topic Re: Endpoints not showing on console in Cortex XDR Discussions

Endpoints not showing on console

Shahwaz_Md — Wed, 01 Feb 2023 09:38:29 GMT

Hi,

Cortex XDR is installed on the client's endpoints but it is not visible on our console, what could be the possible reason behind this?

Thanks

Re: Endpoints not showing on console

creddy — Wed, 01 Feb 2023 09:49:20 GMT

Hello @Shahwaz_Md,

There could be various reasons for the endpoint not showing in the console.

But primarily if the agent does not have network access to all required resources, it may fail to communicate to the Cortex XDR cloud server and does not show up on the console.

Check if the agent machine able to reach all cloud URLs.

To know the list of cloud resources to allow from the agent side, refer below article.

Resources Required to Enable Access • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal

Thank you!

Re: Endpoints not showing on console

Shahwaz_Md — Wed, 01 Feb 2023 09:51:13 GMT

Hi Creddy,

Thanks for the reply, all the URLs in the list are allowed from the Agent side but still we are facing the issue.

Re: Endpoints not showing on console

neelrohit — Wed, 01 Feb 2023 10:24:03 GMT

Hi @Shahwaz_Md ,

Agent does not reflect primarily because of the network connectivity and there is a lot of certainty that one or more than one network element(firewalls, authentication proxy, etc.) is blocking the connection. Inorder to validate it, you can try couple of things:

Open cmd as administrator,
cd C:\Program files\Palo Alto Networks\Traps\ ///( for windows endpoints)
cytool connectivity_test, add uninstall password <possibly "Password1" or anything that you have set>
Observe the output. It should come up something like the screenshot below:

Second option is do a traceroute to any of the IPs listed in the URL, depending upon your region. (Eg. EU) and then if there is an RTO output, you would know the issue.

If you need additional guidance, please retrieve the TSF from the agent of the affected endpoint and open a support case for analysis

Regards,

Re: Endpoints not showing on console

joseph.lim — Thu, 02 Feb 2023 07:56:01 GMT

1. Check internal firewall.

2. Check enterprise firewall if any of the pre-requisite url is blocked

3. If brokervm is implemented, check if proxy is set.

4. Check if services is up by > cytool runtime query