Anyone else having XDR communication problems?

[G.Stefanov]

Starting later in the day on June 24, we started seeing endpoints show 'No connection to server' when opening the Cortex console on the endpoint. Endpoint tasks like collect firewall logs, pause protection and live terminal all fail.

Some systems shows that they ARE connected to our tenant but trying to live terminal into them fails.

[susekar]

Hello @G.Stefanov ,

Greetings for the day.

The issue you are describing, where endpoints show as "Connected" in the management console but "No connection to server" on the local agent UI while interactive tasks (Live Terminal, log collection, pausing protection) fail, typically stems from a breakdown in the secure WebSocket (WSS) communication channel or an internal agent Inter-Process Communication (IPC) failure.

Diagnostic Steps on Affected Endpoints:

Run the following commands from an elevated Command Prompt to isolate the failure point:

1. Verify Service Status:cytool runtime query

Ensure that cyserver and cyverak are in a Running state.

2. Test Network Connectivity: cytool connectivity_test

Review the output for any DNS errors, connection timeouts, or SSL errors.

3. Verify WebSocket Status: cytool websocket query

Confirm that the output shows: Connected: true

If it displays Connected: false or No websocket connection available, the agent is unable to receive real-time commands.

--------------------------

Recommended Remediation Actions

1. Whitelist Required URLs

Ensure that all regional Cortex XDR URLs, including wss:// (WebSocket) connections, are excluded from SSL/TLS decryption and Deep Packet Inspection (DPI) on your network security devices.

2. Force Agent Reconnection

If network connectivity is confirmed but the agent remains out of sync, force a reconnection using the tenant's Distribution ID: cytool reconnect force [DISTRIBUTION_ID]

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution"

Thanks & Regards,
S. Subashkar Sekar