topic Re: How endpoint devices, XDR Broker VM and XSIAM Cloud communicate in case of HA configuration in Cortex XDR Discussions

How endpoint devices, XDR Broker VM and XSIAM Cloud communicate in case of HA configuration

miyaito — Mon, 25 Aug 2025 04:56:39 GMT

Hi Team,

I'd like to know how endpoint devices, XDR Broker VM and XSIAM Cloud communicate in case of HA configuration.

I guess HA configuration may require a virtual IP address to receive logs from endpoint devices and to send the logs to XSIAM Cloud.

For example, there are 3 IP addresses.

(1)Broker VM A : 10.0.0.5

(2)Broker VM B: 10.0.0.6

(3)Virtual IP address: : 10.0.0.7

To which IP address should endpoint devices send logs ? both (1) and (2)? or (3)?

From which IP address should XDR Broker VM send logs to XSIAM Cloud? both (1) and (2)? or (3)?

eluis — Wed, 27 Aug 2025 15:33:15 GMT

The BVM HA configuration requires FQDN set up which I assume you already did.

So the FQDN should be the proxy to which your agents will communicate to.

The former is valid for Cortex XDR and XSIAM

Please check the doc:

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis