Enquiry about the VQL for datetime

[stephenttt626]

May I ask if the VQL can do the query with datetime like "selecting the latest 7 days result" rather than defining a specific datetime? Many thanks.

[Mike Cohen]

Im not sure what you are asking here? You can see all the collections from a specific client using the flows() plugin https://docs.velociraptor.app/vql_reference/server/flows/ and the flow object has a last active time and a state.

For example to know all the flows on a client that occurred in the last 24 hours

SELECT * FROM flows(client_id="C.8cfee3cef5dc6915")
WHERE state =~ "FINISHED" AND timestamp(epoch=active_time) > now() - 60 * 60 * 24