Is it possible to trigger insights collection on multiple hosts?

[Piotr_Kowalczyk]

Hi,

I know that I can go to Endpoint Data -> Open Asset View -> Open Asset View in new tab and then use "Run Insight collection" but from time to time I need to do this on around 50 hosts so this option is not really practical. I wasn't able to find any option which allows me to trigger this on multiple host, is it possible?

[aspatil]

Hello,

Thank you for writing to Live community!

Cortex XDR will calculate host insights for all the endpoints where the license can be applied(considering that the quota is not exceeded) every 24 hours. On the window of the module you want to view, also states beside the header, the last calculation timestamp for Cortex XDR host insights collection. 

Unfortunately, the expected use case cannot be achieved as of now. Could you please help me with the reason to run the insight collection manually?

[Piotr_Kowalczyk]

Hi,

Thank you for your reply,

The reason is: I want to check if some software was updated to particular version and would like to have data up to date, without potential 24 hours delay. Is any way to display last insight collection timestamp in the host table instead of going to Asset View?

[aspatil · Accepted solution]

Hello,

Running manually on multiple endpoints is not the recommended option, as it creates a performance issue on Agent and the Dashboard as well while collecting data and events. Hence, it is scheduled for 24 hours. If you are just concerned about the software updates, you can follow below actions:

1. Go to Incident Response--> Investigations--> Host Inventory

2. Select Applications and click on Recalculate. 

Even Vulnerability Assessment option has option to "Recalculate".

The Recalculate option will trigger calculation and updation of host insights information for the Cortex XDR and the agents will send the insights data upon next data upload cycle. Please note that this can take a minimum of 6 hours for recalculation of information and to be able to populate data accordingly. 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query. 

[Piotr_Kowalczyk]

Is looks like what I'm looking for but just to clarify just to make sure I understand the process correctly. Once I trigger recalculation, the Cortex XDR server requests new application information form agents and then update them in the console?

[aspatil]

Hello,

That's right!!

[Piotr_Kowalczyk]

Many thanks. This was what I was looking for! I thought recalculation is just internal Cortex process and has nothing to do with updating endpoint data.