XSIAM-ENGINEER: Palo Alto Networks Certified XSIAM Engineer

By Palo Alto Networks · Question Mode

QuestionQ21

VerifiedMaintenance and Troubleshooting

A Cortex XDR agent is installed on an endpoint, but it cannot download content updates and has not registered with the Cortex XSIAM server. While troubleshooting the network connection, an engineer determines that this endpoint is intentionally designed without direct internet access to the required network destinations for Cortex XDR agent traffic.

A reachable Broker VM has the Local Agent Settings applet enabled and Agent Proxy configured. The Broker VM details are:

  • FQDN: crtxbroker01.company.net
  • Proxy listening port: 8888

How should the engineer configure the Cortex XDR agent to use the existing Broker VM as a proxy for agent network traffic?

Explanation

Cytool configures the Cortex XDR agent proxy with the proxy set command and a quoted host:port proxy list. A Broker VM enabled for Agent Proxy can route agent traffic in restricted networks, allowing agents to obtain updates and communicate with Cortex XSIAM without direct internet access.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!