Add agents to a fleet - Cortex XCOR Documentation

This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone product separate from Palo Alto Networks Cortex XCOR.

This feature isn’t available to all Palo Alto Networks Telemetry Pipeline users. For more information, contact Cortex XCOR Support.

After you’ve created a fleet, you can add supported telemetry agents to that fleet.

When an agent joins a fleet, that agent’s standalone configuration file is replaced by the configuration file that governs the entire fleet. Any settings previously configured in the standalone configuration file but not in the fleet-level configuration file will be permanently overwritten.Certain settings in an agent’s standalone configuration file are necessary part of the agent creation process, and can later be overwritten by fleet-level settings without issue. However, any text in the original standalone configuration file is lost forever, so be sure to save critical key-value information in a separate location, or update the fleet-level configuration file accordingly.

Add a Fluent Bit agent

Requires Fluent Bit v2.1.8 or later.

To add a Fluent Bit agent to a fleet:

YAML configuration
Classic configuration

YAML configuration is only supported in Palo Alto Networks Telemetry Pipeline v2.25.0 or later, and requires Fluent Bit v3.2 or later. Additionally, to use YAML configuration files for individual agents in a fleet, the fleet_config_legacy_format parameter in that fleet’s configuration file must be set to false.

If necessary, install a new Fluent Bit agent.
Update the customs section in the configuration file for that agent.
customs: - name: calyptia calyptia_host: HOST api_key: 'KEY' fleet_name: 'NAME' fleet.interval_sec: SECONDS fleet.interval_nsec: NANOSECONDS fleet_config_legacy_format: false
Replace the following values:
- HOST: Your Cortex XCOR hostname. If you don’t know your hostname, ask a Palo Alto Networks representative for this value.
- KEY: The API token you use to authenticate with Palo Alto Networks Telemetry Pipeline.
- NAME: The name of the fleet to which your agent will be added.
- SECONDS: How often, in seconds, this agent should check for configuration updates. If unspecified, defaults to 15.
- NANOSECONDS: How often, in nanoseconds, this agent should check for configuration updates. If unspecified, defaults to 0.
Run the following command:
fluent-bit -c CONFIG
Replace CONFIG with the name of the configuration file you updated in the previous step.

If necessary, install a new Fluent Bit agent.
Update the [CUSTOM] section in the configuration file for that agent.
[CUSTOM] Name calyptia Calyptia_Host HOST API_Key KEY Fleet_Name NAME fleet.interval_sec SECONDS fleet.interval_nsec NANOSECONDS
Replace the following values:
- HOST: Your Cortex XCOR hostname. If you don’t know your hostname, ask a Palo Alto Networks representative for this value.
- KEY: The API token you use to authenticate with Palo Alto Networks Telemetry Pipeline.
- NAME: The name of the fleet to which your agent will be added.
- SECONDS: How often, in seconds, this agent should check for configuration updates. If unspecified, defaults to 15.
- NANOSECONDS: How often, in nanoseconds, this agent should check for configuration updates. If unspecified, defaults to 0.
Run the following command:
fluent-bit -c CONFIG
Replace CONFIG with the name of the configuration file you updated in the previous step.

Add a Core Agent

Requires Core Agent v23.4.5 or later.

To add an instance of Core Agent to a fleet:

YAML configuration
Classic configuration

YAML configuration is only supported in Palo Alto Networks Telemetry Pipeline v2.25.0 or later, and requires Core Agent v25.1.1 or later. Additionally, to use YAML configuration files for individual agents in a fleet, the fleet_config_legacy_format parameter in that fleet’s configuration file must be set to false.

If necessary, install a new instance of Core Agent.
Update the customs section in the configuration file for that agent.
customs: - name: calyptia calyptia_host: HOST api_key: 'KEY' fleet_name: 'NAME' fleet.interval_sec: SECONDS fleet.interval_nsec: NANOSECONDS fleet_config_legacy_format: false
Replace the following values:
- HOST: Your Cortex XCOR hostname. If you don’t know your hostname, ask a Palo Alto Networks representative for this value.
- KEY: The API token you use to authenticate with Palo Alto Networks Telemetry Pipeline.
- NAME: The name of the fleet to which your agent will be added.
- SECONDS: How often, in seconds, this agent should check for configuration updates. If unspecified, defaults to 15.
- NANOSECONDS: How often, in nanoseconds, this agent should check for configuration updates. If unspecified, defaults to 0.
Run the following command:
calyptia-fluent-bit -c CONFIG
Replace CONFIG with the name of the configuration file you updated in the previous step.

If necessary, install a new instance of Core Agent.
Update the [CUSTOM] section in the configuration file for that agent.
[CUSTOM] Name calyptia Calyptia_Host HOST API_Key KEY Fleet_Name NAME fleet.interval_sec SECONDS fleet.interval_nsec NANOSECONDS
Replace the following values:
- HOST: Your Cortex XCOR hostname. If you don’t know your hostname, ask a Palo Alto Networks representative for this value.
- KEY: The API token you use to authenticate with Palo Alto Networks Telemetry Pipeline.
- NAME: The name of the fleet to which your agent will be added.
- SECONDS: How often, in seconds, this agent should check for configuration updates. If unspecified, defaults to 15.
- NANOSECONDS: How often, in nanoseconds, this agent should check for configuration updates. If unspecified, defaults to 0.
Run the following command:
calyptia-fluent-bit -c CONFIG
Replace CONFIG with the name of the configuration file you updated in the previous step.

​Add a Fluent Bit agent

​Add a Core Agent

Add a Fluent Bit agent

Add a Core Agent