Machine name in Agent Overview is different than expected for macOS agents

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention
• Data Loss Prevention Enforce

Issue/Introduction

There are similarly named macOS agents in the agent overview page of Symantec Data Loss Prevention (DLP) Enforce console with numbers appended to the end of the Machine Name, e.g., myMacbook-2, myMacbook-3, and so on.

Cause

MacOS automatically updates its HostName when it determines there is another machine on the local network with the same name. The DLP agent uses the macOS Host Name for the Machine Name (AgentName field in the Agent table).

Resolution

No action required. Incidents are recorded using the HostName and IP address at the time the incident occurred to identify the source machine.

Additional Information

There are three different names used to identify macOS machines on a network.

• HostName: is the name assigned to the computer as visible from the command line and it is also used by local and remote networks when connecting through services like SSH and Remote Login.
• ComputerName: is the user-friendly name of your Mac. It will show up on the Mac itself and what will be visible to others when connecting to it over a local network.
• LocalHostName: is the name identifier used by Bonjour and visible through file-sharing services like Airdrop.

View the current names by running the following commands in terminal:

scutil --get HostName
scutil --get ComputerName
scutil --get LocalHostName