Skip to main content
NOTICE: Support has moved to the Zscaler Customer Support portal. To access support, log into Zscaler MDR, click your user icon (top right), and select Support Portal.
Go to Zscaler MDR Documentation
Zscaler MDR Support

Unable to pull list of end users and endpoints they have used

  • Updated .

Issue

I would like to use the Red Canary API to download a list of users that are active in our environment and the endpoints that they have been observed on.

Environment

Red Canary

Crowdstrike Falcon

Resolution

Generally, this information would be present in Red Canary via Identities > Endpoint Usage. However, since the Crowdstrike platform does not currently collect the username and uid for each process that runs on each of your endpoints, polling for this data is not possible.