Cortex XDR 3.10 and endpoint slowness

[PC-TomS]

3.10 activated in our tenant yesterday and along with that, our endpoints started upgrading to 8.3 (we are one release behind the latest).

This morning we were deluged with calls about unresponsive endpoints.

We stopped the automatic endpoint upgrades leaving most on 8.2, but it seems like any version could have the issue.

The only other clue is VA assessment has been running since this morning.

Makes me wonder if something in the back-end is causing the issue.

Anyone else experience this?

[jmazzeo]

Hi @PC-TomS, thanks for reaching us using the Live Community.

With the XDR 3.10 version, the "Enhanced Vulnerability Assessment" feature is added to the product. Are you able to check if it is enabled in your tenant?

This enhanced versions scans for applications vulnerabilites in Mac and Windows endpoints, and can have a performance impact in the agent for a few minutes.

This is detailed in the official doc in "Limitations": https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Vulnerabili...

Anyway, if you find that the performance impact takes longer, even with the Enhanced VA feature disabled, please open a TAC case to have a deeper analysis.

If this post answers your question, please mark it as the solution.

[PC-TomS]

It is not enabled, but it sure acts like it is. 

We have a support case open on this, but I thought I'd post here to see if anyone else was having the same issue.

I find it interesting that so many posts refer to TAC cases.  I thought that was a Cisco term, lol

Thanks