topic Re: Host insights enabled, yet only 12% have any CVE information. How to troubleshoot? in Cortex XDR Discussions

Host insights enabled, yet only 12% have any CVE information. How to troubleshoot?

PC-TomS — Tue, 12 Sep 2023 23:45:10 GMT

We've been running XDR Pro per endpoint since late 2022 with the host insights add-on licensed and enabled for all endpoints.
CVE data exists for around 12% of the endpoints and include every OS, etc... no rhyme or reason why some work, but most do not.
I cannot determine why it is or isn't working on all endpoints and don't know of a way to troubleshoot it.

Anyone else having this issue?

Re: Host insights enabled, yet only 12% have any CVE information. How to troubleshoot?

nsinghvirk — Wed, 13 Sep 2023 13:40:21 GMT

Hello @PC-TomS

Thanks for reaching out on Live Community!

There are few pointers we need to clarify before we can suggest some solution.

1. Do you have enough number of Host Insight licenses? Since Host insight is an add-on separate from pro license, many times it happen that customer do not buy equal number licenses as compare to their pro licenses. So host insight will only work for the number of endpoints for which add-on was bought.

2. Please verify if Host Insight was enabled for all the endpoints. When we have multiple profiles, it can happen that we may miss out on some profiles for which host insight capability was not enabled. Please ensure that all the profiles for which you want to enable host insight, you go to the agent setting profile and then first enable the pro capabilities(Disabled by default) and then enable host insight capability(Enabled by default) along with the sub menu for Endpoint Information Collection.

3. Please follow below document to verify if your endpoints meet the requirement for vulnerability assessment.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Vulnerability-Assessment?tocId=1asxAZOcVriCZCDhfe0jQQ

Re: Host insights enabled, yet only 12% have any CVE information. How to troubleshoot?

PC-TomS — Fri, 15 Sep 2023 18:46:38 GMT

Thanks anyway for trying, this is now a support case.

To answer your questions:

We have enough licenses.
It is enabled on all endpoints.
All endpoints meet the requirements.

Tom

Re: Host insights enabled, yet only 12% have any CVE information. How to troubleshoot?

BFournier — Wed, 01 May 2024 17:42:41 GMT

Did you find a solution? I have the same issue.

Re: Host insights enabled, yet only 12% have any CVE information. How to troubleshoot?

RFeyertag — Wed, 01 May 2024 20:12:46 GMT

I would try to reinstall an agent. We had also some likely issues. In our case we hadn't enough licenses, bought some, but the agents didn't get the information to push the data. We had to reinstall the agent.

Rob