To get the activity that occurred before the agent was installed into the LimaCharlie, you would want to use our Artifact Ingestion functionality.

For example, on Windows machines you can configure Artifact Ingestion (or do it manually via the artifact_get command) to get the raw Windows Event Logs from the endpoint containing old records.

Did this answer your question?