topic Re: How to create group in Cortex XDR Discussions

How to create group

RajeshPremSingh — Thu, 04 May 2023 10:35:47 GMT

we want to create a group on the cortex console but we have the below concern

how to we add all the endpoints to the group
if any new endpoint is newly connected how to automatically added in the group

Re: How to create group

bbucao — Thu, 04 May 2023 14:12:47 GMT

Hi RajeshPremSingh,

It sounds like you want to create a Dynamic Group. In order to do this, when you are in the Create New Endpoints Group page, use the available filters to define the criteria you want for existing and future endpoints to be included in that group. This could be things like filtering on the operating system field, or endpoint name field, or based on specific endpoint tags. When creating a Dynamic Group make sure you do not manually select any endpoints in the table as that will override your filter and only include the selected endpoint(s) and turn your group into a Static Group. The Create button at the bottom right of the screen will change to indicate which type of group you are creating. Hope this helps!

Regards,
Ben

Re: How to create group

RajeshPremSingh — Fri, 05 May 2023 05:16:18 GMT

1 .we need to create a static group

2. how to select all the endpoints because it we tough to select all the endpoints manually

3. we don't have a domain. and we might need to remove some endpoints from the group in future

Re: How to create group

PiyushKohli — Fri, 05 May 2023 10:25:41 GMT

Hi @RajeshPremSingh

Regarding your use case to add all endpoint to group and automating it to add in the group if any new endpoint is newly connected. You won't be needing a domain as mentioned earlier by Ben you can achieve it by using endpoint tags. Using API you can assign tags to all those endpoints and can create an Endpoint Group by selecting that tag thus the group will be dynamic. This way you will be able to add all endpoint to that group at once and not manually.

In another case where you might need to remove some endpoints from group in future, using api again you may remove the tags from that endpoint and that endpoint will be removed from that endpoint group.

For dynamic Endpoint group you may refer to Cortex XDR How-To Video: Endpoint Group.

API

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Thanks