Looking for other people who have used ‘max_days_since_last_vm_scan' on 'fo/asset/host/vm/detection' endpoint. Currently, I'm using this as 'max_days_since_last_vm_scan=1' - However I'm finding some data differences between the report and what the portal shows. Does anyone know if 'max_days_since_last_vm_scan=1' means (My job runs at 6:00pm daily):
- • Show me all hosts scanned and processed in the past (1) calendar day (IE: 12:00am to 6:00pm (when the API call is run)). This would account for missing data.
- • Show me all hosts scanned and processed yesterday.
- • Show me all hosts scanned and processed in the past 24 hours (6:00pm yesterday to 6:00pm today).
Laura Seletos 
Jun 6, 2018 1:02 PM
Jun 6, 2018 1:02 PMCorrect Answer
- For "max_days_since_last_vm_scan=1" it works by checking the last calendar day as there are no notes stating it works off a YYYYMM-DD[THH:MM:SSZ] format
- I would probably use vm_scan_since={date} so I could calculate the time slot to minutes if needed:
- (Optional) Show hosts scanned and processed since a certain date and time (optional). The date/time is specified in YYYYMM-DD[THH:MM:SSZ] format (UTC/GMT), like “2007-07-01” or “2007-01-25T23:12:00Z”
See the reply in context