Command line to set a Proxy_List to an already installed Cortex XDR Agent

[MartinCimone]

Hi.

Does anyone know if there is a command line to set a proxy to an already installed version of Cortex XDR?

I know the proxy can be set using the command line:  Cortex_Installer.msi proxy_list=”<proxy>:<port>”

That being said, I didn’t find any way to change the defined proxy, once the installation is complete, except completely uninstalling the software and re-installing it with the correct Proxy list.

I know I can change it through the Cortex Cloud console but the problem I am facing is that some of our endpoints do not have access to the internet and we are using Cortex Broker VMs as a relay.  So, if someone made a mistake when entering proxy information, that computer will never register with the cloud console, and modifying the proxy won't be available.

TLDR:  is there any command line available to force a Cortex XDR proxy list once the application is installed?

Thanks.

[JohnSmith7732 · Accepted solution]

cytool proxy set "<Proxy IP><Port>"

Should work

Im pretty certain you list several brokers separated by ; or comma. Youll have to check that

[MartinCimone]

Exactly what I was looking for.

Thanks

[AtanasBachvarov]

Hi,

Thank you for the information, though I am unable to change the proxy following your guide. When I attempt to add any of the two  commands you have shared:

cytool proxy set "<Proxy IP><Port>"
Cortex_Installer.msi proxy_list=”<proxy>:<port>”

I get the following message: "cytool" or "Cortex_Installer.msi" is not recognized as an internal or external command. Could you please advise?

Just to clarify I am using Windows 10. Is your post about the Windows 10 Command line or another OS?

Thanks in advance,
Atanas

[MartinCimone]

"cytool.exe" is an executable from Cortex XDR and the folder containing the executable is NOT in the Windows System Path.

You need to be in the Cortex XDR installation folder before running the command.

Ex:   

- Open a Command Prompt "cmd"

- Go to folder C:\Program Files\Palo Alto Networks\Traps

- Run the command to set your proxy:   cytool.exe proxy set 1.1.1.1 8888

That's it.

[eluis]

Hi 

additionally you can add C:\Program Files\Palo Alto Networks\Traps to your windows path

KR,
Luis

[AtanasBachvarov]

Thank you! Should there be the symbol ":" , between the Proxy IP and the Port please?

I do appreciate your patience with my query 🙂

[AtanasBachvarov]

Thank you! Should there be the symbol ":" , between the Proxy IP and the Port please?

[MartinCimone]

YES!

The exact command line is:

• cytool.exe proxy set 10.10.10.10:8888   (Use the IP and port configured in your BrokerVM)

[AtanasBachvarov]

Thank you all so much Martin! Is there a way to add two Proxies at the same time please? 🙂

Again your feedback is deeply appreciated.

[MartinCimone]

Sure you can.

Just separate each value with a comma ",".

Ex:  cytool.exe proxy set 10.10.10.10:8888,11.11.11.11:8888

[AtanasBachvarov]

Makes sense, thank you once again Martin!

[MosR]

Set or query cloud-defined proxies for the agent.

Usage:

• cytool proxy query—Displays the current status of cloud-defined proxy settings.

• cytool proxy set <list>—Set cloud-defined proxy settings to the proxies defined in <list>. For example: cytool proxy set "192.168.50.1:8080,192.168.60.2:808"

• cytool proxy set “”—Disable cloud-defined proxy.

[MosR]

You can now just right click on an endpoint and add it to your proxy if you are on Cortex XDR V3.8.