Difference between host_inventory and endpoint in XQL Query

[RemiLiquete]

Hello,

I'm trying to search for all installed vpn on endpoints using an XQL Query.

Before going further in my query, I'm trying to list all hosts where the application name contains "*vpn*".

This result and the result from host insight doing the same search are different. Somes endpoints are not showing in the query. So I've tried to search for those missing endpoints in query. I only find them when using the dataset "endpoints". I can't find them using host_inventory.
Why?

[nsinghvirk · Accepted solution]

Hello @RemiLiquete 

Thanks for reaching out on LiveCommunity!

Possible reason for not getting same number of hosts in endpoint and host_inventory dataset can be that the host insight capability was not enabled for all the hosts in agent setting profile. Other possible reason can be that you have limited number of Host Insight licenses which are required for host_inventory to work. Hence you may be missing out data from some of the hosts in host_inventory dataset.

[RemiLiquete]

Hello @nsinghvirk

Thank you for your answer!

You're right, this is a licenses problem; I didn't check that.

[RFeyertag]

Hey @RemiLiquete, 

please set me know if you also have the problem to get them inside host inventory when your licence issue is solved. 

In my opinion you have to reinstall the agent, because I have severall clients which are not visible in the host inventory after license upgrade.

BR

Rob 

[RemiLiquete]

Hello, thank you for the information.
For now, I did not resolve this issue since it's not impacting for now. I let you know if it changes.

[RFeyertag]

You're welcome!

Maybe you have more visibility with this XQL:

config case_sensitive = false
| dataset = endpoints
|join conflict_strategy = both type = left (dataset = host_inventory ) as HI HI.host_name = endpoint_name and HI.agent_domain = domain
|fields domain , endpoint_name, last_seen, host_name, endpoint_status
|filter host_name = null
|sort desc last_seen