Delete Cortex XDR Agents

From Cortex XDR, you can delete a Cortex XDR agent from one or more Windows, Mac, or Linux endpoints that have disconnected from the Cortex XDR management console. Deleting an endpoint triggers the following lifespan flow:
  • Standard agents are deleted after 180 days of inactivity.
  • VDI and TS agents are deleted after 6 hours of inactivity.
To reinstate an endpoint, you have to uninstall and reinstall the endpoint.
After an endpoint is deleted, data associated with the deleted endpoint is displayed in the Action Center tables and in the Causality View with am
Endpoint Name
-
N/A (Endpoint Deleted)
. Alerts that already include the endpoint data at the time of the alert creation are not affected.
The following workflow describes how to delete the Cortex XDR agent from one or more Windows, Mac, or Linux endpoints.
  1. Select
    Endpoints
    Endpoint Management
    Endpoint Administration
    .
  2. Right-click the endpoint you want to remove.
    You can also select multiple endpoints if you want to perform a bulk delete.
  3. Select
    Endpoint Control
    Delete Endpoint
    .

Recommended For You