XDR Agent Conenction Status : Connection Lost

[Venkatesh_Konar]

Hello guys!

I was thinking about what happens to Cortex XDR agent showing connection status as Connection Lost . I know XDR agent who failed to communicate to Management console for past 30 days would go to connection lost.

My doubt is if XDR agent status found to be connection lost , still it will provide protection to endpoints? I know it wont get latest updates . So need a clarification on this point.

What action need to be taken against Cortex XDR agent showing connection lost status to bring them back to Connected status?

Do we need tor reinstall cortex xdr agent with latest version?

Please share the possible remediation Steps !

[aspatil]

Hello @Venkatesh_Konar ,

Event if Cortex XDR agent is showing connection lost, it will still provide the protection to the endpoint. However, it will not receive any Content Update or other update. Also, if any prevention activity happens on the machine you will not get alerts on the Server and incase if there are any FP detection, you will not be able to create exceptions due to lost connectivity. 

The action to retrieve the connections will be running Cytool connectivity_test command or check the connectivity using the network commands. Or involve the Support to investigate.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution".

[Shahwaz_Md]

You can also try to establish a forced connection between the agent and the server by using the below commands -

cytool reconnect force 

OR

cytool reconnect force (distribution ID)   - This distribution ID is specific to agent version and can be found in agent installations page