Cortex Doubt Operations

[Alpalo]

Hello everyone;

Cortex:
The console reports 481 agents of which it gives with lost connection 110, in the licensing section it indicates 371 agents installed of the 500 licensed, so it seems that it does not take into account those of lost connection, I wanted to confirm this extreme since, according to the panel, we could be close to rushing the license.

We use DHCP in the workstations, it is frequent to change the name and even the address of the computers, due to fleet renewal, staff rotation or change of vlan, and with the on-site access frequently interrupted by the pandemic, there may be computers -few- that are not turned on for months.

How does Cortex understand that an agent is unique? Is it univocally identified in the computer that is installed regardless of its name or IP address? If the computer with a complete image is replatformed, does it still count the old agent, which will no longer respond, in addition to the new one? In the list of agents, there are computers with both name and IP address repeated, even some with both, how could we avoid these duplicates?

Thanks in advance.
Best regards.

[etugriceri]

There are two important facts about licensing. Even your agents are not active, Cortex XDR is keeping Agent data's and after 180 days, Data's will be deleted and count 481 will be decreased. But Licensing is calculating totally different. After 30 days connections lost status, agent license will be returned to pool. 

Connection Lost (Days)
—Configure the number of days after which the license should be returned when an agent loses the connection to Cortex XDR. Default is 30 days; Range is 2 to 60 days.
Agent Deletion (Days)
—Configure the number of days after which the agent and related data is removed from the Cortex XDR management console and database. Default is 180 days; Range is 3 to 360 days and must exceed the Connection Lost value.

Hostname and ip address are not impacting to calculating Uniq machine ID. But mac address changes does. Even a host changes ip and hostname, will not consume another license. You can re-image host, as long as you keep same hardware, same license will be applied to host. 
For the duplicates, You can delete manually from management console or API. otherwise cortex xdr will delete agents after 180 days.