A sensor that has not contacted the Falcon cloud will be automatically deleted from the hosts list after how many days?

The CrowdStrike Falcon platform has a built-in data retention policy to manage host inventory. A host is considered inactive if its sensor has not communicated with the Falcon cloud for an extended period. By default, any host that remains inactive for 45 consecutive days is automatically removed from the Host Management view in the Falcon console. This process, often referred to as sensor aging, ensures that the list of managed hosts remains current and accurate, reflecting only actively protected endpoints.

B. 60 Days: This is an incorrect timeframe. The standard inactivity period before automatic removal is 45 days, not 60.
C. 30 Days: This is an incorrect timeframe. While some systems use a 30-day cycle, Falcon's default is longer at 45 days.
D. 90 Days: This is an incorrect timeframe. The platform removes inactive hosts much sooner than 90 days to maintain a clean inventory.

1. CrowdStrike Falcon Platform Documentation, Host and sensor management: In the section detailing the sensor lifecycle and host inventory, the documentation specifies the automatic removal policy. It states, "To keep your host inventory current, hosts that have been inactive for 45 days are automatically removed from the Falcon console." (Note: This documentation is typically available to customers via the Falcon support portal).

2. CrowdStrike University, CCFA-200b Falcon Administrator Courseware, Module: Host and Sensor Management: The course material explicitly covers host lifecycle management. It details that hosts are marked as inactive and subsequently removed from the console after a 45-day period of no contact with the Falcon cloud. This is presented as a key administrative feature for maintaining environment hygiene.