XDR Agent Conenction Status : Connection Lost

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

XDR Agent Conenction Status : Connection Lost

L1 Bithead

Hello guys!

 

I was thinking about what happens to Cortex XDR agent showing connection status as Connection Lost . I know XDR agent who failed to communicate to Management console for past 30 days would go to connection lost.

 

My doubt is if XDR agent status found to be connection lost , still it will provide protection to endpoints? I know it wont get latest updates . So need a clarification on this point.

 

What action need to be taken against Cortex XDR agent showing connection lost status to bring them back to Connected status?

Do we need tor reinstall cortex xdr agent with latest version?

 

Please share the possible remediation Steps !

 

 

2 REPLIES 2

L5 Sessionator

Hello @Venkatesh_Konar ,

 

Event if Cortex XDR agent is showing connection lost, it will still provide the protection to the endpoint. However, it will not receive any Content Update or other update. Also, if any prevention activity happens on the machine you will not get alerts on the Server and incase if there are any FP detection, you will not be able to create exceptions due to lost connectivity. 

 

The action to retrieve the connections will be running Cytool connectivity_test command or check the connectivity using the network commands. Or involve the Support to investigate.

 

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution".

Ashutosh Patil

L3 Networker

You can also try to establish a forced connection between the agent and the server by using the below commands -

cytool reconnect force 

OR

cytool reconnect force (distribution ID)   - This distribution ID is specific to agent version and can be found in agent installations page

  • 839 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!