xdr agent download 22MB with each check-in

[Carracido]

Dear community,

I hope you all stay safe and doing great.

I noticed that per each 5-minutes check-in the cortex XDR agents they will get 22MB back from the cloud.

I think this is considerable amount of data if there´s no policy/content update to be sent from Cortex XDR cloud to the agents. 

This is happening for each agent and it´s impacting the network. 

Does anyone know if is expected to receive this amount of data from the Cortex cloud each check-in?  

Thank you in advance.

[BPry]

@Carracido,

By memory, that seems about right for the latest agents. If you go into your settings on your XDR instance, there is an option for content bandwidth management that you can enable and set a max allocation for, along with an auto upgrade schedule and agent amount that are customizable that can help you save bandwidth however if that's needed. 

I believe that this is the limit of managing bandwidth usage by the agents however. 

[Carracido]

@BPry Thank you for your answer.

Now the traffic got stable but the day EDR data collection was enabled there was a high increase in received traffic.

Do you know if it´s normal that the very first time that EDR data collection is enable this causes high bandwidth consumption to stabilize after some hours?

Thank you! 

[BPry]

@Carracido,

That's an important piece of the puzzle, but yes that's expected as your clients were doing the initial data upload with all of the additional EDR collection records. 
https://docs.paloaltonetworks.com/traps/tms/traps-management-service-admin/manage-endpoint-policy/tr...