Broker VM upgrade control (Delay)

[A.Bisht584260]

Hi Team,

As we faced the mass issue of BSOD due to Crowdstrike, there's a query by management team that can we delay the agent upgrade or we can say can we control upgrade process of Broker VM if we want to hold the version on any specific version.

[aspatil]

Hello @A.Bisht584260 ,

Thanks for reaching out on LiveCommunity!

Please have a look at below discussion:
https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/preventing-crowdstrike-disaster-in-corte...

If you feel this has answered your query, please let us know by clicking on Like and "mark this as a Solution".

[A.Bisht584260]

Hi @aspatil,

Thanks for your response, but this following query of delaying the content upgrade and agent upgrade was already been found out. Also i would like to know the risk of delaying the content upgrade as it comes weekly.

But the thing is, we had a query of delaying the agent upgrade of Broker VM? Is it possible to do so?

[aspatil]

Hello @A.Bisht584260 ,

You can create a different policy for those Endpoints and use below:

Regarding risk, if you delay the content update, that means you have accepted the risk. If you want to go with immediate and determine it can be risk, then we do have quality assurance process before publishing any kind of update.

Hope this helps!

[A.Bisht584260]

Hi @aspatil ,

I am querying about the following attached screenshot, the highlighted agent version of Broker VM not the agent version of Endpoints.

[aspatil · Accepted solution]

You meant Broker VM version. You cannot control the delay, but it is possible to disable the auto upgrade:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Edit-Your-B...