topic Re: Cortex XDR Agent in General Topics

Cortex XDR Agent

samulelebarbera — Wed, 29 Mar 2023 14:36:49 GMT

Hi,

I'm noticing that Cortex Agent is giving me High RAM usage in all endpoint

Re: Cortex XDR Agent

aleksandar.astardzhiev — Thu, 30 Mar 2023 10:32:40 GMT

Hi @samulelebarbera ,

Any prove that is caused by Cortex XDR?

Are you talking about servers or workstations?

Re: Cortex XDR Agent

samulelebarbera — Thu, 30 Mar 2023 10:37:52 GMT

Hi @aleksandar.astardzhiev ,

from the task manager I see that it is cortex that consumes a lot of resources and slows down my devices, both servers and workstations

Re: Cortex XDR Agent

BPry — Thu, 30 Mar 2023 12:51:05 GMT

@samulelebarbera,

Do you have an established installation in your environment, or is this something that you are just starting to roll out? Generally when this gets reported the root of the issue is that someone is running Cortex alongside another AV product, do you have any other solutions installed alongside Cortex?

Re: Cortex XDR Agent

samulelebarbera — Thu, 30 Mar 2023 12:53:32 GMT

@BPry

Cortex is in use for 2 years, no other AV installed apart from Microsoft Windows Defender

Re: Cortex XDR Agent

BPry — Thu, 30 Mar 2023 13:21:59 GMT

@samulelebarbera,

I'd generate a support file and take a look if you're seeing an increase in memory usage. Outside of someone making a file scanning change you shouldn't be seeing any sort of resource increase reported with the latest agent.

Re: Cortex XDR Agent

aleksandar.astardzhiev — Fri, 07 Apr 2023 07:42:32 GMT

Hi @samulelebarbera ,

I was hoping you can share any evidences that Cortex XDR is really consuming high amount of resources

And actually see what you mean by "high"

Apart from that, a while ago we noticed that the Network Packet Inspection Engine Protection was causing performance issues on servers with high amount of traffic. We didn't had any issues with workstations as it looks like they usually generate high volume of network traffic.

If you still believe XDR is still the cause of the performance issues - which I am still skeptical since you haven't provide any prove - you can try to create separate profile which will disable network inspection, if this does not help you can start disabling modules