Cisco AMP Active Connectors

[Julios Nahuero Balbin]

Is there a way to know what computers are the active connector that the report gives, i can see the number but i need to know wich computers are active and wich not.

[Marvin Rhoads]

You cannot get that via an AMP for Endpoints report.

However if you go into the console under Management > Computers and choose "Export to CSV" you will get a listing that includes the following fields:

Connector GUID,Hostname,Operating System,Connector Version,Group,Install Date,Last Seen,Internal IP,External IP,MAC Addresses,iOS Serial Number,Connector Antivirus,Last Definitions Update,Last Definitions Update Failure

"Last Seen" is a pretty good indicator of an active installation. Of course the computer could have been turned off for a month but that's an outlier data point. 

[David Janulik]

You can use "Last Seen" to filter out endpoints over certain time period.

[David Janulik]

Computers > filters

[Marvin Rhoads]

Yes @David Janulik but how can one (in the GUI) show only computers seen UNDER 7 days ago? (i.e., active computers)