Cortex XSIAM broker vm

bridgetlitt — Wed, 08 Jul 2026 18:02:58 GMT

Our Cortex XSIAM agents connect to the XSIAM server exclusively via the Broker VM's local agent proxy settings applet, as direct outbound internet/server access is blocked for these endpoints. If we want our agents to auto-upgrade, do we absolutely have to enable and configure the 'Agent Installer and content caching' part of the applet on the Broker VM? Or can the agents just utilize the existing proxy connection to fetch the upgrade installer directly from the XSIAM cloud server on their own? We understand that passing the installer through the proxy without caching will consume more cloud-to-local bandwidth, but given our low endpoint count, we want to know if auto-upgrades are functionally supported this way. Additionally, what is the maximum recommended number of agents for this type of deployment?

Re: Cortex XSIAM broker vm

Vinothkumar_SBA — Thu, 09 Jul 2026 06:33:26 GMT

Hi @bridgetlitt

The Agent Installer and Content Caching feature is not required for Cortex XSIAM agent auto-upgrades. Its primary purpose is to optimize bandwidth by caching agent installers and content updates on the Broker VM.

If only the Local Agent Proxy is configured, and the endpoints communicate with the Cortex XSIAM cloud exclusively through the Broker VM (with no direct Internet access), the agents can still automatically download and install upgrades through the proxy. In this scenario, the Broker VM simply forwards the traffic between the agents and the Cortex XSIAM cloud. The only trade-off is that each endpoint downloads the installer individually, which increases WAN bandwidth usage during upgrade deployments.

The Agent Installer and Content Caching feature is recommended for larger environments because it reduces bandwidth consumption and accelerates mass deployments, but it is not a functional requirement for automatic agent upgrades.

Regarding scalability, a Broker VM configured for Agent Proxy can support up to 50,000 agents on newer Broker VM deployments (or 28,000 agents on older deployments), while Agent Installer and Content Caching supports up to 10,000 agents per Broker VM when the required hardware specifications are met.

Therefore, for a smaller deployment with a limited number of endpoints, using only the Local Agent Proxy without enabling Agent Installer and Content Caching is a supported and practical deployment model.

Best regards,

Vinothkumar.C.

topic Cortex XSIAM broker vm in Cortex XSIAM Discussions

Cortex XSIAM broker vm

Re: Cortex XSIAM broker vm