Endpoints not showing on console

[Shahwaz_Md]

Hi, 

Cortex XDR is installed on the client's endpoints but it is not visible on our console, what could be the possible reason behind this?

Thanks

[creddy]

Hello @Shahwaz_Md,

There could be various reasons for the endpoint not showing in the console. 

But primarily if the agent does not have network access to all required resources, it may fail to communicate to the Cortex XDR cloud server and does not show up on the console.

Check if the agent machine able to reach all cloud URLs.

To know the list of cloud resources to allow from the agent side, refer below article.

Resources Required to Enable Access • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networ...

Thank you!

[Shahwaz_Md]

Hi Creddy,

Thanks for the reply, all the URLs in the list are allowed from the Agent side but still we are facing the issue.

[neelrohit]

Hi @Shahwaz_Md ,

Agent does not reflect primarily because of the network connectivity and there is a lot of certainty that one or more than one network element(firewalls, authentication proxy, etc.) is blocking the connection. Inorder to validate it, you can try couple of things:

1. Open cmd as administrator, 
2. cd C:\Program files\Palo Alto Networks\Traps\       ///( for windows endpoints)
3. cytool connectivity_test, add uninstall password <possibly "Password1" or anything that you have set>
4. Observe the output. It should come up something like the screenshot below:
   

Second option is do a traceroute to any of the IPs listed in the URL, depending upon your region. (Eg. EU) and then if there is an RTO output, you would know the issue. 

If you need additional guidance, please retrieve the TSF from the agent of the affected endpoint and open a support case for analysis

Regards,

[joseph.lim]

1. Check internal firewall.

2. Check enterprise firewall if any of the pre-requisite url is blocked

3. If brokervm is implemented, check if proxy is set.

4. Check if services is up by > cytool runtime query