Cortex XDR agent protection after 90 days of inactive

[B.Sasmito]

Hello Everyone. 

I need your opinion to this topic. What will happen to the agent protection for the endpoint after 3 months of inactive. 

Correct me if im wrong. Cortex XDR agent will delete permanently from management console and database after default deletion which is 90 days. 

if i enable all the module in day 1 for an endpoint, then after 90 days which is day 91, my agent in an endpoint can't connect to Cortex XDR platform anymore which leave it as "Zombie agent". 

in this case, what happen to the all module, does the agent still have capabilities of enabled module before 90 days implemented within agent's local database or does the enabled module work via internet connection ? if so, what prevention the agent currently have within that state ? 

Hope everyone can help me with this question, Thanks !

[H.Eldessouki · Accepted solution]

Small correction on the numbers  ----> 90 days is the retention window after an endpoint is manually deleted from the console, not the inactivity trigger. Pure inactivity works differently: standard agents auto-delete after 180 days of no check-in, VDI/TS agents after just 6 hours. So on day 91 your agent isn't gone, it's just quiet.

While it's disconnected, prevention doesn't stop — exploit protection, restriction rules, child-process protection etc. all enforce locally on the endpoint regardless of connectivity. For malware verdicts specifically, the agent falls back to its local hash cache + Local Analysis (its own on-box ML/pattern engine) instead of querying WildFire. So it's not "defenseless," it's just working off last-known intel until it reconnects.

[B.Sasmito]

Thank you sir !

[B.Sasmito]

I got another question, if i turn on the endpoint after 180 days which is day 181, will my agent be able to reconnect ? or it won't be able to reconnect ?

[susekar]

Hello @B.Sasmito ,

Thank you for the response.

if you turn on an endpoint after 181 days, it will not automatically reconnect to the console using its original identity.

If you need to restore protection to a device that has been offline for more than 180 days, you must perform manual intervention to re-register it as a "new" asset:

Option 1: Cytool Reconnect: Use the cytool reconnect force (Distribution ID) command on the endpoint. This forces the agent to register as a new asset, which will be assigned a new Agent ID.
Option 2: Reinstallation: Uninstall the existing agent and perform a fresh installation.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar