topic Re: Anyone else having XDR communication problems? in Cortex XDR Discussions

Anyone else having XDR communication problems?

G.Stefanov — Mon, 29 Jun 2026 14:18:45 GMT

Starting later in the day on June 24, we started seeing endpoints show 'No connection to server' when opening the Cortex console on the endpoint. Endpoint tasks like collect firewall logs, pause protection and live terminal all fail.

Some systems shows that they ARE connected to our tenant but trying to live terminal into them fails.

Re: Anyone else having XDR communication problems?

susekar — Mon, 29 Jun 2026 18:17:28 GMT

Hello @G.Stefanov ,

Greetings for the day.

The issue you are describing, where endpoints show as "Connected" in the management console but "No connection to server" on the local agent UI while interactive tasks (Live Terminal, log collection, pausing protection) fail, typically stems from a breakdown in the secure WebSocket (WSS) communication channel or an internal agent Inter-Process Communication (IPC) failure.

Diagnostic Steps on Affected Endpoints:

Run the following commands from an elevated Command Prompt to isolate the failure point:

1. Verify Service Status:`cytool runtime query`

Ensure that cyserver and cyverak are in a Running state.

2. Test Network Connectivity: `cytool connectivity_test`

Review the output for any DNS errors, connection timeouts, or SSL errors.

3. Verify WebSocket Status: cytool websocket query

Confirm that the output shows: Connected: true

If it displays Connected: false or No websocket connection available, the agent is unable to receive real-time commands.

--------------------------

Recommended Remediation Actions

1. Whitelist Required URLs

Ensure that all regional Cortex XDR URLs, including wss:// (WebSocket) connections, are excluded from SSL/TLS decryption and Deep Packet Inspection (DPI) on your network security devices.

2. Force Agent Reconnection

If network connectivity is confirmed but the agent remains out of sync, force a reconnection using the tenant's Distribution ID: cytool reconnect force [DISTRIBUTION_ID]

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution"

Thanks & Regards,
S. Subashkar Sekar

Re: Anyone else having XDR communication problems?

C.Hamilton931476 — Wed, 23 Sep 2026 14:43:37 GMT

Hi @susekar ,

These instructions are exactly what I'm looking for.

On the distribution ID, I have not been able to find a good guide on how to find this information. Can you please provide instructions on how to do so?

Thank you.

Re: Anyone else having XDR communication problems?

susekar — Wed, 23 Sep 2026 14:54:26 GMT

Hello @C.Hamilton931476 ,

Thank you for the response.

The distribution ID used must be from an Agent Installer of the same OS and whose version is less or equal to the installed Cortex XDR Agent version.

To find the Distribution ID, do the following:

Navigate to Inventory-> Installations
At your top right, you will have three dots symbol, then search and add the field ID
Check the option and use the ID of the package that you have installed in the 'cytool reconnect force distribution_ID' command.

Or

You can enter the below command and see the Distribution ID in the Output - cytool connectivity_test

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution"

Thanks & Regards,
S. Subashkar Sekar

topic Re: Anyone else having XDR communication problems? in Cortex XDR Discussions

Anyone else having XDR communication problems?

Re: Anyone else having XDR communication problems?

Diagnostic Steps on Affected Endpoints:

1. Verify Service Status:cytool runtime query

2. Test Network Connectivity: cytool connectivity_test

Recommended Remediation Actions

1. Whitelist Required URLs

2. Force Agent Reconnection

Re: Anyone else having XDR communication problems?

Re: Anyone else having XDR communication problems?

1. Verify Service Status:`cytool runtime query`

2. Test Network Connectivity: `cytool connectivity_test`