdStrike, Inc. (2023). Falcon Platform User Guide. "Scheduled Reports". This guide details the various report types available in the Falcon platform. The "Last Seen" report is explicitly described as a tool to identify hosts that have not connected to the Falcon cloud within a specified timeframe, making it ideal for managing stale host records. (Note: Access to the official user guide typically requires a customer account on the CrowdStrike Support Portal).

2. SANS Institute. (2022). Endpoint Protection and Response. Courseware for SEC503: Intrusion Detection In-Depth. The course material discusses the importance of maintaining an accurate asset inventory in endpoint security platforms. It highlights that tracking the "last seen" or "last check-in" time is a fundamental capability for identifying unmonitored or decommissioned assets, a function directly served by reports like CrowdStrike's Sensor Last Seen.