Host Insights - Functionality limitation through license

[RFeyertag]

Hello dear community, 

we had not enough host insights licenses. About 13 agents are not available in the module system information. 

Where is the trigger to say one or more of them should now gather or send the informations to Host Insights?

This topic is about one week ago, since we have the new license. 

BR

Rob

[neelrohit]

Hi @RFeyertag ,

Thank you for writing to Live community!

Cortex XDR will calculate host insights for all the endpoints where the license can be applied(considering that the quota is not exceeded) every 24 hours. On the window of the module you want to view, also states beside the header, the last calculation timestamp for Cortex XDR host insights collection. Though there is no option to trigger the host insights collection for these asset information, it is actually listed in the Vulnerability Assessment option, where you get the option to click on "Recalculate".

The Recalculate option will trigger calculation and updation of host insights information for the Cortex XDR and the agents will send the insights data upon next data upload cycle. Please note that this can take a minimum of 6 hours for recalculation of information and to be able to populate data accordingly. If the license is exceeded, there can be issues where partial data collection would happen and you might not have complete view to all the data fields for all the endpoints. 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query. 

Regards,

NR

[RFeyertag]

Hello @neelrohit,

lets say this happened.

If the license is exceeded, there can be issues where partial data collection would happen and you might not have complete view to all the data fields for all the endpoints.

And the license upgrade was 3 days ago and the recalculation went 2 times automatich through. Yesterday I tried it with manual recalculation, in the vuln module it says it is still recalculating it. 

In the module systeminformations   (Last calculated on Jun 11th 2023 00:47:58). 

The client is still online. 

What would you do in the next step to get your missing data in host insights?

Reinstall the agent?

BR

Rob

[neelrohit]

Hi @RFeyertag ,

A reinstall would definitely work. However, you can also try registering the agents an easier way than uninstall is by running cytool reconnect force(without any distribution ID) and the agent should start fetching a fresh license. 

Also, before doing it, you might want to check if the endpoint with missing entries has host insights feature enabled or capabilities enabled and not disabled due to operational status.

Hope this helps

[RFeyertag]

Hello @neelrohit,

I tried the solution cytool reconnect force. First I gut Error 13. But after a retry it accepted the supervisor pw. 

I will give the agent 24 hours to deliver some HI informations. 

Thanks for your help!

BR

Rob