01-28-2022 01:53 AM
There are two important facts about licensing. Even your agents are not active, Cortex XDR is keeping Agent data's and after 180 days, Data's will be deleted and count 481 will be decreased. But Licensing is calculating totally different. After 30 days connections lost status, agent license will be returned to pool.
Connection Lost (Days)
—Configure the number of days after which the license should be returned when an agent loses the connection to Cortex XDR. Default is 30 days; Range is 2 to 60 days.
Agent Deletion (Days)
—Configure the number of days after which the agent and related data is removed from the Cortex XDR management console and database. Default is 180 days; Range is 3 to 360 days and must exceed the Connection Lost value.
Hostname and ip address are not impacting to calculating Uniq machine ID. But mac address changes does. Even a host changes ip and hostname, will not consume another license. You can re-image host, as long as you keep same hardware, same license will be applied to host.
For the duplicates, You can delete manually from management console or API. otherwise cortex xdr will delete agents after 180 days.
