The primary and most direct indicator of an inactive CrowdStrike Falcon sensor within the console is its "Last Seen" timestamp. This timestamp records the last successful communication between the sensor and the Falcon cloud. Sensors are expected to check in at regular intervals. If the "Last Seen" time is older than this expected interval, it signifies that the sensor is not communicating and is therefore considered inactive or offline. This metric is the fundamental data point from which other status indicators are derived.

A. The "Inactive" status is a label or filterable state that is determined by the "Last Seen" timestamp exceeding a specific threshold (e.g., 45 days), making the timestamp the more primary indicator.
B. If the Falcon sensor is not installed on an endpoint, the host would not be registered or visible in the Falcon console to have a status in the first place.
C. The "Threat Detection" tab is for viewing and managing security alerts and detections. A sensor's connectivity status is an administrative/operational issue found in Host Management, not a security threat.

1. CrowdStrike, Inc. (2023). Falcon Platform: Host Management. In the official CrowdStrike Falcon documentation, the "Hosts" page within the "Host management" app is described. The "Last Seen" column is explicitly defined as the "Date and time the host was last seen by the CrowdStrike cloud." This is the core field used to determine host connectivity and is the basis for filtering for offline or inactive hosts. (Section: "Hosts and host details," subsection: "Hosts page details").

2. University of California, Berkeley - Information Security Office. (2022). Endpoint Detection & Response (EDR) Service FAQ. In their public documentation for the campus EDR service, they state: "The 'Last Seen' field in the Falcon console indicates the last time a device checked in. If this date is not recent, it may indicate a problem with the sensor on the device." This corroborates that the "Last Seen" timestamp is the key metric for assessing sensor activity. (Section: "Troubleshooting," FAQ entry on sensor status).

3. Carnegie Mellon University - Software Engineering Institute (SEI). (2021). A Framework for Evaluating and Adopting Endpoint Detection and Response. CMU/SEI-2021-TR-006. This technical report, while not specific to CrowdStrike, outlines the core functionalities of EDR solutions. It emphasizes the importance of agent "health and status monitoring," where the agent's last check-in or "heartbeat" time is the fundamental metric for determining if the agent is active and communicating with the management console. (Section 3.2.4, "Agent Management").