topic Re: Operational status unprotected with error message running without valid content in Cortex XDR Discussions

Operational status unprotected with error message running without valid content

Shashanksinha — Thu, 27 Oct 2022 07:24:11 GMT

Related to Cortex XDR

we are observing operational status as unprotected for some endpoints and the error says running without valid content.
But at the same time we also observed some of the agents running on the the latest agent version also having this error(running without valid content) .
How do get the hosts in protected operational status in both cases one which is not upgraded to the latest agent version and one which with upgraded to latest version but still running without valid content

Re: Operational status unprotected with error message running without valid content

creddy — Tue, 01 Nov 2022 03:05:14 GMT

Hi @Shashanksinha

The first and foremost requirement for agent is content updates which can be downloaded from XDR cloud resources. Please check with the network administration team to allow the URLs required to be whitelisted to enable access to Cortex XDR resources as listed here to download content.

If the above access in already place, look at the corresponding Content Version column field of the endpoint in Endpoints section under Cortex XDR console. It should be an empty field. This happens when an EOL (End-of-Life) agent is installed on the endpoint. An EOL agent will not receive any content updates. Get those endpoints upgraded to the latest version of Cortex XDR agent via Action Center or other methods as is used in your organization.

I hope that answers your query.
If these answers are helpful, mark this post as answer.

Thank you!

Re: Operational status unprotected with error message running without valid content

bbarmanroy — Tue, 01 Nov 2022 08:38:23 GMT

@Shashanksinha Assuming all endpoints have network access to Cortex XDR, this appears to be an issue with an endpoint DB potentially corrupted.
My recommendation is that for those endpoints which are running on latest version but yet without CU, try uninstalling and reinstalling the agent to see if the problem disappears. It is imperative to get those endpoints with a valid CU to ensure there is an adequate level of protection in place.