Performance Impact of Cortex XDR Process Monitoring and Process Injection Detection

[tlmarques]

Hi,

We would like to understand whether there is any way to determine which processes are being actively monitored/analyzed by Cortex XDR on an endpoint and, more importantly, what performance impact this monitoring may be having on the applications.

We are particularly interested in understanding whether process monitoring, process injection detection, or other Cortex XDR protection mechanisms can introduce additional CPU usage, processing overhead, or delays to specific applications/processes.

Our questions are:

1. Is there a way, either through the Cortex XDR console or locally on the endpoint, to identify which processes are being actively monitored or analyzed by Cortex XDR?
2. Is there any way to measure the performance impact/overhead caused by Cortex XDR on a specific process or application?
3. Can we determine whether Process Injection monitoring/detection is contributing to a delay or performance degradation in a specific application?
4. Are there any XQL queries, agent logs, diagnostic tools, or other troubleshooting methods that can help us correlate:
   • Process activity
   • Cortex XDR monitoring/detection
   • CPU/memory usage
   • Application response time or execution delays
     
     

We have a specific application where we suspect that Cortex XDR monitoring may be contributing to performance degradation, so we would like to collect objective data before making any configuration changes.

Could you please advise us on the recommended troubleshooting methodology and which logs/data you would need from the endpoint?

Thanks in advance.

[susekar · Accepted solution]

Hello @tlmarques ,

Greetings for the day.

1. Identifying Monitored Processes:

• Windows Registry: Check HKLM\SYSTEM\Cyvera\Policy\Organization\Process\<affected-process-name.exe>. Protect = 1 confirms injection.
• Process Explorer: Check loaded DLLs. cyvrtrap.dll or similar Cortex DLLs indicate active monitoring.
• TSF Analysis: Check CyveraSystem.reg for protection status and modules.
  
  

2. Measuring Performance Impact:

• Use cytool to check agent resource usage. cyserver.exe and sandbox processes may use up to 800 MB; sustained usage above 1 GB may indicate high overhead.
• Shellcode Intercept and Dynamic Kernel Protection can introduce execution delays.
• Isolation Test: Create a Legacy Agent Exception with Disable Injection, restart the application, and test.
• If performance improves, re-enable injection and disable modules such as BTP, DLL Security, or ROP Mitigation one-by-one.
  
  

3. Diagnostic Data

For Support:

• TSF collect immediately after reproducing the issue.
• User-Mode Process Dump if the application crashes.
• ProcMon Log captured during the slowdown.

(Summary)

• DLP Classification: CPU is limited to 50% and memory to 1 GB per process.
• Constantly reaching these limits indicates a potential performance issue requiring engineering investigation.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar