topic Re: Broker VM upgrade control (Delay) in Cortex XDR Discussions

Broker VM upgrade control (Delay)

A.Bisht584260 — Tue, 23 Jul 2024 05:15:02 GMT

Hi Team,

As we faced the mass issue of BSOD due to Crowdstrike, there's a query by management team that can we delay the agent upgrade or we can say can we control upgrade process of Broker VM if we want to hold the version on any specific version.

Re: Broker VM upgrade control (Delay)

aspatil — Tue, 23 Jul 2024 09:24:48 GMT

Hello @A.Bisht584260 ,

Thanks for reaching out on LiveCommunity!

Please have a look at below discussion:
https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/preventing-crowdstrike-disaster-in-cortex-xdr-pro/td-p/592570

If you feel this has answered your query, please let us know by clicking on Like and "mark this as a Solution".

Re: Broker VM upgrade control (Delay)

A.Bisht584260 — Tue, 23 Jul 2024 09:35:16 GMT

Hi @aspatil,

Thanks for your response, but this following query of delaying the content upgrade and agent upgrade was already been found out. Also i would like to know the risk of delaying the content upgrade as it comes weekly.

But the thing is, we had a query of delaying the agent upgrade of Broker VM? Is it possible to do so?

Re: Broker VM upgrade control (Delay)

aspatil — Tue, 23 Jul 2024 10:13:45 GMT

Hello @A.Bisht584260 ,

You can create a different policy for those Endpoints and use below:

Regarding risk, if you delay the content update, that means you have accepted the risk. If you want to go with immediate and determine it can be risk, then we do have quality assurance process before publishing any kind of update.

Hope this helps!

Re: Broker VM upgrade control (Delay)

A.Bisht584260 — Tue, 23 Jul 2024 10:23:18 GMT

Hi @aspatil ,

I am querying about the following attached screenshot, the highlighted agent version of Broker VM not the agent version of Endpoints.

Re: Broker VM upgrade control (Delay)

aspatil — Tue, 23 Jul 2024 10:29:55 GMT

You meant Broker VM version. You cannot control the delay, but it is possible to disable the auto upgrade:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Edit-Your-Broker-VM-Configuration