Who rated this post

susekar · ‎06-29-2026

Greetings for the day.

The issue you are describing, where endpoints show as "Connected" in the management console but "No connection to server" on the local agent UI while interactive tasks (Live Terminal, log collection, pausing protection) fail, typically stems from a breakdown in the secure WebSocket (WSS) communication channel or an internal agent Inter-Process Communication (IPC) failure.

Diagnostic Steps on Affected Endpoints:

Run the following commands from an elevated Command Prompt to isolate the failure point:

1. Verify Service Status:`cytool runtime query`

Ensure that cyserver and cyverak are in a Running state.

2. Test Network Connectivity: `cytool connectivity_test`

Review the output for any DNS errors, connection timeouts, or SSL errors.

3. Verify WebSocket Status: cytool websocket query

Confirm that the output shows: Connected: true

If it displays Connected: false or No websocket connection available, the agent is unable to receive real-time commands.

--------------------------

Recommended Remediation Actions

1. Whitelist Required URLs

Ensure that all regional Cortex XDR URLs, including wss:// (WebSocket) connections, are excluded from SSL/TLS decryption and Deep Packet Inspection (DPI) on your network security devices.

2. Force Agent Reconnection

If network connectivity is confirmed but the agent remains out of sync, force a reconnection using the tenant's Distribution ID: cytool reconnect force [DISTRIBUTION_ID]

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution"

Thanks & Regards,
S. Subashkar Sekar

Unlock your full community experience!