Re: Reconnect after endpoint cleanup

kiwi — Wed, 18 Feb 2026 11:35:56 GMT

It's important to distinguish between "Connection Lost" and an actual "Deleted" state, as the system treats them very differently.

1. Licensing and Deletion In Cortex XDR, licensing is tied directly to the active management of the node.

License Revocation: Cortex XDR issues a license for every node where the agent is running and will revoke that license the moment the agent is removed or the node is manually deleted from the console.
Immediate Recovery: This is why many admins use the Cleanup tool—to immediately return licenses to the pool for use elsewhere.

2. Will it "Show Up Again"? This is where it gets tricky.

Manual/Cleanup Deletion: If you manually delete an endpoint or use the Cleanup tool, the license is revoked immediately. While the agent might attempt to check in, it generally will not automatically "re-protect" itself and reappear as a managed node. To restore it, you usually need to perform a fresh reinstall or use the cytool reconnect force command locally on the machine.
Connection Lost: This is a "soft" state. The license is still reserved for that machine. If a machine in "Connection Lost" status regains internet access, it will automatically check in and return to a "Connected" status without any manual intervention.

I hope this clarifies,

When a Cortex XDR agent is deleted from the management console, the visibility of its subsequent check-in attempts and activity depends on how the deletion occurred and which communication channel the agent is using.

1. Can you see if a deleted agent is trying to check in?

There is no specific “Check-in Attempt” log for agents that fail to register or authenticate after being deleted. However, you can often determine activity through other console logs:

Telemetry Logs (XQL):

The Cortex XDR agent uses separate channels for:

Management communication (heartbeats)
Telemetry (EDR data)

Even if the endpoint record has been removed from the All Endpoints list, the locally installed agent may still send raw telemetry data if it retains a valid authentication token.

Incident / Alert Generation:

If the deleted agent is still successfully sending telemetry:

It can still generate incidents or BIOC alerts.
The endpoint may appear as “Unknown” or show an outdated hostname in the incident view.

2. Logs to Use in the Console:

XQL Search (Primary Method)

Query the raw telemetry dataset using the known hostname or Agent ID. If results return, the agent is still active and communicating.

Example query:

dataset = xdr_data 
| filter agent_hostname = "HOSTNAME_OF_DELETED_AGENT" 
| sort _time desc

If events appear, the agent is running and successfully sending telemetry.

Management Audit Logs:

To determine who deleted the agent and when:

Navigate to: Settings → Management Audit Logs
Filter by:
- Type: Endpoint Administration
- Sub Type: Delete

This shows the administrator account and timestamp associated with the deletion.

3. Agent Behavior After Deletion:

The behavior varies depending on how the deletion occurred.

Manual Deletion:

If an administrator manually deletes an endpoint:

When the agent reconnects, it usually registers as a new endpoint with a new Agent ID.
In some cases, if the deletion process has not fully completed in the backend, the agent may resume communication with its original identity.

Automatic Purge (Default 180-Day Inactivity Policy):

If the agent is automatically removed due to inactivity:

Its unique identity is permanently removed.
It will not automatically re-onboard when it comes back online.
Manual intervention is required (reinstallation or forced reconnection).

4. Critical Limitation: Failed Registrations

If an agent attempts to register but fails (for example, because the Distribution ID used during installation was deleted):

The registration attempt is processed at a central Palo Alto Networks distribution service.
Because the request fails before reaching your tenant, no logs will appear in your console for that failed registration attempt.

This means you cannot see those failed check-in attempts from within your Cortex XDR tenant.

Recommendation for Mistakenly Deleted Agents:

-If you suspect an active agent was accidentally deleted and it is not automatically reappearing:

Run the following command locally on the endpoint to force re-registration:

cytool reconnect force <distribution_id>

-You can find the Distribution ID in the console under:

Endpoints → Agent Installation

-This forces the agent to establish a fresh registration with the tenant.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

topic Reconnect after endpoint cleanup in Cortex XDR Discussions

Reconnect after endpoint cleanup

Re: Reconnect after endpoint cleanup

Re: Reconnect after endpoint cleanup

Re: Reconnect after endpoint cleanup

1. Can you see if a deleted agent is trying to check in?

Telemetry Logs (XQL):

Incident / Alert Generation:

2. Logs to Use in the Console:

XQL Search (Primary Method)

Management Audit Logs:

3. Agent Behavior After Deletion:

Manual Deletion:

Automatic Purge (Default 180-Day Inactivity Policy):

4. Critical Limitation: Failed Registrations

Recommendation for Mistakenly Deleted Agents: