// Illustrative hunt; not executed in a live Sentinel or Falcon tenant.
// Sentinel DeviceInfo ingestion is required; this is not a universal Sentinel inventory table.
// Replace the example inventory with authoritative server FQDNs. Never infer inventory solely from EDR.
// Seven-day snapshot, flag older than one day or unhealthy/unonboarded; at most 100 leads.
let Inventory=datatable(AssetName:string)["REPLACE_WITH_SERVER_FQDN_1","REPLACE_WITH_SERVER_FQDN_2"]
    | extend AssetKey=tolower(AssetName);
let Sensors=DeviceInfo
    | where TimeGenerated between (ago(7d) .. now())
    | summarize arg_max(TimeGenerated, DeviceId, SensorHealthState, OnboardingStatus) by AssetKey=tolower(DeviceName)
    | project AssetKey, LastSeen=TimeGenerated, DeviceId, SensorHealthState, OnboardingStatus;
Inventory
| join kind=leftouter Sensors on AssetKey
| where isnull(LastSeen) or LastSeen < ago(1d)
    or OnboardingStatus !~ "Onboarded" or SensorHealthState !~ "Active"
| project AssetName, LastSeen, DeviceId, SensorHealthState, OnboardingStatus
| order by AssetName asc
| take 100