Disappearing XDR Endpoints for iOS and Android

[cnogawaterfront]

Hi There,

We've got the XDR Agent for mobile devices deployed in our environment for both Android and iOS.

I've noticed after some time these devices stop checking in with Cortex in the Endpoints dashboard.

The devices will first say 'disconnected' then 'connection lost' etc. 

Funny thing is, they seem to stay upgraded in terms of versions. We've got them deployed though Intune.

Just seems like they don't stay activated? Do new versions require a manual re-activation after each upgrade?

This was quite noticeable with the iOS devices where many users updated their iOS to a new major version, say 15.x to 16.5.

The Cortex agents seemed to be re-installed but were not showing on the Endpoints dashboard anymore.

Does this mean those XDR agents aren't scanning any longer/returning reports?

Also, I read somewhere the agents have to be manually started up after every device reboot .. is this actually true? That would seem to default to the purpose of 'always on' security.

See attached -  notification from end users device, asking to manually start the app again after a reboot...

Anyhow, let me know if you've run into the same situation.

Thanks

[neelrohit · Accepted solution]

Hi @cnogawaterfront ,

For iOS and android devices, the reason why you might find them disconnected after OS upgrade is because these endpoints would shutdown and reboot during upgrade cycle. As per our admin guide, it is clearly mentioned that we have to manually start the applications to let it run after reboot.

You can refer here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-iOS-App/Install-Cortex-XD...

 Hope this helps