Issue
I would like to use the Red Canary API to download a list of users that are active in our environment and the endpoints that they have been observed on.
Environment
Red Canary
Crowdstrike Falcon
Resolution
Generally, this information would be present in Red Canary via Identities > Endpoint Usage. However, since the Crowdstrike platform does not currently collect the username and uid for each process that runs on each of your endpoints, polling for this data is not possible.