Query
Check for Falcon AcUninstallConfirmation Event Followed by no Heartbeat Events
LogScale · Investigation & Troubleshooting · v1 · @sebastian · 25.7.2026
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Falcon AcUninstallConfirmation Event Followed by no Heartbeat Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Falcon%20AcUninstallConfirmation%20Event%20Followed%20by%20no%20Heartbeat%20Events.md
DetectionEndpointInvestigationTroubleshooting
Query contentv1
Download v1Loading editor…
Version history
Every save keeps the previous content. Open any version to view or download it.