This query will show the last successful access for all Hosts, Network Devices, and SNMP Managed Devices:
 

Prior to running the query, replace <appliance-name> with the actual hostname or IP address of the appliance.

Since the search is done on more than one node kind, it displays what is called a multi-kind result.  When selecting the Hosts, the results show the host name, the last credential ID, credential type, last Windows proxy, and a credential URL.

Note that the query does not return the credential name, only the unique credential identifier. The search service intentionally does not have access to credential information, for security reasons. 

The credential type relates to the type of Discovery done. There could be multiple credential types listed. For example, if a Host was running a Microsoft SQL Server, there could be a credential for the Host and also a credential for the database.

Hosts that reside in a cloud are discovered via the cloud credential. For these, no credential ID is set. 

The "last Windows proxy" field will only be populated for Windows scans where a credential proxy was used. This field will contain either the credential proxy name or "Outpost_Credential_Proxy" if the scan was run from an Outpost. 


To retrieve the last access regardless of result, use this query:
 

Prior to running the query, replace <appliance-name> with the actual hostname or IP address of the appliance.

The credential id obtained in either of the previous queries can be used in the following query to return the host name of all hosts that have used the credential in their last access:
 

For example:
 

To look up the credential itself, enter the 'Credential URL' from the first query in a browser: http://<appliance-name>/ui/Credential?uuid=<credential id>

Replace the <appliance-name> and <credential id> as appropriate.


To look up credentials for cloud services, use this query:
 

Prior to running the query, replace <appliance-name> with the actual hostname or IP address of the appliance.