06-28-2023 08:31 AM
Hi @kentwuhc ,
Thank you for writing to live community!
First of all, we would appreciate if you would be okay to remove the data logs attached to the query as this is a public forum and it would expose the configuration information.
In cases when network isolation is performed the broker vm will not be able to send the data to the cloud. The broker VM and cortex xdr in totality are meant to be cloud solutions and there would be no ways to bypass network to start the services or applets.The local agent settings applet still stays up and running but because we do not have network connectivity, the agent is not able to send the data to the cloud and also, the proxy fails. The broker vm is a transparent app specific proxy and if the agents fail to send data to the xdr cloud only. The broker vm local agent settings applet does not cache the EDR data from the agents, rather it is the agents itself who cache the EDR data and other relevant data upto a specific threshold in the local disk and when the connectivity is restored, they connect to the cloud and all the data is uploaded.
Hope this clarifies it
