Clear agent database - Learn how to clear the Cortex XDR agent database. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation
Product
Cortex XSIAM
Creation date
2025-07-15
Last date published
2026-06-04
Category
Administrator Guide
Abstract

Learn how to clear the Cortex XDR agent database.

If one or more Cortex XDR agents are having issues, you can attempt a reset by clearing the Cortex XDR agent state of one or more endpoints.

Note

Clearing the agent database is supported on all platforms with Cortex XDR agent version 7.9 or later, and is available only when using the debugging mode.

Clearing the agent database is available only when using the debugging mode, and can be tracked in the Action Center.

  1. Clear Agent Database.

    1. Navigate to Inventory → Endpoints → All Endpoints and select one or more endpoints for which you want to clear the database.

    2. In Windows, press ALT and right-click, or in macOS press Option and right-click, to open the context menu in debugging mode.

    3. Navigate to Endpoint Control → Clear Agent Database.

  2. Track progress of the Clear Database action.

    1. Navigate to Investigation & Response → Response → Action Center.

    2. In the All Actions table, filter the Action Type field according to Agent Database Cleanup.

      Note

      You can only right-click to cancel the clear agent database for actions with a pending status.