topic Re: is it normal to have an endpoint with multiple instances of "Cortex xDR local Analsys worker" running in the task manager. in Cortex XDR Discussions

is it normal to have an endpoint with multiple instances of "Cortex xDR local Analsys worker" running in the task manager.

Stephane.B — Wed, 21 Jul 2021 15:14:04 GMT

we have a customer which noticed the following? is it normal to have an endpoint with multiple instances of "Cortex xDR local Analsys worker" running in the task manager.

is this normal behavior?

Thank you

Stephane Boudreau

Re: is it normal to have an endpoint with multiple instances of "Cortex xDR local Analsys worker" running in the task manager.

gjenkins — Wed, 21 Jul 2021 15:18:22 GMT

@Stephane.B wrote:
we have a customer which noticed the following? is it normal to have an endpoint with multiple instances of "Cortex xDR local Analsys worker" running in the task manager.

is this normal behavior?

Thank you
Stephane Boudreau

Hi @Stephane.B ,

Thank you for the inquiry.

It is normal for there to be one instance of the Cortex XDR Local Analysis Worker process per CPU core or logical processor on the endpoint depending upon the operating system and version.

Re: is it normal to have an endpoint with multiple instances of "Cortex xDR local Analsys worker" running in the task manager.

Stephane.B — Wed, 21 Jul 2021 15:22:36 GMT

Hi Gjenkins, thanks for the info. Do you have a reference which states this?

Re: is it normal to have an endpoint with multiple instances of "Cortex xDR local Analsys worker" running in the task manager.

gjenkins — Wed, 21 Jul 2021 16:23:48 GMT

Hi @Stephane.B ,

That's a great question.

In all my years working with the product, I can honestly say that this has never been published in the documentation nor have steps been provided to prove such using executables such as cytool. If further verification is needed, I would recommend opening a case with Support.