Cortex Connection Lost

[Yayati]

Hello everyone,

I'm currently conducting a survey on the various possibilities that could lead to the "Connection Lost" issue in the environment. I encourage all of you to participate in this survey. Additionally, I have a question: In the event that an endpoint loses connection and is subsequently removed from the Cortex Administrator console, will the endpoint agent automatically re-register with the Cortex console once it's live again, or will reinstallation be required in this scenario?

[BPry]

@Yayati,

Depends highly on why it isn't communicating. If the endpoint simply isn't getting used and it comes back online before it's deleted then things will recover perfectly fine. If the endpoint isn't used for an extended period and it actually gets deleted, you need to fully reinstall the agent to get things functional again. Lastly, in the event that an agent breaks during an upgrade you'll also need to reinstall the agent to get it functional and protected.

This is one area where Cortex XDR still lags behind competitors quite a bit in my personal opinion. I've never setup an environment where we didn't also need to proactively hunt down agents that weren't communicating and recover them on a regular basis.

I'm not saying we don't encounter issues with every single vendor and every single agent, but it's usually few and far between that it takes actual human intervention. XDR on the other hand required weekly manual intervention to recover agents even in relatively small ~1000 agent environments.