admin applied agent tags

[Brett_Hobbs]

I have a few XDR deployments I manage and one this I miss is the ability to tag objects like I can on firewalls.

This would be useful for a number of tasks from:

- filtering views/dashboards/reports

- adding agents to dynamic agent groups

- assigning policies to agents

Often hardware or OS level details are not variable enough to filter and having to manage static groups to handle things can get clunky where tags on an agent would allow the admin to move agents in and out of different policies/groups easily.

[gjenkins]

Hi @Brett_Hobbs ,

This is possible by applying "Endpoint Aliases" to your endpoints. Once configured, you can group dynamically by the alias, focus dashboards, and reports based upon that group and apply policies based upon either the group or the alias.

Click here for more information on Endpoint Aliases.

[Brett_Hobbs]

Hi,

Yes that is an option however it is not as flexible as being able to add and remove tags. Also we already use the alias for another use. We are applying group membership based on alias and policy based on group/alias it would be helpful if we had tags to quickly apply a policy to a single endpoint should the need arrive if we have to override a setting for a specific use case where we don't want to apply it to the whole group or have to manually update a policy to apply to individual agents.

[gjenkins]

That's completely understandable, @Brett_Hobbs. In this case, I would recommend opening a feature request with your Account team so that the Cortex XDR Product team can consider the feedback provided.