admin applied agent tags
cancel
Showing results for 
Search instead for 
Did you mean: 

admin applied agent tags

L1 Bithead

I have a few XDR deployments I manage and one this I miss is the ability to tag objects like I can on firewalls.

 

This would be useful for a number of tasks from:

- filtering views/dashboards/reports

- adding agents to dynamic agent groups

- assigning policies to agents

 

Often hardware or OS level details are not variable enough to filter and having to manage static groups to handle things can get clunky where tags on an agent would allow the admin to move agents in and out of different policies/groups easily.

3 REPLIES 3

L4 Transporter

Hi @Brett_Hobbs ,

 

This is possible by applying "Endpoint Aliases" to your endpoints. Once configured, you can group dynamically by the alias, focus dashboards, and reports based upon that group and apply policies based upon either the group or the alias.

 

Click here for more information on Endpoint Aliases.

--gjenkins

Hi,

Yes that is an option however it is not as flexible as being able to add and remove tags. Also we already use the alias for another use. We are applying group membership based on alias and policy based on group/alias it would be helpful if we had tags to quickly apply a policy to a single endpoint should the need arrive if we have to override a setting for a specific use case where we don't want to apply it to the whole group or have to manually update a policy to apply to individual agents.

That's completely understandable, @Brett_Hobbs. In this case, I would recommend opening a feature request with your Account team so that the Cortex XDR Product team can consider the feedback provided.

--gjenkins
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!