The Palo Alto Networks Broker is a secured virtual machine (VM), integrated with Cortex XDR, that bridges your network and Cortex XDR. By setting up the broker, you establish a secure connection in which you can route your endpoints, and collect and forward logs and files for analysis.
The Broker can be leveraged for running different services separately on the VM using the same Palo Alto Networks authentication. Once installed, the broker automatically receives updates and enhancements from Cortex XDR, providing you with new capabilities without having to install a new VM.
Per your Cortex XDR license, the following figure illustrates the different Broker VM features that could be available on your organization side.