Can Cortex XDR be installed to be standalone?

Vudoo408 — Tue, 19 Oct 2021 17:13:44 GMT

We're in a situation where HQ has moved to Cortex XDR, at the satellite facilities, there are PC/Laptops that never touches HQ network and are often standalone systems or is on a competely separate domain and those domain is to never communicate with the HQ domain. To complicate things a little more, some of these other domains are moving targets that are often offline for an extended periods (Maritime).

We were provided an installer Agent 7.3.1, I have it on a Server 2019 and a Win 10 VM as well as a physical Win 10 box. The two VM shows to be checked in and communicating with the trap server but is showing to be disabled. The physical Win 10 refuses to connect to the server at all.

We've always operated our satellite sites using standard alone versions of SEP which has worked well. Is it possible with Cortex XDR?

Re: Can Cortex XDR be installed to be standalone?

jcandelaria — Mon, 25 Oct 2021 18:23:01 GMT

Hi Vudoo408,

Let me answer your question directly first then follow up with additional questions and solution. 🙂

With regards to standalone agent installer, you can check the link below (Install or Update Agents Using Installer and Content Package Manually)

https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-5/cortex-xdr-agent-admin/cortex-xdr-agent-for-windows/install-the-cortex-xdr-agent-with-installer-and-content-update-bundle

Follow up questions: with regards to satellite facilities, are they air gapped environment or they have access to internet directly? If they have then technically as long as the required communication ports/fqdn are open then agents should be able to check-in

If they are air gapped, would setting up broker vm on those satellite facilities an option?

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/broker-vm/set-up-broker-vm/activate-the-agent-proxy-for-closed-networks.html

Q:The two VM shows to be checked in and communicating with the trap server but is showing to be disabled.

A:(need to check the policy and profile assigned to the agent whether modules are enabled). Also try installing the latest agent, 7.5.1 instead.

Q: The physical Win 10 refuses to connect to the server at all.

most common culprit are:

A: firewall (either ports are not open from network segment or endpoint firewall itself is blocking)

A: doesnt have updated certificate

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/set-up-endpoint-protection/enable-access-to-cortex-xdr

You can also submit a support case for PA support to analyze the logs

Once you open/double click the xdr agent icon and open the xdr agent console from the bottom right corner of your screen.

You can click the generate tech support file which will grab the needed support files and output in zip file which you can attach to the case, as alternative if generating tech support file doesn't work, You should be able to see Open Log File, copy/upload that log file on the case.

topic Re: Can Cortex XDR be installed to be standalone? in Cortex XDR Discussions

Can Cortex XDR be installed to be standalone?

Re: Can Cortex XDR be installed to be standalone?