About iscott

Hello, @Sabjul    This year I had the same issue in other Debian/Ubuntu servers. I opened a case with the TAC and after following this process, the services are ok.   - We have uninstall the XDR Agent. Follow the documentation in order to know which method to use. - Rebooted the machine and installed the XDR Agent using - apt-get install ./filename.deb https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-2/cortex-xdr-agent-admin/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-linux.html - Found services were stopped. (Again). - Started the services using Cytool runtime start all - Could see the agent is reported to the console and services are working.   Hope it helps.   Regards, ... View more

Hello,    I didn't see any deployment in where 2 agents are on the same server. You install one agent, and that agent can monitor up to 100 domain controllers. If you want redundancy, you can install another agent, but on a different server.   I hope it helps!   Regards, ... View more

Hello, @Lucaaslr    If you see an "Application" as "incomplete", it means that the 3-way handshake did not finish.   If you are using a rule-based on "app-id" verify the permission that it has. Above all, the "dns" and "web-browsing" apps. If you have URL Filtering, I recommend checking the URL Filtering logs for the source IP. In order to know if the URL was blocked. Perhaps, this is not the issue, because is cleartext. If the traffic is cleartext you will see a warning from the firewall in the browser. If you can give more details of the issue, it could help.   Hope it helps   Regards,   I ... View more

Hello, @OrkanAlibayli .   Can you check the following?: Obviously review the IP address, Gateway, and Mask. It is important to have the NTP and DNS configured. In order to resolve the DNS requests and sync with the time in the XDR console. Be aware of the token. If 24 hours have been passed, the token is invalid. If you are using a firewall, and it is too restricted, you have to allow URLs and ports from the following link, for the Broker VM IP Address (Required Resources by Region and Broker VM Resources): https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/set-up-endpoint-protection/enable-access-to-cortex-xdr/resources-required-to-enable-access-for-cortex-xdr.html#resources-required-to-enable-access-for-cortex-xdr   Sometimes the steps that I mentioned, do not allow successful communication with XDR Console if aren't configured properly. In my case, was the URLs.   Hope it helps.   Regards, ... View more