Cortex XDR: create endpoint groups

[J.Risquez]

Good morning,

  maybe someone could help me to find out if there is any option to create several endpoint groups by uploading a file or by other means. From the inventory ->  endpoints -> groups, it seems that it is only possible to create one endpoint group at a time.

  Thanks in advance.

Kind regards,

[susekar]

Hello @J.Risquez 

Greetings for the day.

Currently, there is no native functionality within the Cortex XDR management console or via public APIs to create multiple endpoint groups simultaneously through a single file upload or bulk action.

While you can use a file to populate a group, this is limited to creating or populating one Static Endpoint Group at a time.

Key Limitations

• No Bulk Group Creation:
  The Upload From File feature is designed to populate a single group with a list of identifiers (IP addresses, hostnames, or aliases). It does not support creating multiple groups in one operation.

• No API Support:
  There are currently no public API endpoints available to automate the creation of endpoint groups.

• Static Group Limits:
  Static groups created via file upload are limited to 250 endpoints.

  Note: If a hostname in the file has multiple Agent IDs (for example, due to system re-imaging), all associated Agent IDs count toward the 250-endpoint limit. This may cause the upload to fail if the total exceeds the limit.

If this response has answered your query, please let us know by clicking Like and selecting Mark this as a Solution.

Thanks & Regards,
S. Subashkar Sekar