07-28-2022 11:23 PM
We are facing an issue where an endpoint will be reflected on XDR console but after some time the same endpoint will not be seen on the console . Somehow it will come again after a while or a day or two. Does anyone know why this might be happening ?
07-29-2022 01:04 AM
If the endpoints are disappearing from the console and reappearing after some time, please check
1. if the First Seen Date field in the All Endpoints page changes after every subsequent re-appearance.
2. Is the issue only appearing in your browser or all Cortex XDR users experiencing it?
3. Have you tried with other browsers or with Incognito mode to see if the issue persists?
07-31-2022 10:41 PM
Hi Thank you !
We are still looking into the point 1 you mentioned .
All Cortex users are experiencing this issue .
Yes this issue is still persisting even in incognito and other browsers.
08-01-2022 08:18 PM
I understand that you are facing issues with endpoints not reflecting in console, they appear and disappear automatically from XDR console.
From above issue statement, based on my experience, I assume that for some reason agent might have received same unique agent ID to multiple endpoints when they registered to XDR server. This could be causing the issue here.
You can check multiple endpoints have same agent ID or unique ID by verifying the Agent ID value under the Endpoint ID column for the particular endpoint from Endpoints -> All Endpoints section in the XDR Management Console.
If all the endpoints not appearing in console at a time, you can check value in agent.id file under the path C:\ProgramData\Cyvera\LocalSystem\OSPersistence in the affected endpoints.
These value should be unique to each endpoint.
If you have same agent ID showing in multiple machines from above verification, please let me know.
Based on your response I can suggest you a solution.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!