topic Re: Cortex XDR Agent in Cortex XSIAM Discussions

Cortex XDR Agent

O.Faheem — Mon, 28 Apr 2025 05:03:19 GMT

Hi,

We are using Cortex XSIAM. Currently, some Microsoft Windows 10 and 11 agents are not receiving updates, indicating that they will soon become outdated. I concur that the majority of the machines lack network connectivity. However, is it possible that the moment it gets connected to internet, the agent automatically gets updated either by pulling new agent version or pushing the agent

Re: Cortex XDR Agent

Mudhireddy — Mon, 28 Apr 2025 05:13:54 GMT

You're right. In XSIAMand XDR , since the agent management behavior is similar) yes once a Windows 10/11 machine that had no internet regains internet connectivity. The Agent can automatically update, depending on a few conditions:

Pull Method (Default Behavior):
The agent checks in with the Cortex XSIAM backend regularly. If there's a new agent version assigned to its upgrade policy, it will download and install the new version automatically.
Push Method (Manual or Scheduled):
Alternatively, you can push an update command from the XSIAM console once the device is back online, to force an immediate upgrade.

Re: Cortex XDR Agent

O.Faheem — Mon, 28 Apr 2025 05:18:03 GMT

Hi Suresh,

Thanks for your prompt reply.

How can we schedule an update command from the XSIAM console once the device is back online?

Regards,

Osama

Re: Cortex XDR Agent

Mudhireddy — Mon, 28 Apr 2025 05:24:42 GMT

Steps to Schedule or Push an Agent Update in Cortex XSIAM:
Go to:
Endpoints → Agent Management → Agent Versions

Find your Endpoint(s):

Use filters to find the machines that are outdated or running older agent versions.

Select the Endpoint(s):

Check the box next to the device(s) you want to upgrade.

Click on Actions → Upgrade Agent

Choose Upgrade Options:

Immediate Upgrade: If you want the update to happen as soon as the machine is online and checks in.

Scheduled Upgrade: You can set a future time and date for the upgrade to happen.

Example: "Upgrade during maintenance window at 2 AM."

Grace Period Settings (optional): Set a delay after the agent comes online before upgrading.

Confirm and Save:

Cortex XSIAM will wait until the device is online and then trigger the upgrade according to your settings.