Use Case and Purpose of xdrhealth.exe

[KanwarSingh01]

Recently i have noticed that there is another folder which has been created under PA Cortex folder as below:

"C:\Program Files\Palo Alto Networks\Cortex XDR Health Helper"

Inside the Folder there is PE which is xdrhealth.exe, what is the purpose of this EXE? Is there any documentation which can be used for understanding its purpose. From the name it seems to be something to do with health checks up for the XDR services on the local system and report to cloud console but it would be beneficial to understand the purpose.

Thank you

[Rindsland]

We are seeing also a new Service with Name "Cortex XDR Health helper" which is set to Automatic but not started.

This causes Issues with our Monitoring. Not sure if this service runs only from time to time and what is the purpose of that Service.

(Even a restart of the Device, doesn't start the Service.)

Seems to be something new with Agent 7.7.0.

[MarvinC]

Following this thread. I am seeing this also when investigating the trapsd
logs.

[akash_chhetri]

Hi everyone,

The product team has published the public documentation for the XDR Health Service.

Please find the relevant links below:

1. https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-7/cortex-xdr-agent-release-notes/cortex-xdr-ag...

2. https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-7/cortex-xdr-agent-admin/cortex-xdr-agent-for-...

[Dominic-Erni]

Here are some additional infos about the behaviour of Cortex XDR Health Helper Service: Cortex XDR Health Helper service does not start after upgrade t... - Knowledge Base - Palo Alto Netw...

[SStrauch]

Does anyone know how to exclude this alert in the Windows Server Manager / Service Health Status?
It's really annoying that XDR Health Service is the only Service on our Servers that produces these "red flags"...

[Dominic-Erni]

Just found that. May help, didn't test/check Windows Server 2012 Server Manger Ignore Services? (microsoft.com)
If someone has a solution to set this with gpo would be apreciated.