topic Endpoints not being reflected on the XDR console in Cortex XDR Discussions

Endpoints not being reflected on the XDR console

NivedaR — Fri, 29 Jul 2022 06:23:13 GMT

Hello ,

We are facing an issue where an endpoint will be reflected on XDR console but after some time the same endpoint will not be seen on the console . Somehow it will come again after a while or a day or two. Does anyone know why this might be happening ?

Thanks.

Re: Endpoints not being reflected on the XDR console

bbarmanroy — Fri, 29 Jul 2022 08:04:55 GMT

If the endpoints are disappearing from the console and reappearing after some time, please check

1. if the First Seen Date field in the All Endpoints page changes after every subsequent re-appearance.

2. Is the issue only appearing in your browser or all Cortex XDR users experiencing it?

3. Have you tried with other browsers or with Incognito mode to see if the issue persists?

Re: Endpoints not being reflected on the XDR console

NivedaR — Mon, 01 Aug 2022 05:41:15 GMT

Hi Thank you !

We are still looking into the point 1 you mentioned .

All Cortex users are experiencing this issue .

Yes this issue is still persisting even in incognito and other browsers.

Re: Endpoints not being reflected on the XDR console

creddy — Tue, 02 Aug 2022 03:18:12 GMT

Hi @NivedaR

I understand that you are facing issues with endpoints not reflecting in console, they appear and disappear automatically from XDR console.

From above issue statement, based on my experience, I assume that for some reason agent might have received same unique agent ID to multiple endpoints when they registered to XDR server. This could be causing the issue here.

You can check multiple endpoints have same agent ID or unique ID by verifying the Agent ID value under the Endpoint ID column for the particular endpoint from Endpoints -> All Endpoints section in the XDR Management Console.
If all the endpoints not appearing in console at a time, you can check value in agent.id file under the path C:\ProgramData\Cyvera\LocalSystem\OSPersistence in the affected endpoints.
These value should be unique to each endpoint.

If you have same agent ID showing in multiple machines from above verification, please let me know.

Based on your response I can suggest you a solution.