s there any way for a disabled host to be enabled by some action on the monitored system?

[observabully]

recently we faced a potential issue. Some of our client's hosts (which were previously disabled) were activated. However, the support team dsnt know how its happened.
We dnt have logs enabled to identify if it was a user action. So, I would like to know if anyone has ever faced the kind of issue that of disabled hosts being activated, for example, when performing an update in the monitored environment.
The environment was built on openshift, and we only know that an action was taken to add pods.
I would be happy if anyone could share if they had any similar experiences.

[Julius_Loman]

There can be many reasons for this. The most common one is, that a change was introduced to the host such as cloning a VM and thus OneAgent considered it a new host with a new ID. So if the Host ID has changed, cloning a VM is most likely the reason.
If it's a Kubernetes environment, disabling OneAgent in UI / API is not the best way to have them disabled. Consider properly setting your DynaKube configuration so it does not deploy OneAgents on nodes where you don't want them to be active.