01-28-2022 07:42 AM
I see this discussion has come up before here: (https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/manually-update-content-version/m-p/4406...
And I don't see yet an answer to FIX the problem or resources indicated as to what to look for as to WHY there is no Content Update on endpoints that reflect they are Status = Connected (sometimes for DAYS / Weeks at a time) yet they are not a current Content Update.
Also, why is there a row in the Agent Audit Logs, that is labeled as "REASON" yet it seems to not be populated?
Really do need to have some solution that would allow (even if manually done by dropping some file on an endpoint) and then run a command / script to execute it. (fyi @enewman @PeteJacobCF )
I would also note that we have some endpoints that don't show "FAILED" Content Updates. They seem to not even be TRYING to update themselves. What is going on here?
