Cortex XDR Agent Failover

[HindraHindra]

Hi,

I use broker VM for bridging communication between XDR agent and XDR cloud. But the communication can happen only when the agent reside in internal network. Does cortex xdr have mechanism to detect whether inside or outside network? So it can decide to send data via broker VM (inside network) or direct to cloud (outside network)?

Thanks in advance

[eluis]

Hi @HindraHindra 

You can configure agent to use as a proxy the Broker VM. As far as the agent has physical network access to the BVM that should work. 

And yes, there is a config that will tell XDR what is inside the network and outside the network 

When you configure the agent settings profile, you scroll down to the Network Location Configuration and you will see there the option to add the DNS and IP address so that the agent will know if it is inside or outside internal network. 

Please check the attached screenshot as a reference

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

[HindraHindra]

Thanks Eluis

What I try to find is configuration to make XDR agent can automatically decide to :

1. Connect to broker VM when XDR agent reside on internal network

2. Connect direct to XDR tenant on cloud when XDR agent reside on outside network (can not reach broker VM)