Open Remote Terminal
Perform commands remotely on your Cortex XDR Broker VM.
Cortex XDR allows you to remotely connect to a broker VM directly from the Cortex XDR console.
- In Cortex XDR, selecttable.Settings ( )ConfigurationsBroker VMBroker VMs
- Locate the broker VM you want to connect to, right-click and selectOpen Remote Terminal.Cortex XDR opens a CLI window where you can perform the following commands:
- LogsBroker VM logs located are located in/data/logs/ folderand contain the applet name in file name. For example, folder/data/logs/[applet name], containingcontainer_ctrl_[applet name].log
- Ubuntu CommandsCortex XDR Broker VM supports all Ubuntu commands. For example,telnet 10.0.0.10 80 or ifconfig -a.
- Sudo CommandsBroker VM supports the command listed in the following table. All the commands are located in the/home/admin/sbinfolder.Cortex XDR requires you use the following values when running commands:Applet Names
- Agent Proxy—tms_proxy
- Syslog Collector—anubis
- Network Mapper—network_mapper
The following table displays the available commands in alphabetical order.CommandDescriptionExampleapplets_restartRestarts one or more applets.> sudo applets_restart wecapplets_startStart one or more applets.>sudo applets_start wecapplets_statusCheck the status of one or more applets.> sudo applets_status wecapplets_stopStop one or more applets.> sudo applets_stop wechostnamectlCheck and update the machine hostname on a Linux operating system.> sudo hostnamectl set-hostname <new_host_name>Restart machine after running command.killLinux kill command.> sudo kill [some pid]restart_routesInvoke a restart of the routing service after updating your static network route configuration file,vi /etc/network/routes.Editing the file triggers an editor (VI). Enter the parameters in a new line, save, exit, and execute therestart_routescommand to apply the updates.> sudo restart_routesForrestart_routesto take affect, restart the machine and broker VM.routeModify your IP address routing./sbin/routeservices_restartRestarts one or more services. OS services are not supported.> sudo services_restart cloud_syncservices_startStart one or more services> sudo services_start cloud_syncservices_statusCheck the status of one or more services.> sudo services_status cloud_syncservices_stopStop one or more services.> sudo services_restart cloud_syncset_ui_password.shChanges password of the Broker VM Web UI.Run the command, enter the new password followed by Ctrl+D.> sudo set_ui_password.shsquid_tailDisplay the Proxy applet Squid log file in real-time.sudo squid_tailtcpdumpLinux capture network traffic command.You must use-wflag in order to print output to file.> sudo tcpdump -i eth0 -w /tmp/packets.pcap
- Frontend service—webui
- Sync with Cortex XDR—cloud_sync
- Internal messaging service (RabbitMQ)—rabbitmq-server
- Uploads metrics to the Cortex XDR—metrics_uploader
- Prometheus node exporter—node_exporter
- Backend service—backend
Recommended For You
Recommended videos not found.