View Broker VM Details - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide
Product
Cortex XDR
License
Pro
Creation date
2023-03-22
Last date published
2023-09-21
Category
Administrator Guide

In Cortex XDR , select Settings → Configurations → Data Broker → Broker VMs to view detailed information regarding your registered Broker VMs in the Brokers tab.

The Broker VMs table enables you to monitor and mange your Broker VM and applet connectivity status, version management, device details, and usage metrics.

The following table describes both the default fields and additional optional fields that you can add to the Brokers table using the column manager and lists the fields in alphabetical order.

Note

Certain fields are also exposed in the Clusters tab, when a Broker VM node is added to a High Availability (HA) cluster, and each cluster node is expanded to view the Broker VM nodes table. An asterisk (*) is beside every field that is also included in the Broker VM nodes table for each HA cluster.

Field

Description

Status Indicator (

alert-status.png

)*

Identifies in the following columns:

  • DEVICE NAME—Whether the Broker machine is registered and connected to Cortex XDR.

  • VERSION—Whether the Broker VM is running the latest version.

  • APPS—Whether the available applications are connected to Cortex XDR.

Colors depict the following statuses:

  • Black—Disconnected to Cortex XDR

  • Red - Disconnected from Cortex XDR

  • Orange—Past Version

  • Green—Connected, Current Version

check-box.png

Check box to select one or more Broker devices on which to perform actions.

ALL interfaces

All IP addresses of the different interfaces on the device.

APPS*

List of active or inactive applets and the connectivity status for each.

CLUSTER NAME*

Indicates the name of the HA cluster that the Broker VM has been added to. For a standalone Broker VM, which isn't added to any HA cluster, this field is empty.

CPU USAGE*

CPU usage of the Broker device in percentage synced every 5 minutes.

CONFIGURATION STATUS*

Broker VM configuration status. Status is defined by the following according to changes made to any of the Broker VM configurations.

  • up to date—Broker VM configuration changes made through the Cortex XDR console have been applied.

    in progress—Broker VM configuration changes made through the Cortex XDR console are being applied.

    submitted—Broker VM configuration changes made through the Cortex XDR console have reached the Broker VM and awaiting implementation.

    failed—Broker VM configuration changes made through the Cortex XDR console have failed. Need to open a Palo Alto Networks support ticket.

DEVICE ID

Device ID allocated to the Broker VM by Cortex XDR after registration.

DEVICE NAME*

Same as the Device ID.

A expired-broker.pngicon notifies of an expired Broker VM. To reconnect, generate a new token and re-register your Broker VM as described in steps 1 through 7 of Configure the Broker VM. Once registered, all previous Broker VM configurations are reinstated.

DISK USAGE*

Disk usage of the Broker VM in portion of computer storage that is currently in use.

Notification about low disk space appear in the Notification Center.

EXTERNAL INTERFACE

The IP interface the Broker VM is using to communicate with the server.

For AWS and Azure cloud environments, the field displays the Internal IP value.

LAST SEEN

Indicates when the Broker VM was last seen on the network.

MEMORY USAGE*

Memory usage of the Broker VM in percentage synced every 5 minutes.

STATUS*

Connection status of the Broker VM. Status is defined by either Connected or Disconnected.

Disconnected Broker VMs do not display CPU Usage, Memory Usage, and Disk Usage information.

Notifications about the Broker VM losing connectivity to Cortex XDR appear in the Notification Center.

UPGRADE TIME

Timestamp of when the Broker VM was upgraded.

VERSION*

Version number of the Broker VM. If the status indicator is not green, then the Broker VM is not running the latest version.

Notifications about the available new Broker VM version appear in the Notification Center.