topic Re: Use Case and Purpose of xdrhealth.exe in Cortex XDR Discussions

Use Case and Purpose of xdrhealth.exe

KanwarSingh01 — Tue, 12 Apr 2022 01:41:33 GMT

Recently i have noticed that there is another folder which has been created under PA Cortex folder as below:

"C:\Program Files\Palo Alto Networks\Cortex XDR Health Helper"

Inside the Folder there is PE which is xdrhealth.exe, what is the purpose of this EXE? Is there any documentation which can be used for understanding its purpose. From the name it seems to be something to do with health checks up for the XDR services on the local system and report to cloud console but it would be beneficial to understand the purpose.

Thank you

Re: Use Case and Purpose of xdrhealth.exe

Rindsland — Tue, 12 Apr 2022 08:44:37 GMT

We are seeing also a new Service with Name "Cortex XDR Health helper" which is set to Automatic but not started.

This causes Issues with our Monitoring. Not sure if this service runs only from time to time and what is the purpose of that Service.

(Even a restart of the Device, doesn't start the Service.)

Seems to be something new with Agent 7.7.0.

Re: Use Case and Purpose of xdrhealth.exe

MarvinC — Tue, 12 Apr 2022 11:34:02 GMT

Following this thread. I am seeing this also when investigating the trapsd
logs.

Re: Use Case and Purpose of xdrhealth.exe

akash_chhetri — Thu, 14 Apr 2022 17:58:54 GMT

Hi everyone,

The product team has published the public documentation for the XDR Health Service.

Please find the relevant links below:

1. https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-7/cortex-xdr-agent-release-notes/cortex-xdr-agent-release-information/changes-to-default-behavior

2. https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-7/cortex-xdr-agent-admin/cortex-xdr-agent-for-windows/troubleshoot-cortex-xdr-for-windows#id183583006QR

Re: Use Case and Purpose of xdrhealth.exe

Dominic-Erni — Wed, 20 Apr 2022 15:01:57 GMT

Here are some additional infos about the behaviour of Cortex XDR Health Helper Service: Cortex XDR Health Helper service does not start after upgrade t... - Knowledge Base - Palo Alto Networks

Re: Use Case and Purpose of xdrhealth.exe

SStrauch — Tue, 28 Feb 2023 14:50:52 GMT

Does anyone know how to exclude this alert in the Windows Server Manager / Service Health Status?
It's really annoying that XDR Health Service is the only Service on our Servers that produces these "red flags"...

Re: Use Case and Purpose of xdrhealth.exe

Dominic-Erni — Tue, 28 Feb 2023 15:23:53 GMT

Just found that. May help, didn't test/check Windows Server 2012 Server Manger Ignore Services? (microsoft.com)
If someone has a solution to set this with gpo would be apreciated.