Endpoint shown as 'Connection Lost' - cannot reach

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L0 Member

Endpoint shown as 'Connection Lost' - cannot reach

I have a user (my boss) who is one of several endpoints with a status of 'Connection Lost'. I'm not actually able to ping him from the DNS server when he is plugged in to the network at work; the XDR portal reports two IP addresses which are probably from his domestic wifi.

Running the msi to install isn't possible because tamper protection is enabled so I am not sure how I can get Cortex XDR running properly again.

I am guessing that this and other 'Connection Lost' issues are down to IP changes but... how can I clean up the portal and re-establish broken connections.

Highlighted
L1 Bithead

'Connection Lost' means that your endpoint has not communicated with Cortex Console for more than 30 days.

 

You should investigate locally the machine to find out what's the problem.  Probably a network issue or some kind of block (firewall, app, ETC) preventing the Agent from communicating with Cortex Servers.

 

This has nothing to do with the number of IP address you can see in Cortex Console.

 

btw, you can disable the Anti Tempering with the command:  cytool.exe protect disable

 

 

Martin Cimone
Highlighted
L0 Member

Thanks. I have got advice to remove the client and re-install and there is a utility for doing this for Windows... is there a Mac utility too, as one of these is a Mac.

 

One of the disconnected Windows agents, on a server, couldn't have been due to a network issue - or if it was the connection was not re-made when whatever happened was over. So I had to remove the agent and reinstall.

 

Tim

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!