Endpoint shows as offline and is not clickable in an incident

[Arman_Zaheri]

Hello everyone,

We have a problem recently that in Cortex incidents we see involved endpoint as offline, even though it is online (if we go to Endpoints in Cortex we see it online and "Last Seen" is very recent) and it is not clickable like before. This is the case for most of the endpoints since the last two weeks.

[nsinghvirk · Accepted solution]

Hello @Arman_Zaheri 

Thanks for reaching out on LiveCommunity!

Please try performing a manual checkin from endpoints table and after some time refresh incidents tab. If issue persists please open a support case with TAC team to investigate the problem further.

[Arman_Zaheri]

Thanks for your help. It didn't work even after checking in. I'll open a support case.