I’ve been trying to write a SQL report that uses fact_asset_discovery.last_discovered, but was surprised to find that it does not reflect contacts from the Rapid7 Insight Agent. The Last Scan column on the Assets page does, however. Is there anything analogous to the Last Scan value in the reporting schema? There seems to be hardly any mention of the agent in the reporting schema documentation.
I also tried querying for the max value from dim_asset_scan.scan_finished, but that was no help.
Without going into much more detail, at the heart of this problem is the fact that we have corporate laptops running the agent which haven’t connected to the network in, sometimes, months, so they have not been scanned but we know they’re alive. (The fact that they show up in InsightVM data with an IP address from an employee’s home network is another bother associated with these assets.)