Anyone else having XDR communication problems?

[G.Stefanov]

Starting later in the day on June 24, we started seeing endpoints show 'No connection to server' when opening the Cortex console on the endpoint. Endpoint tasks like collect firewall logs, pause protection and live terminal all fail.

Some systems shows that they ARE connected to our tenant but trying to live terminal into them fails.

[susekar]

Hello @G.Stefanov ,

Greetings for the day.

The issue you are describing, where endpoints show as "Connected" in the management console but "No connection to server" on the local agent UI while interactive tasks (Live Terminal, log collection, pausing protection) fail, typically stems from a breakdown in the secure WebSocket (WSS) communication channel or an internal agent Inter-Process Communication (IPC) failure.

Diagnostic Steps on Affected Endpoints:

Run the following commands from an elevated Command Prompt to isolate the failure point:

1. Verify Service Status:cytool runtime query

Ensure that cyserver and cyverak are in a Running state.

2. Test Network Connectivity: cytool connectivity_test

Review the output for any DNS errors, connection timeouts, or SSL errors.

3. Verify WebSocket Status: cytool websocket query

Confirm that the output shows: Connected: true

If it displays Connected: false or No websocket connection available, the agent is unable to receive real-time commands.

--------------------------

Recommended Remediation Actions

1. Whitelist Required URLs

Ensure that all regional Cortex XDR URLs, including wss:// (WebSocket) connections, are excluded from SSL/TLS decryption and Deep Packet Inspection (DPI) on your network security devices.

2. Force Agent Reconnection

If network connectivity is confirmed but the agent remains out of sync, force a reconnection using the tenant's Distribution ID: cytool reconnect force [DISTRIBUTION_ID]

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution"

Thanks & Regards,
S. Subashkar Sekar

[C.Hamilton931476]

Hi @susekar ,

These instructions are exactly what I'm looking for. 

On the distribution ID, I have not been able to find a good guide on how to find this information. Can you please provide instructions on how to do so?

Thank you.

[susekar]

Hello @C.Hamilton931476 ,

Thank you for the response.

The distribution ID used must be from an Agent Installer of the same OS and whose version is less or equal to the installed Cortex XDR Agent version.

To find the Distribution ID, do the following:

1. Navigate to Inventory-> Installations
2. At your top right, you will have three dots symbol, then search and add the field ID
3. Check the option and use the ID of the package that you have installed in the 'cytool reconnect force distribution_ID' command.

Or

You can enter the below command and see the Distribution ID in the Output - cytool connectivity_test 

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution"

Thanks & Regards,
S. Subashkar Sekar