Restart agent

Restart Cortex XDR agents from Cortex XSIAM for endpoint troubleshooting.

You can restart an agent from the Cortex XSIAM tenant.

This action is hidden by default.

As soon as the action is confirmed, the restart command triggers a restart of the agent on the endpoint.

1

From Cortex XSIAM, navigate to Inventory → Endpoints → All Endpoints. Select the relevant endpoint to restart and right-click + Alt, select Endpoint Control → Restart Agent, and click OK.

2

Select I agree, and then click OK to confirm restarting the agent on all selected endpoints.