Cortex Doubt Operations

Alpalo — Thu, 27 Jan 2022 11:06:58 GMT

Hello everyone;

Cortex:
The console reports 481 agents of which it gives with lost connection 110, in the licensing section it indicates 371 agents installed of the 500 licensed, so it seems that it does not take into account those of lost connection, I wanted to confirm this extreme since, according to the panel, we could be close to rushing the license.

We use DHCP in the workstations, it is frequent to change the name and even the address of the computers, due to fleet renewal, staff rotation or change of vlan, and with the on-site access frequently interrupted by the pandemic, there may be computers -few- that are not turned on for months.

How does Cortex understand that an agent is unique? Is it univocally identified in the computer that is installed regardless of its name or IP address? If the computer with a complete image is replatformed, does it still count the old agent, which will no longer respond, in addition to the new one? In the list of agents, there are computers with both name and IP address repeated, even some with both, how could we avoid these duplicates?

Thanks in advance.
Best regards.

Re: Cortex Doubt Operations

OriNahir — Thu, 27 Jan 2022 18:25:21 GMT

It appears that your question is around Cortex XDR, however, this discussion board is for Cortex XSOAR, i would suggest to post your question in the dedicated Cortex XDR discussion board (https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/bd-p/Analytics_Discussions)
if your question is about Cortex XSOAR, can you please elaborate on what exactly your issue is?

topic Cortex Doubt Operations in Cortex XSOAR Discussions

Cortex Doubt Operations

Re: Cortex Doubt Operations