To reduce the bandwidth costs associated with thousands of endpoints downloading updates directly from the Palo Alto Networks cloud (Cortex XDR tenant), you need to localize the distribution of files. Both selected techniques achieve this effectively:
Cortex XDR supports Peer-to-Peer (P2P) distribution for agent upgrades and content updates.
When enabled, endpoints on the same local subnet share downloaded files with each other.
Instead of 1,000 remote or office machines downloading a 100MB update from the internet, only a few download it from the cloud, and the rest pull it locally over the LAN/wlan, dramatically slashing external bandwidth costs.
By deploying an on-premise Broker VM and enabling its caching capabilities, it acts as a local proxy server for Cortex XDR. The Broker VM downloads the content updates and agent installers once from the cloud, and all local endpoints point to the Broker VM to pull their updates, keeping internet bandwidth consumption to an absolute minimum.