Endpoints not being reflected on the XDR console

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Endpoints not being reflected on the XDR console

L2 Linker

Hello ,

 

We are facing an issue where an endpoint will be reflected on XDR console but after some time the same endpoint will not be seen on the console . Somehow it will come again after a while or a day or two. Does anyone know why this might be happening ?

 

Thanks. 

3 REPLIES 3

L5 Sessionator

If the endpoints are disappearing from the console and reappearing after some time, please check

1. if the First Seen Date field in the All Endpoints page changes after every subsequent re-appearance.

bbarmanroy_0-1659081791221.png

 

2. Is the issue only appearing in your browser or all Cortex XDR users experiencing it?

 

3. Have you tried with other browsers or with Incognito mode to see if the issue persists?

 

 

 

Hi Thank you !

 

We are still looking into the point 1 you mentioned .

All Cortex users are experiencing this issue .

Yes this issue is still persisting even in incognito and other browsers.

L3 Networker

Hi @NivedaR 

 

I understand that you are facing issues with endpoints not reflecting in console, they appear and disappear automatically from XDR console.


From above issue statement, based on my experience, I assume that for some reason agent might have received same unique agent ID to multiple endpoints when they registered to XDR server. This could be causing the issue here.


You can check multiple endpoints have same agent ID or unique ID by verifying the Agent ID value under the Endpoint ID column for the particular endpoint from Endpoints -> All Endpoints section in the XDR Management Console.
If all the endpoints not appearing in console at a time, you can check value in agent.id file under the path C:\ProgramData\Cyvera\LocalSystem\OSPersistence in the affected endpoints.
These value should be unique to each endpoint.

If you have same agent ID showing in multiple machines from above verification, please let me know.

Based on your response I can suggest you a solution.

  • 1351 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!