Cortex XDR agent change managing server

[NitinJoshi]

Hi All,

Looking for best way to migrate cortex XDR agents to new tenant in bulk.
I have downloaded all the hostnames in excel format and when i try to paste it on the XDr console filter section it doesnt work.

Please comment

[BPry]

@NitinJoshi,

Are you looking to migrate all agents from one tenant to a new one? If so I'd just filter by the endpoint, that'll be the best method to perform the migration.

If that isn't the case and you're looking to peacemeal endpoints, the best way to do this is to group the endpoints or assign a specific tag "Migration" as an example so you can filter solely on that. Since you already have a file with all of the hostnames, you could easily use that to create a group and then filter on the created group instead of the tag. 

[NitinJoshi]

Hi BPry

Yes, we are planning to migrate XDR agents in few stages and a particular stage will target 300 endpoints. Is their any way we can select first 300 endpoints or upload a list of 200 endpoints to perform migration.

The problem with tagging is also same, as we are performing migration in stages we have to apply tags on first 300 endpoints and once we have migrated 300 endpoints we can apply tags to next set of 300 endpoints and we cant find a way to select top 300 endpoint because on XDR console it selects all the endpoints or we have to manually select 300 endpoints(which isn't feasible)

[BPry]

@NitinJoshi,

So I think the tag method is still valid for the migration. Once you've migrated endpoints via the filter tag you can remove the endpoints that were migrated. So the tag will always be the next group of endpoints to be migrated, and once migrated you can reuse that tag for the next group.

As for the endpoint selection, if you filter the endpoint list by the tag of the next group to migrate you'll be able to select all endpoints to process the migration and subsequent removal once everyone has migrated. 

[NitinJoshi]

Thanks, but how do i select first 300 machines to apply a tag?

all the machines are being selected in the endpoint section