I have recently been rolling out the Endpoint agent to some host for testing.
Within the fleet agents tab, there is a single entry for each host in the format "hostname".
However within the logs-* index there are two host names for each host in the following formats, "hostname" and "hostname.domain.name.here" .
This is then showing as two separate hosts under the SIEM hosts location.
Any idea as to what could be causing this ?
Thanks in advance