The error message "The content package was faulty or could not be downloaded" typically indicates a failure during the download phase of the agent update process, often caused by network interruptions, SSL decryption interference, or a corrupted local package state. Since the endpoint is currently disconnected, reconnection must be initiated from the endpoint side using local administrative tools.

1. Local Recovery Steps (To Reconnect the Agent):

If the agent is in a Disconnected state following the failed upgrade, follow these steps on the affected Windows endpoint to clear the corrupted state and force a reconnection:

Open a Command Prompt as Administrator.
Stop the agent services (you may need the agent's administrative password or a temporary token):"C:\Program Files\Palo Alto Networks\Traps\cytool.exe" runtime stop

Wait for 60 seconds and verify all components have stopped:"C:\Program Files\Palo Alto Networks\Traps\cytool.exe" runtime query

Delete the corrupted content settings database:rmdir /q /s "C:\ProgramData\Cyvera\LocalSystem\Persistence\content_settings.db"

Clear the downloaded content cache:del /q /s "C:\ProgramData\Cyvera\LocalSystem\Download\*"

Restart the agent services:"C:\Program Files\Palo Alto Networks\Traps\cytool.exe" runtime start

Wait 60 seconds and force a heartbeat check-in to the console:"C:\Program Files\Palo Alto Networks\Traps\cytool.exe" checkin

2. Network and Firewall Verification:

If the local recovery does not resolve the issue, or if multiple endpoints are affected, verify that your network security infrastructure is not blocking the required resources.

URL Whitelisting

Ensure the following URL is allowed through your firewall or secure web gateway:

panw-xdr-installers-prod-us.storage.googleapis.com

SSL Decryption Exclusions

Add the following domains to your SSL decryption exclusion list:

*.traps.paloaltonetworks.com
*.xdr.<region>.paloaltonetworks.com
panw-xdr-installers-prod-us.storage.googleapis.com
global-content-profiles-policy.storage.googleapis.com

3. Additional Troubleshooting

Pending Reboot

A pending reboot from a previous installation attempt can cause this error. Perform a standard OS reboot and monitor the agent's connection status afterward.

Corrupted Installation (Last Resort)

If the agent remains disconnected or the installation is corrupted, use the Cortex XDR Cleaner utility to completely remove the agent and then perform a fresh installation of the required agent version.

The cleaner utility is typically located at:

C:\Program Files\Palo Alto Networks\Cortex XDR Health Helper\XdrAgentCleaner\XdrAgentCleaner.exe

Additional Recommendation

If the issue persists after completing the above steps, it is recommended to open a support case with Palo Alto Networks Support. The support team can provide the latest version of the cleaner utility, review the agent logs, and perform a deeper analysis to identify the root cause of the content download failure and disconnection issue.

topic Re: XDR agent disconnected after automatic upgrade in Cortex XDR Discussions

XDR agent disconnected after automatic upgrade

Re: XDR agent disconnected after automatic upgrade

1. Local Recovery Steps (To Reconnect the Agent):

2. Network and Firewall Verification:

3. Additional Troubleshooting

Additional Recommendation