Cortex XDR agent network bandwidth consumption

[tejaspatil12]

Hello team, 

Does anyone know how much internet bandwidth the Cortex XDR agent consumes when there is no Broker VM, and the agent connects directly to Palo Alto URLs / the Cortex XDR tenant?

Cortex XDR Cortex Cloud 

[mshamamulla]

Hi @tejaspatil12 

Could you please be specific to your question, Are you talking about internet bandwidth consumed during General-Telemetry/Heartbeats, EDR/ Event-Telemetry.......

[tejaspatil12]

Hi @mshamamulla , 

I want details about all the consumptions including Telemetry/Heartbeats, EDR/ Event-Telemetry

[mshamamulla]

Hi @tejaspatil12 

1) General Telemetry and Heartbeats:- For basic management, including heartbeats and general telemetry, the standard requirement is approximately 1.2 Mbps for every 1,000 agents. This requirement scales linearly (e.g., 100,000 agents require 120 Mbps).

2) EDR and Event Telemetry:- EDR data consumption is highly variable and depends on the endpoint's activity and the verbosity of your security policies.
     * Average Estimate: Field observations suggest that, on average, approximately 65 agents collect 1 TB of data per month
    * Data Types: This includes telemetry for process executions, file access, network connections, and host inventory.
    * Caching: If connectivity is lost, agents can cache up to 200 MB of EDR data locally before it is rotated.

3. Content and Installer Updates:- Without a Broker VM to act as a local cache, every agent must download updates directly from the Cortex XDR console.
    * Content Updates (CU): These occur periodically. Typical package sizes are approximately 1 GB for Windows and Mac, while Linux content updates are significantly larger, often reaching 5 GB
    * Agent Upgrades: Installer packages for version upgrades are typically around 700-800 MB (e.g., 749 MB for Windows)