Cortex XDR Forensics doesn't display Endpoints

[Aristooo]

When I configure Forensics, at the 'Endpoints' step, it doesn't show the name of any endpoint. "Monitor and Collect Forensics Data" is enabled on Agent Settings. User role is Instance Administrator. Triage type is "Online".

[nsinghvirk]

Hello @Aristooo 

Thanks for reaching out on LiveCommunity!

On the configuration page, depending on the type of Artifacts, Volatiles and File collection you choose there may be different minimum agent versions requires to perform triage. Hence on the endpoints page please hover your mouse over "Eligible for forensics triage" button to see the conditions required for the eligible endpoints as shown in attached screenshot.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

[Aristooo]

Hello @nsinghvirk 
Thank you for your response. The endpoint meets all the requirements. And Forensics is enabled. I have activated 'Forensics' in the agent settings. Could it be that it needs to be activated somewhere else as well? Are 'Forensics' and 'is forensics' different things?
I have added screenshots

[Aristooo · Accepted solution]

Solved!
I had not added the profile for Forensics to the "Prevention Policy Rule.