#
Force initial build
Optional
The initial build of the CrowdStrike assets will not occur until the first scheduled runtime (see Update default saved search schedule). To force the initial build perform the following:
- Navigate to Settings > Searches, reports, and alerts.
- Set the "App" dropdown to
SA-CrowdstrikeDevices
. - Set the "Owner" dropdown to
All
. - Click "Run" under actions for the search
CrowdStrike Devices Lookup - Gen
.
Note
The search will run in a new tab over the default time period of 60 minutes. Expand the timeframe to a larger window if the number of hosts in the last 60 minutes does not seem accurate. The default search is configured to run hourly to continually append new devices reported from CrowdStrike.