07-08-2026 11:02 AM
Our Cortex XSIAM agents connect to the XSIAM server exclusively via the Broker VM's local agent proxy settings applet, as direct outbound internet/server access is blocked for these endpoints. If we want our agents to auto-upgrade, do we absolutely have to enable and configure the 'Agent Installer and content caching' part of the applet on the Broker VM? Or can the agents just utilize the existing proxy connection to fetch the upgrade installer directly from the XSIAM cloud server on their own? We understand that passing the installer through the proxy without caching will consume more cloud-to-local bandwidth, but given our low endpoint count, we want to know if auto-upgrades are functionally supported this way. Additionally, what is the maximum recommended number of agents for this type of deployment?
07-08-2026 11:33 PM
Hi @bridgetlitt
The Agent Installer and Content Caching feature is not required for Cortex XSIAM agent auto-upgrades. Its primary purpose is to optimize bandwidth by caching agent installers and content updates on the Broker VM.
If only the Local Agent Proxy is configured, and the endpoints communicate with the Cortex XSIAM cloud exclusively through the Broker VM (with no direct Internet access), the agents can still automatically download and install upgrades through the proxy. In this scenario, the Broker VM simply forwards the traffic between the agents and the Cortex XSIAM cloud. The only trade-off is that each endpoint downloads the installer individually, which increases WAN bandwidth usage during upgrade deployments.
The Agent Installer and Content Caching feature is recommended for larger environments because it reduces bandwidth consumption and accelerates mass deployments, but it is not a functional requirement for automatic agent upgrades.
Regarding scalability, a Broker VM configured for Agent Proxy can support up to 50,000 agents on newer Broker VM deployments (or 28,000 agents on older deployments), while Agent Installer and Content Caching supports up to 10,000 agents per Broker VM when the required hardware specifications are met.
Therefore, for a smaller deployment with a limited number of endpoints, using only the Local Agent Proxy without enabling Agent Installer and Content Caching is a supported and practical deployment model.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
