Cortex XDR Broker VM handling

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Cortex XDR Broker VM handling

L3 Networker

Hello dear live community! 

 

We are now at the step where we connect some Servers to Cortex XDR which should not connect directly to the Internet. 

In the first mind we talked about the Tier 0 server. Today I was asked why we cannot bring all the server under the umbrella of the Broker vm. 

I am a little bit unsecure to put about 100 server onto one Broker vm. 

Here are my questions:

1. when Broker vm is down, compromised, dead, how do I connect all the server endpoints onto the second Broker vm? Is there a HA balancing to another Broker vm posibility? Yes I habe seen the fallback to internet setting. 

2. Is the live terminal possible When the server are connected through the Broker vm?

 

BR

 

Rob

 

1 ACCEPTED SOLUTION

Accepted Solutions

L3 Networker

Hi Cyber1985,

 

First, the Broker can handle up to 10,000 endpoints so 100 servers is not a stretch.  You may want to consider deploying two Brokers and then providing both as proxies to your servers for redundancy.  This is configured via Endpoints -> All Endpoints, select the servers and right-click -> Endpoint Control -> Set Agent Proxy, you can specify the IPs and ports for both Brokers and then the agents on these servers will be able to use either one.  You don't directly do "HA" configuration in the Brokers or XDR Instance as they Brokers do not need to communicate with one another, just provide both as proxies for your agents and you will be ready to go.

 

Second, you can absolutely use the Live Terminal when an agent connects through a Broker.

View solution in original post

4 REPLIES 4

L3 Networker

Hi Cyber1985,

 

First, the Broker can handle up to 10,000 endpoints so 100 servers is not a stretch.  You may want to consider deploying two Brokers and then providing both as proxies to your servers for redundancy.  This is configured via Endpoints -> All Endpoints, select the servers and right-click -> Endpoint Control -> Set Agent Proxy, you can specify the IPs and ports for both Brokers and then the agents on these servers will be able to use either one.  You don't directly do "HA" configuration in the Brokers or XDR Instance as they Brokers do not need to communicate with one another, just provide both as proxies for your agents and you will be ready to go.

 

Second, you can absolutely use the Live Terminal when an agent connects through a Broker.

Thank you very much for sharing your knowledge! 

 

BR

 

Rob

Hi Afurze, is there a redundancy option (without use of external load-balancer) when we use Broker VM as Syslog forwarder?

Or is there a way how to do automatic deduplication on Cortex XDR side?

Thank you,

Jan

 

Honza_Linhart,

 

No, there is no product supported load balancing mechanism.  You can use an external load balancer as you suggested or set up a single Broker VM and use a syslog service such as syslog-ng which will queue messages on disk if it isn't able to send them.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!