Cortex XDR on Citrix non-persistent multi-user server

[Remo]

Hi community

Quite often we have issues with cortex xdr on citrix infrastructure. Currently meinly with windows server 2022 we are in the situation where it is not possible to run cortex at all because of possibel servercrashes which are not yet analyzed and resolved. So we needed to - at least temporary - change to microsoft defender. I wanted to ask here what are your solutions to let cortex xdr run properly on citrix servers without bothering the user too much? Do you use exceptions for different paths or specific configurations?
Would be great to collect some informations on how to do this properly as I assume this could also help others here.

Looking forward to your replies 🙂
Remo

[jmazzeo]

Hi @Remo, thanks for reaching us using the Live Community.

Have you installed the agents following our specific procedure fore VDI environments?: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.6/Cortex-XDR-Agent-Administrator-Guide/Corte...

Pay attention to this note in the linked doc:

If this post answers your question, please mark it as the solution.

[Remo]

Hi @jmazzeo 

Thanks for your answer. Yes we installed cortex according to this document. But on server 2022 we still have big issues. At least until version 8.5.0.

We actually always used the TS_ENABLED=1 param for these multi-user servers, but TAC told us to use the VDI_ENABLED=1 option for out installation, so since about 2 month. Which option would you recommend and are there other hints on how to successfully use cortex xdr on citrix servers?

[E.Jafarov]

Hi  Remo 

You can disable event collector ("cytool event_collection disable")  to reduce CPU usage if high. If does not work , you could create support ticket. The support team will provide YARA rule to map exception profiles, but protection capability performance will reduce slightly

[Remo]

@E.Jafarov to be honest, this does not really help. The issues we have seem to be quite complex as support so far is still analyzing the issue. It is not only the high cpu (even if disabling event collection is also not a solution as if you have cortex xdr you probably want this feature), the servers simply and then need to rebooted. Which results in hours of work lost for our customers every time it happens ...

[Remo]

The troubleshooting goes on. So far support has multiple memory dumps and cortex logs. Unfortunately so far I don't know any result of the analysis. Next week we plan to have a call between Paloalto and Citrix in order to move on in this situation.

At least so far it looks like with version 8.6.0 the situation seem to be more stable.