Cortex XDR, you can delete a Cortex XDR agent from one or more Windows,
Mac, or Linux endpoints that have disconnected from the Cortex XDR
management console. Deleting an endpoint triggers the following
Standard agents are deleted after
180 days of inactivity.
VDI and TS agents are deleted after 6 hours of inactivity.
reinstate an endpoint, you have to uninstall and reinstall the endpoint.
an endpoint is deleted, data associated with the deleted endpoint
is displayed in the Action Center tables and in the Causality View
N/A (Endpoint Deleted)
Alerts that already include the endpoint data at the time of the
alert creation are not affected.
The following workflow describes
how to delete the Cortex XDR agent from one or more Windows, Mac,
or Linux endpoints.
Right-click the endpoint you want to remove.
You can also select multiple endpoints if you want to perform
a bulk delete.