How much resource consumed by XDR agent

SeanDeHarris — Thu, 27 Feb 2025 06:55:07 GMT

Hello,

Just wondering how much resource (CPU, Memory, Bandwidth) will be consumed on Windows agent normally?

what is the bandwidth requirement per 1000 agents? Defference with or without brokervm?
Thanks,

SdG

Re: How much resource consumed by XDR agent

aspatil — Thu, 27 Feb 2025 07:12:42 GMT

You can expect the agent to use about 300 MB min of RAM, and on busier systems and larger servers up to 2 GB, anywhere between 3-5% CPU or so is normal.

However, this is highly dynamic by nature as it would depend upon the activity on the endpoint during the scan. If there are running processes which Cortex XDR needs to scan, the agent takes more CPU to examine those process hashes. Many a times, this effort fails and hence the agent shows the scan status as "Completed with partial success" upon completion.

It also depends upon how many unique hashes are present on the endpoint for hash verdict determination and recieve the verdict from Wildfire cloud. Hence, it is not static by nature. However, the agent has a soft tuning by default to lower the usage of the Cortex XDR running process using Adaptive Policy Exception to monitor and lower the usage count every 30 minutes, which should bring it down to 5-10%.

Also, agent to bvm is the same volume as agent to tenant. There is no difference because the broker merely acts as a proxy.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Configure-the-Broker-VM

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

topic Re: How much resource consumed by XDR agent in Cortex XDR Discussions

How much resource consumed by XDR agent

Re: How much resource consumed by XDR agent