The console reports 481 agents of which it gives with lost connection 110, in the licensing section it indicates 371 agents installed of the 500 licensed, so it seems that it does not take into account those of lost connection, I wanted to confirm this extreme since, according to the panel, we could be close to rushing the license.
We use DHCP in the workstations, it is frequent to change the name and even the address of the computers, due to fleet renewal, staff rotation or change of vlan, and with the on-site access frequently interrupted by the pandemic, there may be computers -few- that are not turned on for months.
How does Cortex understand that an agent is unique? Is it univocally identified in the computer that is installed regardless of its name or IP address? If the computer with a complete image is replatformed, does it still count the old agent, which will no longer respond, in addition to the new one? In the list of agents, there are computers with both name and IP address repeated, even some with both, how could we avoid these duplicates?
Thanks in advance.
It appears that your question is around Cortex XDR, however, this discussion board is for Cortex XSOAR, i would suggest to post your question in the dedicated Cortex XDR discussion board (https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/bd-p/Analytics_Discussions)
if your question is about Cortex XSOAR, can you please elaborate on what exactly your issue is?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!