Constant Cortex XDR Agent upgrades

[TIbrahim]

Hello,

I am working in an organization with about 25,000 machines installed with Cortex XDR solution.
Recently we have noticed that there are many frequent upgrades being rolled out within a short time span.
To date, we are still having trouble keeping up with the upgrades on older systems especially with the jump from 7.9 to 8.0 due to Azure Code Signing requirements. This upgrade requires a lot of systems/applications needed to be revisited and multiple patches to be applied. While still tackling this issue, 8.2 has already been rolled out and 8.0 will be EOL by December 2023.

I understand that using the latest version of XDR is best practice, but the question I am trying to find an answer to is:
1. Would rolling back to CE versions be more advisable at our current state? Constant version upgrades require more resources to test the stability and iron out problematic installations one by one each time.
2. How do other companies manage their new versions rollout? Do they run into problems where large numbers of the XDR agent is not able to upgrade due to various reasons? If so, what would be the best way to handle this?

Regards,
Tawfik

[jtalton]

Hi TIbrahim,

Standard versions support will be provided for 9 months after the release date. These versions will be released alongside the server, approximately every 3 months with a 9-month support period. 

Critical Environment versions will be released in a cadence of 12-18 months and are designed to be installed in sensitive and highly regulated environments, will be provided 24 months of support since the release date. Due to its sensitive nature, these versions will include maintenance releases of critical and high-severity issues only. Frequency of hot-fixes depends on customer impact. 

Also, please note, standard versions can be upgraded to CE version subject to caveats:

• Any older releases prior to a CE version can be upgraded to a CE version from the console.
• Requires an uninstall of the current Agent then installation of the CE version i.e. 8.1.x & 8.0.x cannot be upgraded to 7.9.x CE 

Recommended Practices

• Enable automatic version updates on low impact systems (desktop/laptops).
• Enable automatic version on the longer standing release and minor updates for non-critical servers.  
• Manually update mission-critical servers per established change control. 
• Utilize Critical Environment agent versions for mission-critical servers

The Auto Upgrade setting is disabled by default, the upgrades are not intrusive typically takes an hour, the packet is small, you have the option config delay period. 

If you found this answer helpful, please select Accept as Solution.

Thank you