Broker VM for Cortex XDR

[Kavurisowmya]

Hi,

As a part of Cortex XDR , I would like to know some benefits of Broker VM

 I have gone through some of the docs and it looks like a Separate image that need to be installed. So,

1. Do we have to install it on every endpoint (Ex: 10,000 servers) that has cortex xdr installed and should we do it separately for every endpoint?

2. Should we maintain it frequently for updates, maintenance so on or it does automatically?

3. What more benefits we can have apart from content updates using broker VM when installed on a endpoint?

4. Does it help in improving cortex XDR performance (ex: speed)?

[MarvinC]

Hi Kavurisowmya,

*Note: This is an individual contributor answer*

1. Do we have to install it on every endpoint (Ex: 10,000 servers) that has
cortex xdr installed and should we do it separately for every endpoint?

- You don't need to install it on every endpoint but to configure it to be
used as a proxy or it depends on the agent configuration that you are
using.

- The configuration of brokerVM to be used as a content cache or agent
proxy will depend on your infrastructure like WFH employees that don't use
VPN can directly do the updates to Cortex XDR directly than using BVM.

2. Should we maintain it frequently for updates, maintenance so on or it
does automatically?

- The updates are defaultly set automatically.

3. What more benefits we can have apart from content updates using broker
VM when installed on a endpoint?

- Usage of bandwidth? Since you have your broker VM on your network, agents
won't need to consume Internet access directly outside since you have BVM
on your network.

4. Does it help in improving cortex XDR performance (ex: speed)?

- Speed of getting the content updates, I think yes. Since you don't have
to worry if an endpoint doesn't have Internet connection as long as the
endpoint can reach the BVM.

- with regards to the endpoint CPU performance, I don't think so.

Hope this helps.

[SilviuMihailDascalu]

Hi Matthew,

Information regarding the broker vm and the proxy setting for xdr agents is available here.  This will lower the traffic for content update and agent installs but everything will stay the same in terms of bandwidth consumption.

Let me know if you have any questions or concerns!

Thanks,

Silviu