Best way to detect endpoints that do not yet have Cortex XDR Agent installed

[DKasabji]

Hey guys,

I am curious about if there is a way to find out which Endpoints in certain environment do not yet have XDR Agent installed.

I still two options, but had no practical experience in testing it:

1. Directory Sync with Cortex XDR. Would it detect endpoints (which are in AD) that do not have XDR Agent yet installed?
2. Pathfinder. Would Pathfinder be something useful to detect such cases, even for those that are not in AD?

Any other option?

Thanks.

D

[ESJosephPrinz]

@WRoodhooft You would be correct.  I have spent 4 months working on this.  Started with the broker, net mapper and then when that didnt work, pathfinder per cortex support. They were incorrect.   Then tried the new 7.5 agent network discovery feature.. could not get that to work (nothing reported to asset manager). Now on dhcp Log collector.  The dhcp log collector is the closest we have gotten. However; while it is currently providing the name of the hosts to asset manager, the mac address is not in sync when hosts move from wlan to lan and visa versa so it is reporting false negatives. Currently working with cortex engineers to see if we can correct this but I suspect that the Cortex XDR agent is delaying the network adapter change so the mac addresses wont align and I dont know if that is going to be correctable. AT LEAST we have something actionable.. we have thousands of nameless IP's in the asset manager and this allows us to spot check what does show up.. BUT I have some concerns because thus far, DHCP log collector has not provided a single host name where XDR is installed (3 days now).. so something doesnt smell right.   

[Rashele-Shoun]

Really good information here! Thank you!