Cisco AMP - auto assign a device to a group upon device registration

[Kombi]

Question One - Is there a way to have devices auto assign to a group based on a partial name of that device ? 

Example 1 - If we have a node called "worker-LT" - I want this laptop auto assigned to our laptop group based on a partial  name of " -LT" .

Example 2 - we have servers that name contain letters such as erp, prd, sup, stx, sdk in the server name.  Is there a way to have multiple partial names of a node assigned to a group? 

Question two - Is there a way to decommission a node automatically if it has not check in for 24 hrs? 

- We have a lot of Dockers that get built and torn down on a regular bases that we want to be able to reclaim the AMP license automatically base on a check in time for a certain group or policy.

[Troja007 · Accepted solution]

Hello @Kombi ,

enclosed the infos i have....

Q1: sorry to say, there is not built in feature in AMP to sort Computer automatically to groups. There is a script template available to move computers to a group, this may help: https://github.com/CiscoSecurity/amp-04-group-membership

Q2: you can use a script from GitHub to delete inactive computers: amp-04-delete-stale-guids

There is a FR open for both features, but today no ETA. I added your post to the FRs.

Greetings,

Thorsten