Falcon Sensor Support Status

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: Falcon Sensor Support Status

# Description of what the query does and its purpose.
description: This query lists all active falcon sensors including their release date and support end date.

# The author or team that created the query.
author: CrowdStrike

# The required log sources to run this query successfully in Next-Gen SIEM.
# This will be displayed in the UI to inform the user.
log_sources:
  - Endpoint

# The CrowdStrike modules required to run this query.
cs_required_modules:
  - Insight

# Tags for filtering and categorization.
# Include relevant techniques, tactics, or platforms.
tags:
  - Monitoring

# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
# Using the YAML block scalar `|` allows for multi-line strings.
cql: |
  #repo=sensor_metadata #data_source_name=aidmaster #data_source_group=aidmaster-api
  | groupBy([aid], function=([selectFromMax(field="@timestamp", include=[ComputerName, Time, Version, ConfigIDBuild, AgentVersion])]))
  | match(file="falcon/helper/sensors_support_info.csv", field=ConfigIDBuild, column=BUILD, ignoreCase=true, strict=true)
  | parseTimestamp("M/d/yy",field=SUPPORT_ENDS, as=SUPPORT_ENDS_EPOCH, timezone="UTC")
  | case{
      test(now()>SUPPORT_ENDS_EPOCH) | SUPPORTED:="NO";
      * | SUPPORTED:="YES";
  }
  | groupBy([PLATFORM, VERSION_FAMILY, SUPPORTED], function=([count(aid, as=Count), collect([RELEASE_DATE, SUPPORT_ENDS])]))