HackBlue

Tools · Endpoint visibility · 20 / 25

Velociraptor: last seen is not the collection time

Last seen is when the client last checked in. The flow start and end are when that collection ran. Write both clocks, and do not describe yesterday’s rows as if they were taken at the check-in.

12 min read · practice only with authorization

Last seen is a check-in

The client record has a last-seen time. That is the latest time the server heard from that enrollment. It says the client was in contact then. It does not say an artifact ran then, and it does not move older flows forward.

A client that is online this morning can still have a flow that finished yesterday. The check-in does not redate the flow.

The flow has its own start and end

A finished flow stores when it was created and when it completed. Rows you download from that flow were produced between those times, on that client id. Quote the flow’s clock when you say when the table was collected.

If the flow page does not show a start time, write “flow time not opened.” Do not substitute last seen.

What to file

File the client id, last seen, the flow id, and the flow’s start and end. Label each time. A sentence about “when we collected this” uses the flow. A sentence about “when the client was last in contact” uses last seen.

Worked case: online now, collected yesterday

Client C.333 was last seen at 2026-11-04T08:05:00Z. Flow F.300 on that client started at 2026-11-03T16:10:00Z and finished at 2026-11-03T16:12:00Z. A draft says the process table was collected this morning because the client is online.

The note quotes last seen as the morning check-in and F.300’s start and end as the collection. The rows are yesterday’s flow. The morning contact does not refresh them.

Snippet
client: C.333
last seen: 2026-11-04T08:05:00Z
flow: F.300
flow start: 2026-11-03T16:10:00Z
flow end: 2026-11-03T16:12:00Z
write: rows are from F.300
not: collected at the morning check-in

Diagram

Two clocks on one client

Contact and collection are different events.

  • Last seen

    When this enrollment last checked in. Not a collection.

  • Flow start and end

    When that flow ran. This is the collection clock.

  • Rows

    Belong to the flow whose file you opened.

  • A later check-in

    Does not move the flow’s clock forward.

Check yourself

1. The client was last seen this morning, and the flow finished yesterday. When were the rows collected?

2. What does last seen support?

3. The flow page was not opened, so no start time was copied. What do you use instead?