A question about Cortex 7.3.0

LuisEhate — Fri, 27 Aug 2021 08:23:46 GMT

Hi There,

What does it mean to see Cortex status DISABLED in the VDI?

Looking forward.

Re: A question about Cortex 7.3.0

yalonso — Tue, 31 Aug 2021 22:48:18 GMT

@LuisEhate wrote:
Hi There,

What does it mean to see Cortex status DISABLED in the VDI?

Looking forward.

Hello LuisEhate,

Can you share a screenshot of your issue?, If you are referring to Cortex XDR agent operational status.

You can find more information here:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/monitoring/monitor-agent-operational-status.html

For example the unprotected status could mean;

Behavioral threat protection and Malware protection are not running
Exploit protection and malware protection are not running
The content is unavailable.

Cortex XDR agent on VDI's:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-2/cortex-xdr-agent-admin/cortex-xdr-agent-for-windows/cortex-agent-for-virtual-environments-and-desktops.html

Endpoint details:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/investigate-endpoints/view-details-for-an-endpoint.html

The registration statuses of the Cortex XDR agent on endpoint are:

• Connected—The Cortex XDR agent has checked in within 10 minutes for standard endpoints, and within 3 hours for mobile endpoints.

• Connection Lost—The Cortex XDR agent has not checked in within 30 to 180 days for standard endpoints, and between 90 minutes and 6 hours for VDI and temporary sessions.

• Disconnected—The Cortex XDR agent has checked in within the defined inactivity window: between 10 minutes and 30 days for standard and mobile endpoints, and between 10 minutes and 90 minutes for VDI and temporary sessions.

• VDI Pending Log-on—(Windows only) Indicates a non-persistent VDI endpoint is waiting for user logon, after which the Cortex XDR agent consumes a license and starts enforcing protection.

• Uninstalled—The Cortex XDR agent has been uninstalled from the endpoint.

Re: A question about Cortex 7.3.0

Breitenberg — Thu, 02 Sep 2021 04:59:32 GMT

Just wondering if anyone else is experiencing this... We have about 600 XDR agents deployed and keep running into scenarios where the agents just seemingly randomly stop checking in. Nothing meaningful in the logs. Doing a cytool checkin does nothing. The agents disappear from the dashboard entirely making it reeeeeeallly hard to even determine that the agent has stopped communicating. If we use the XDRAgentCleaner to manually remove the agent and re-install it magically starts working just fine. We've seen it on multiple agent versions from 7.0 to 7.3. The last_checkin dates are all over the map.. It's just super odd. Palo support has been completely unhelpful.

official rapidfs

topic Re: A question about Cortex 7.3.0 in Cortex XDR Discussions

A question about Cortex 7.3.0

Re: A question about Cortex 7.3.0

Re: A question about Cortex 7.3.0