Move Cortex XDR agent from one tenant to another (and back)

[tmeksik]

When we move an agent to a new management server, what would happen to the logs and telemetries we have on the old tenant? Would they be retained as per the usual policy or would they just get purged?

Also if we then move it back to the old tenant, would it appear like the logs/telemetries just have some gaps while the agent was away from the tenant or it would appear like a freshly installed one with no awareness of its "past life"??

Thanks in advance!

Tum

[aspatil]

Hello @tmeksik ,

Thanks for reaching out on LiveCommunity!

One you move the agent from one tenant to another the logs will be there until its retention period. Once you move back to old tenant the logs will be there with the gap in between the transfer.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Regards

[tmeksik]

Thanks @aspatil - Just to confirm it with 100% certainty, when the endpoint is moved back to the old tenant, it won't be treated as a brand new endpoint with the same host name? Correct?

Would want to confirm this specifically since the docs say "When you change the server that manages the agent, the agent transfers to the new managing server as a freshly installed agent". So I wonder if this would apply to when you move it back to the old tenant too? The old tenant may treat the one that just moved back as a freshly installed agent without associating it with its previous logs and everything.

[neelrohit]

Hi Tum,

Any back management server change event is considered a fresh installation on the destination instance as the endpoint registers with the new endpoint ID. The agents do not have a memory which they carry between the tenants and hence any change between instances is considered a new registration.

As a practice recommendation, it is generally not advised to perform this activity more than twice as this can lead to database corruption for the agents.

Hope this helps.

Feel free to mark the response as "Accept as Solution" if it answers your query.