About BocoIP

It appears I forgot to update the thread with my findings, so here's the same message I recently sent to someone who had the same issue:   Yes, we did manage to solve this. The problem seemed to be that we had updates happening in the wrong layer. We had Cortex installed in the OS layer, as per the instructions, but it had then auto-updated itself in another App layer, which then broke the installation, as we now had Cortex installed in two different layers.   If you're having similar problems, try isolating the installation so that you only have Cortex installed in the OS layer, and then remove all traces of Cortex from the App layer(s). I think I actually reinstalled my App layers from scratch just to get rid of Cortex (as conventional uninstall did not work, as it was installed in two layers). You could probably also uninstall Cortex from the OS layer in a new version, use that version for the App layer, and then uninstall Cortex from the App layer (as it will then be the only version in use), and then scrap the OS version and use the one with Cortex still installed, with the newest App layer version which now doesn't have its "own" Cortex.   To keep this from happening in the future, we have now created a policy in XDR Dashboard to not update the App layers, by creating a dynamic group including "Endpoint Name   Contains CITRXAL" and "Endpoint Name   !=*198000", which effectively picks up all App layers which are not the OS layer (198000). Your numbers might vary, I'm not sure if these are set or dynamic.   I hope this will help you get back on track with this. If you have any other questions, I'm happy to help if I can. ... View more