Cortex XDR as part of the golden image

[Shashanksinha]

• How can we include Cortex XDR as part of the golden image? (for the agent installation on Windows)
  • Condition:- It shouldn't create any duplicate entries on the console.
• Will there be a new entry on the console if the admin changes the system hostname?

    Also, If someone changes the name of the host does it create a new entry on the console for it and a new endpoint ID is assigned to it?

[mavraham]

Hi @Shashanksinha,

Thank you for writing to live community. 

Hi

1. Yes, Cortex XDR can be included as part of a golden image
2. Adding Cortex XDR to the golden image could result in duplicate entries, namely the same endpoint IDs.  In such cases, using ‘cytool reconnect force’ should help fix the issue.
3. Each agent have its own unique ID to communicate to XDR server, so simply changing hostname should not create an additional entry.

4. You can use the following basic XQL query to identify duplicate endpoints:

dataset = xdr_data 

| fields agent_id, agent_hostname

| filter agent_hostname != NULL

| dedup agent_id

Hope this helps!

[hugosantos]

Hi.

My organization tried to implement Cortex XDR on our Golden image for our Citrix persistant VDi's. And we have face an issue during the deploy of the golden image throught Citrix Studio, during the boot of the cloned image used by our machines catalogs. 
What seems to happen is that the boot takes forever on this image and there is a timeout during Citrix Deployment.

On the initial Golden image the boot takes up to 3 minutos when Cortex XDR is installed (but boots) - if we remove Cortex XDR it takes a few seconds - , any clone from this will take forever to boot.

We have postponed the use of Cortex XDR since we are unable to deploy it under VDI's and cannot not found the reason for it.

[mavraham]

Hi @hugosantos,

This sounds like performance issues. Due to this being a public forum, I highly suggest opening a support ticket in our support portal

so that this could be further investigated.