Cortex XDR Broker VM handling

[Cyber1985]

Hello dear live community! 

We are now at the step where we connect some Servers to Cortex XDR which should not connect directly to the Internet. 

In the first mind we talked about the Tier 0 server. Today I was asked why we cannot bring all the server under the umbrella of the Broker vm. 

I am a little bit unsecure to put about 100 server onto one Broker vm. 

Here are my questions:

1. when Broker vm is down, compromised, dead, how do I connect all the server endpoints onto the second Broker vm? Is there a HA balancing to another Broker vm posibility? Yes I habe seen the fallback to internet setting. 

2. Is the live terminal possible When the server are connected through the Broker vm?

BR

Rob

[afurze · Accepted solution]

Hi Cyber1985,

First, the Broker can handle up to 10,000 endpoints so 100 servers is not a stretch.  You may want to consider deploying two Brokers and then providing both as proxies to your servers for redundancy.  This is configured via Endpoints -> All Endpoints, select the servers and right-click -> Endpoint Control -> Set Agent Proxy, you can specify the IPs and ports for both Brokers and then the agents on these servers will be able to use either one.  You don't directly do "HA" configuration in the Brokers or XDR Instance as they Brokers do not need to communicate with one another, just provide both as proxies for your agents and you will be ready to go.

Second, you can absolutely use the Live Terminal when an agent connects through a Broker.

[Cyber1985]

Thank you very much for sharing your knowledge! 

BR

Rob

[Honza_Linhart]

Hi Afurze, is there a redundancy option (without use of external load-balancer) when we use Broker VM as Syslog forwarder?

Or is there a way how to do automatic deduplication on Cortex XDR side?

Thank you,

Jan

[afurze]

Honza_Linhart,

No, there is no product supported load balancing mechanism.  You can use an external load balancer as you suggested or set up a single Broker VM and use a syslog service such as syslog-ng which will queue messages on disk if it isn't able to send them.