// Restrict search to Windows systems in AID Master
| readFile([aid_master_main.csv])
| event_platform=Win
 
// Parse AgentVersion into individual components for evaluation
| AgentVersion=/^(?<majorVersion>\d+)\.(?<minorVersion>\d+)\.(?<buildNumber>\d+)\./

// Check for updated version
| case {
      // Handles 8+
      majorVersion>7                                    | Status:="OK";
      // Handles 7.29+
      majorVersion=7 minorVersion>28                    | Status:="OK";
      // Handles 7.28
      majorVersion=7 minorVersion=28 buildNumber<=20006 | Status:="HOTFIX AVAILABLE";
      majorVersion=7 minorVersion=28 buildNumber>=20008 | Status:="OK";
      // Handles 7.27
      majorVersion=7 minorVersion=27 buildNumber<=19907 | Status:="HOTFIX AVAILABLE";
      majorVersion=7 minorVersion=27 buildNumber>=19909 | Status:="OK";
      // Handles 7.26
      majorVersion=7 minorVersion=26 buildNumber<=19811 | Status:="HOTFIX AVAILABLE";
      majorVersion=7 minorVersion=26 buildNumber>=19813 | Status:="OK";
      // Hanldes 7.25
      majorVersion=7 minorVersion=25 buildNumber<=19706 | Status:="HOTFIX AVAILABLE";
      majorVersion=7 minorVersion=25 buildNumber>=19707 | Status:="OK";
      // Handles 7.24
      majorVersion=7 minorVersion=24 buildNumber<=19607 | Status:="HOTFIX AVAILABLE";
      majorVersion=7 minorVersion=24 buildNumber>=19600 | Status:="OK";
      // Handles 7.16 Windows 7
      majorVersion=7 minorVersion=16 buildNumber<=18635 | Status:="HOTFIX AVAILABLE";
      majorVersion=7 minorVersion=16 buildNumber>=18637 | Status:="OK";
      // Handles all other 7 versions
      majorVersion=7 minorVersion<24  | Status:="OUT OF SUPPORT - UPDATE SENSOR";
      // Handles all other versions
      majorVersion<7                  | Status:="OUT OF SUPPORT - UPDATE SENSOR";
      // Catch all for logic errors
	  * | Status:="UNKNOWN";         
}

// Add CID Name
| join(query={$falcon/investigate:cid_name()}, field=[cid], include=[name], mode=left, start=1d)

// Modify field names for easier reading
| rename([[name, "Customer"], [cid, "Customer ID"],[aid, "Agent ID"], [event_platform, Platform], [aip, "External IP"]])

// Aggregate results into tabular format with cleaner ordering
| groupBy([Customer, "Customer ID", ComputerName, "Agent ID", Platform, Version, AgentVersion, Status, "External IP", LocalAddressIP4, MAC, SystemManufacturer, SystemProductName, FirstSeen, Time], function=[], limit=max)
 
// Set default values for easier reading
| default(value="-", field=[Customer, ComputerName, Version, AgentVersion, Status, LocalAddressIP4, MAC, SystemManufacturer, SystemProductName, FirstSeen, Time], replaceEmpty=true)
 
// Move timestamps from epoch to human readable
| formatTime(format="%F %T", as="FirstSeen", field=FirstSeen)
| formatTime(format="%F %T", as="LastSeen", field=Time) 

// Remove unnecessary field
| drop([Time])