The key phrase here is 'existing, previously onboarded endpoints continue to communicate successfully' while 'newly installed' endpoints fail with a certificate validation error after a 'tenant was recently updated'. This strongly suggests a certificate mismatch related to the tenant's update. When a Cortex XSIAM tenant is updated, it's possible that the certificates used for agent onboarding and communication are also updated. Existing agents might have already trusted the previous certificate chain, while new agents, encountering the new certificates, fail validation if their trust store isn't updated or if there's a misconfiguration in how the new certificate is presented. The XSIAM Engine itself might also need to explicitly trust the new tenant certificates. Option A is a possibility, but less likely to affect only new agents. Option C would affect all agents, not just new ones. Option D would manifest as other errors (e.g., storage full). Option E is less likely, as protocol versions are generally backward- compatible or explicitly announced as breaking changes, and the error specifically mentions certificate validation, not protocol. Therefore, certificate chain updates related to the tenant upgrade are the most plausible cause.