Activate the Local Agent Settings - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide

Product
Cortex XDR
License
Pro
Creation date
2024-07-16
Last date published
2024-12-02
Category
Administrator Guide
Retire_Doc
Retiring
Link_to_new_Doc
/r/Cortex-XDR/Cortex-XDR-Documentation
Abstract

Learn more about activating a Local Agent Settings applet on a Broker VM.

The Local Agent Settings applet on the Palo Alto Networks Broker VM enables you to:

Before you activate the Local Agent Settings applet, verify the following prerequisites and limitations listed by the main features.

After you configure and register your Palo Alto Networks Broker VM, proceed to set up your Local Agent Settings applet.

  1. Select SettingsConfigurationsData BrokerBroker VMs.

  2. In either the Brokers tab or the Clusters tab, locate your Broker VM.

  3. (Optional) To set up the Agent Proxy:

    1. Right-click the Broker VM, select Configure.

      Ensure your proxy server is configured. If not, proceed to add it as described in Configure the Broker VM.

    2. You can either right-click the Broker VM and select Add AppLocal Agent Settings, or in the APPS column, left-click AddLocal Agent Settings.

    3. In the Activate Local Agent configuration, enable Agent Proxy by setting the Proxy to Enabled, and specify the Port. You can also configure the Listening Interface, where the default is set to All.

      Note

      When you install your XDR agents, you must configure the IP address of the Broker VM and a port number during the installation. You can use the default 8888 port or set a custom port. You are not permitted to configure port numbers between 0-1024 and 63000-65000, or port numbers 4369, 5671, 5672, 5986, 6379, 8000, 9100, 15672, 25672. Additionally, you are not permitted to reuse port numbers you already assigned to the Syslog Collector applet.

  4. (Optional) To setup up Agent Installer and Content Caching:

    1. Ensure you uploaded your SHA256-based certificates.

      If not, upload them as described in Configure the Broker VM and Save.

    2. Specify the Broker VM FQDN.

      Right-click the Broker VM, select Configure. Under Device Name, enter your Broker VM FQDN. This FQDN record must be configured in your local DNS server.

      Important

      A FQDN must be configured for WEC and Agent Installer and Content Caching to function properly.

    3. Activate the Local Agent Settings applet on the Broker VM.

      You can either right-click the Broker VM and select Add AppLocal Agent Settings, or in the APPS column, select AddLocal Agent Settings.

    4. Activate installer and content caching.

      In the Activate Local Agent configuration, enable Agent Installer and Content Caching by setting Caching to Enabled.

      Important

      You can only enable Agent Installer and Content Caching, when in the Broker VM Configuration, you've uploaded your signed SSL Server Certificate and key and set the FQDN. For more information, see the Agent Installer and Content Caching requirements explained above.

    5. To enable agents to start using Broker VM caching, you must add the Broker VM as a download source in your Agent Settings profile and select which Broker VMs to use, as described in Add a New Agent Settings Profile. Then, ensure the profile is associated with a policy for your target agents.

  5. After a successful activation, the APPS field displays Local Agent Settings with a green dot indicating a successful connection. Left-click the Local Agent Settings connection to view the applet status and resource usage.

    To help you easily troubleshoot connectivity issues for a Local Agent Settings applet on the Palo Alto Networks Broker VM, Cortex XDR displays a list of Denied URLs. These URLs are displayed when you left-click the Local Agent Settings applet to view the Connectivity Status. As a result, in a situation where the Local Agent Settings applet is reported as activated with a failed connection, you can easily determine the URLs that need to be allowed in your network environment.

  6. Manage the local agent settings. After the local agent settings have been activated, left-click the Local Agent Settings connection in the APPS column to display the settings, and select:

    • Configure to change your settings.

    • Deactivate to disable the local agent settings altogether.