When a newly installed agent is not reporting telemetry to Cortex XSIAM, which two steps should you check first? (Choose two)

Question

Options

• AAgent connectivity to Cortex gateways
• BAssigned user permission groups
• CBroker VM version compatibility
• DAgent certificate status

• A
  76% (41)
• B
  9% (5)
• C
  15% (8)

Explanation

When a newly installed agent fails to report telemetry, the two most fundamental checks are connectivity and trust. Agent connectivity to Cortex gateways (A) ensures the agent can actually reach the XSIAM platform - without a valid network path, no data can be transmitted regardless of configuration. Agent certificate status (D) is equally critical because Cortex XSIAM uses mutual TLS authentication; if the agent's certificate is invalid, expired, or not yet enrolled, the platform will reject its connections and telemetry will never arrive.

Why the distractors are wrong:

• (B) Assigned user permission groups - permissions govern what human users can see and do in the console, not whether an agent can send telemetry; this is irrelevant to agent reporting.
• (C) Broker VM version compatibility - Broker VMs facilitate specific integrations (like syslog sources or identity collectors), but a standard endpoint agent reports directly to the Cortex gateway, so Broker VM versioning is not a first-step troubleshooting target here.

Memory tip: Think "Can it reach? Can it trust?" - Connectivity (A) = can the agent reach the gateway, Certificate (D) = does the gateway trust the agent. These are the two handshake prerequisites before any telemetry flows.

No community discussion yet for this question.