Cleanup XDR Endpoints

[tlmarques]

How can we clean up (delete/remove) the old endpoints that are still registered on Cortex XDR ?

Is there any automation available for this, or do we need to remove them manually?

[susekar]

Hello @tlmarques ,

Greetings for the day.

• Automated Cleanup: Cortex XDR has a default purge policy that removes endpoints that have not connected for 180 days. For earlier cleanup, Dynamic Endpoint Groups can identify inactive endpoints, but deletion still needs to be performed manually. Bulk cleanup can also be automated using the Public API based on criteria such as last_seen.
  
  
• Manual / API Removal: Go to Endpoints > All Endpoints, filter by Connection Lost/Last Seen, select the endpoints, and use Endpoint Actions > Advanced > Delete from database. For bulk removal, use the API to retrieve endpoint IDs based on last_seen and then delete those endpoint IDs. Deleting from the database does not uninstall the agent; if it reconnects, it can register as a new device.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar