Open Remote Terminal
Perform commands remotely on your Cortex XDR Broker VM.
Cortex XDR allows you to remotely connect
to a broker VM directly from the Cortex XDR console.
- Navigate totable.Cortex XDR appSettingsBrokerVMs
- Locate the broker VM you want to connect to, right-click and selectOpen Remote Terminal.Cortex XDR opens a CLI window where you can perform the following commands:
- LogsBroker VM logs located are located in/data/logs/ folderand contain the applet name in file name. For example, folder/data/logs/[applet name], containingcontainer_ctrl_[applet name].log
- Ubuntu CommandsCortex XDR Broker VM supports all Ubuntu commands. For example,telnet 10.0.0.10 80 or ifconfig -a.
- Sudo CommandsCortex XDR requires you use the following values when running commands:Applet Names
- Agent Proxy—tms_proxy
- Syslog Collector—anubis
- WEC—wec
- Network Mapper—network_mapper
- Pathfinder—odysseus
Services- Upgrade-—zenith_upgrade
- Frontend service—webui
- Sync with Cortex XDR—cloud_sync
- Internal messaging service (RabbitMQ)-—rabbitmq-server
- Uploads metrics to the Cortex XDR—metrics_uploader
- Prometheus node exporter—node_exporter
- Backend service—backend
CommandDescriptionExampleapplets_restartRestarts one or more applets.>sudo applets_restart wecapplets_startStart one or more applets.>sudo applets_start wecapplets_statusCheck the status of one or more applets.> sudo applets_status wecapplets_stopStop one or more applets.> sudo applets_stop wecservices_restartRestarts one or more services. OS services are not supported.> sudo services_restart cloud_syncservices_startStart one or more services> sudo services_start cloud_syncservices_statusCheck the status of one or more services.> sudo services_status cloud_syncservices_stopStop one or more services.> sudo services_restart cloud_syncset_ui_password.shChanges password of the Broker VM Web UI.Run the command, enter the new password followed by Ctrl+D.> sudo set_ui_password.shtcpdumpLinux capture network traffic command.You must use-wflag in order to print output to file.> sudo tcpdump -i eth0 -w /tmp/packets.pcapkillLinux kill command.> sudo kill [some pid]routeModify your IP address routing./sbin/routeedit_routesUpdate static network routes.Can only run through a direct SSH connection.sudo edit_routesBroker VMs that were migrated from Pathfinder VM do not currently support this function.Executing this command will trigger an editor (VI), enter the parameters in a new line, save, exit, and restart the machine and broker VM.hostnamectlCheck and update the machine hostname on a Linux operating system.sudo hostnamectl set-hostname <new_host_name>Restart machine after running command.
Recommended For You
Recommended Videos
Recommended videos not found.