topic Cortex XDR Broker VM handling in Cortex XDR Discussions

Cortex XDR Broker VM handling

Cyber1985 — Mon, 25 Jul 2022 13:55:16 GMT

Hello dear live community!

We are now at the step where we connect some Servers to Cortex XDR which should not connect directly to the Internet.

In the first mind we talked about the Tier 0 server. Today I was asked why we cannot bring all the server under the umbrella of the Broker vm.

I am a little bit unsecure to put about 100 server onto one Broker vm.

Here are my questions:

1. when Broker vm is down, compromised, dead, how do I connect all the server endpoints onto the second Broker vm? Is there a HA balancing to another Broker vm posibility? Yes I habe seen the fallback to internet setting.

2. Is the live terminal possible When the server are connected through the Broker vm?

Rob

Re: Cortex XDR Broker VM handling

afurze — Mon, 25 Jul 2022 16:07:40 GMT

Hi Cyber1985,

First, the Broker can handle up to 10,000 endpoints so 100 servers is not a stretch. You may want to consider deploying two Brokers and then providing both as proxies to your servers for redundancy. This is configured via Endpoints -> All Endpoints, select the servers and right-click -> Endpoint Control -> Set Agent Proxy, you can specify the IPs and ports for both Brokers and then the agents on these servers will be able to use either one. You don't directly do "HA" configuration in the Brokers or XDR Instance as they Brokers do not need to communicate with one another, just provide both as proxies for your agents and you will be ready to go.

Second, you can absolutely use the Live Terminal when an agent connects through a Broker.

Re: Cortex XDR Broker VM handling

Cyber1985 — Mon, 25 Jul 2022 16:22:10 GMT

Thank you very much for sharing your knowledge!

Rob

Re: Cortex XDR Broker VM handling

Honza_Linhart — Mon, 26 Dec 2022 21:33:29 GMT

Hi Afurze, is there a redundancy option (without use of external load-balancer) when we use Broker VM as Syslog forwarder?

Or is there a way how to do automatic deduplication on Cortex XDR side?

Thank you,

Jan

Re: Cortex XDR Broker VM handling

afurze — Wed, 28 Dec 2022 15:56:13 GMT

Honza_Linhart,

No, there is no product supported load balancing mechanism. You can use an external load balancer as you suggested or set up a single Broker VM and use a syslog service such as syslog-ng which will queue messages on disk if it isn't able to send them.