High CPU after XDR 2380 Content update

[Joe-Oberfoell]

Anyone else seeing this? Its slowing all our servers down and VM's

[susekar]

Hello @Joe-Oberfoell ,

Greetings for the day.

Regarding the high CPU usage observed after the Cortex XDR 2380 content update, this is a known phenomenon that can occur when a content update triggers intensive security scans or encounters resource contention, particularly on high-load servers like ADFS WAP or database servers .

Recommended Mitigation Steps:

• For critical servers, consider increasing system resources (e.g., doubling vCPUs and RAM) as a short-term remediation .
• Module Isolation: To identify the specific cause, perform a module isolation test:
  • Disable the Malware Profile first .
  • If high CPU persists, disable the Exploit Profile and restart the impacted applications/services .
  • Test disabling Event Collection if the issue is still unresolved .

For a thorough investigation, I recommend raising a TAC support ticket with the Cortex XDR Palo Alto Networks team. They can perform an in-depth analysis to identify the root cause (RCA) and provide the necessary resolution.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[Joe-Oberfoell]

Thx, I did open a ticket. This is the 1st time in 4 years a content update has ever slowed us down.