Agents Intermittently Disappearing in Cortex XDR Then Shows Up

[katiea]

Hi,

Some Agents in Cortex DXR disappears then shows up after few days - no pattern at all

If my understanding is correct, if the Agents are disconnected or there's a connection lost, the Endpoint Status column will dictate it.

But the Agents in question are not. As in they're like "ghosts" that shows up then after some time disappears.

What could be the possible cause and/or ways to remediate this?

[neelrohit]

Hi @katiea ,

Thank you for writing to live community!

From your statement, your understanding is correct that the endpoints which are disconnected will show as disconnected and the ones which have lost connectivity will stay as connection lost until they connect or till the time they hit the agent deletion limit after which the agents entries are removed completely from the Endpoints Administration page(along with other data).

Based on your issue description, there is also a possibility that you might have Endpoint Administration Cleanup enabled and periodically set to delete duplicate entries on your tenant in the Global Agent Settings. This (if enabled) will cleanup agents from the Endpoints Administration page based on three listed parameters or the combination of the listed parameters:

1. Hostname
2. IP Address
3. Mac Address

We would request you kindly check if this is set to enabled and probably try disabling it to see if your issue is resolved.

To navigate, Click on the Gear Icon>Configurations>Agent Configurations>Endpoint Administration Cleanup> Check if it is set to enabled and try disabling it.

Hope this answers your question and please mark "Accept as Solution" if it does.

Best Regards.

[katiea]

Hi,

Thank you for this. But upon checking, Endpoint Administration Cleanup is disabled. 

[neelrohit]

Hi @katiea ,

It is also possible to perform one time cleanup manually. Can you also check in the management audit logs if someone is using that option by any chance. If not, can you also let us know if you are able to find the list of hosts in question as uninstalled status by any chance?

[katiea]

Hi @neelrohit 

They are not also in uninstalled status. I apologize as I forgot to mention that when we tried to extract, and look into it in via Excel, it does not really appear. In short, in any status the machines won't show.

[neelrohit]

Hi @katiea ,

So, if I understand correctly, you have been looking into Excel sheets all this long and you have found out that the entries disappear in the excel sheet, but are in the console and sometimes, those entries populate themselves upon the list extraction in tsv?

Regards

[eluis]

Hi @katiea 

If the timeout for deleting the endpoints that do not connect for days is very low, it might be that they dissapear and appear again. I dont think that this will be the issue though. By default this option is set to 180days. 

Could it be that sometimes you have a filter set and some of the endpoints are filtered out and not shown ? 

These are little mistakes that sometimes might drive us crazy

KR,

Luis 

[katiea]

Hi @eluis ,

For this one, prior extraction the filters have been removed. It just drives us a nearly crazy on why the machines are like mushrooms that they totally disappear with no status whatsoever and then appears again. 

[katiea]

Hi @neelrohit ,

Apologies as I got confused with your question.

Bottomline is that there are days that the machines are disappeared (as in no trace whatsoever) and the after some time they will be on the endpoints list again.