Describe the bug
The current saved search performs a dedup on the falcon ID. The unintended result is that it removes additional interfaces that a single host may have.

To Reproduce
n/a

Expected behavior
List all MAC/IP addresses for a single host.

Screenshots
n/a

Versions (please complete the following information):

• Splunk ES Version: 7.0
• Splunk Version: 9.0
• SA-CrowdstrikeDevices Version: 1.0.1
• Crowdstrike Devices add-on (TA) Version: 3.1

Additional context
potential fix is to add mac to the dedup.