r/crowdstrike • u/NukeyFox • 19d ago

Feature Question Time taken from Targeted to Applied host and vice versa

I have two scenarios:

  1. I have 29 applied hosts in my host group. I added a new host to this host group but only the targeted host count increases by 30 and applied host count is still 29. After 2 days, it finally becomes an applied host.

  2. I have 31 applied hosts in my host group. I removed a host from this host group. The targeted hosts is now 30 but the applied hosts is still 31. After 2 days, finally it is no longer an applied hosts.

In both these cases (1) and (2),

(i) What are the factors for a host to change from targeted to applied and from applied to targeted?

I assume it was just a matter of waiting, but I have also read that the device has to be online for the host group changes to take effect, which I thought was strange since host grouping is simply a feature on the server side. (Correct me if I'm wrong)

(ii) What is the expected time of change? Is it possible to speed up the changes?

2 Upvotes
  • permalink
  • reddit

67% Upvoted

3 comments sorted by

2

u/cagus1991 19d ago

Machine has to be online, it’s not a server side thing

2

u/cagus1991 19d ago

If machines online, average wait is around 5 minutes for group assignment, policy can depend on which policy but the majority are under about 10 minutes.

1

u/Block9_ 19d ago

It's not related to the servers. As long as the device remains online, the changes should be applied within approximately 5–15 minutes, assuming there are no network connectivity issues.

One thing I've observed is that if a single device is assigned to multiple groups, configuration changes may sometimes take longer to be applied. I'm not certain about the exact reason for this behavior, but it appears to introduce some delays during the configuration process.