[ QUESTION ] Obtain more network address history for a particular host?

[mpetitb]

Using Get-FalconHost and the "-Network" flag (or -Include network_history), there is a way to retrieve the IP/MAC history of an host (and the corresponding last_seen_date for that mac/ip combo)

However, using the Console, we are not limited to the "last_seen_date" : we actually have the full network history of the hostname : FROM_date and TO_date

Looking at the swagger API, there doesn't seem to have any way to retrieve this information but I could be wrong : is that possible?

Thanks

[bk-cs]

The only IP/MAC address history that I'm aware of is provided by the POST /devices/combined/devices/network-address-history/v1 API, which is used by Get-FalconHost -Id <id> -Network and Get-FalconHost -Include network_history. The data is limited to whatever is provided by the API.

You may be able to find more history using the Host Timeline in Falcon Exposure Management or a Falcon NGSIEM search.