About MarvinC

Hi bbarmanroy, Appreciate your help. In cases that hose firewall is not in use, we have tried BIOC yet it is not applying to restriction profile when we are including IP addresses as a criteria. ... View more

Hi @Shaveta ,   Hope this can help you!   https://docs.paloaltonetworks.com/traps/4-2/traps-endpoint-security-manager-admin/getting-started-with-rules/wildcards-and-variables-in-policy-rules/example-using-wildcards-and-variables-in-policy-rules ... View more

Hi Kavurisowmya, *Note: This is an individual contributor answer* 1. Do we have to install it on every endpoint (Ex: 10,000 servers) that has cortex xdr installed and should we do it separately for every endpoint? - You don't need to install it on every endpoint but to configure it to be used as a proxy or it depends on the agent configuration that you are using. - The configuration of brokerVM to be used as a content cache or agent proxy will depend on your infrastructure like WFH employees that don't use VPN can directly do the updates to Cortex XDR directly than using BVM. 2. Should we maintain it frequently for updates, maintenance so on or it does automatically? - The updates are defaultly set automatically. 3. What more benefits we can have apart from content updates using broker VM when installed on a endpoint? - Usage of bandwidth? Since you have your broker VM on your network, agents won't need to consume Internet access directly outside since you have BVM on your network. 4. Does it help in improving cortex XDR performance (ex: speed)? - Speed of getting the content updates, I think yes. Since you don't have to worry if an endpoint doesn't have Internet connection as long as the endpoint can reach the BVM. - with regards to the endpoint CPU performance, I don't think so. Hope this helps. ... View more

Following this thread. I am seeing this also when investigating the trapsd logs. ... View more