xdr agent download 22MB with each check-in

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

xdr agent download 22MB with each check-in

L3 Networker

Dear community,


I hope you all stay safe and doing great.


I noticed that per each 5-minutes check-in the cortex XDR agents they will get 22MB back from the cloud.

I think this is considerable amount of data if there´s no policy/content update to be sent from Cortex XDR cloud to the agents. 

This is happening for each agent and it´s impacting the network. 


Does anyone know if is expected to receive this amount of data from the Cortex cloud each check-in?  


Thank you in advance.



Cyber Elite
Cyber Elite


By memory, that seems about right for the latest agents. If you go into your settings on your XDR instance, there is an option for content bandwidth management that you can enable and set a max allocation for, along with an auto upgrade schedule and agent amount that are customizable that can help you save bandwidth however if that's needed. 

I believe that this is the limit of managing bandwidth usage by the agents however. 

@BPry Thank you for your answer.


Now the traffic got stable but the day EDR data collection was enabled there was a high increase in received traffic.


Do you know if it´s normal that the very first time that EDR data collection is enable this causes high bandwidth consumption to stabilize after some hours?


Thank you! 


That's an important piece of the puzzle, but yes that's expected as your clients were doing the initial data upload with all of the additional EDR collection records. 

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!