Calculate Last Windows Boot Time

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: Calculate Last Windows Boot Time

# Description of what the query does and its purpose.
description: Outputs the last reboot timestamp and calculates the time elapsed since then.

# The author or team that created the query.
author: CrowdStrike

# The required log sources to run this query successfully in Next-Gen SIEM.
# This will be displayed in the UI to inform the user.
log_sources:
  - Endpoint

# The CrowdStrike modules required to run this query.
cs_required_modules:
  - Insight

# Tags for filtering and categorization.
# Include relevant techniques, tactics, or platforms.
tags:
  - Monitoring

# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
# Using the YAML block scalar `|` allows for multi-line strings.
cql: |
  #event_simpleName=AgentOnline event_platform=Win  
  | groupBy([aid], function=([selectLast([BaseTime])]))
  | LastReboot_milli:=(BaseTime/1000*1024)+978307200
  | round("LastReboot_milli")
  | LastRebootAgo:=now()-(LastReboot_milli*1000)
  | formatDuration("LastRebootAgo", precision=2)
  | LastReboot:=formatTime(format="%F %T %Z", field="LastReboot_milli")