> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/6.1-eol/known-issues-in-traps-agent-6.1.md). # Known Issues in Traps Agent 6.1 | Issue ID | Description | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CPATR-10688 | When upgrading a 6.1.X Linux agent to a later release directly from the Cortex XDR management console, the upgrade fails and the agent halts. | | CPATR-10614 | The Traps agent does not create a post-detection event when it receives from WildFire a malware verdict for a macro file that had a previous non-malware verdict. | | CPA-7252 | Traps agents running 6.1 version should not upgrade to any macOS 10.15 version. If you do so, your Traps agent will stop communicating with the Traps management service and your endpoint will become unprotected. | | CPA-6993 | A Traps agent that was upgraded in the past cannot re-register to the Traps management service after the connection between them is lost due to corrupted cloud\_frontend.db.Workaround: Uninstall Traps and re-install it on the endpoint. | | CPA-6607 | When initiating a Live Terminal session on Windows endpoints, you cannot run GUI-based cmd commands like winver or appwiz.cpl. | | CPA-6542 | This issue is resolved in 6.1.1. See Addressed Issues in Traps Agent 6.1.1. For Behavioral Threat events on Mac endpoints, the Analysis tab of the security event displays the wrong year in the timeline. | | CPA-6505 | This issue is resolved in 6.1.0. See Addressed Issues in Traps Agent 6.1.0. On Linux endpoints, the Traps agent will not load the Linux kernel modules if it detected a system crash. The next time the agent uploads, the Anti-Malware flow will be in asynchronous mode and no data collection or Behavioral Threat Protection capabilities will be enabled. | | CPA-6464 | This issue is resolved in 6.1.3. See Addressed Issues in Traps Agent 6.1.3. When an unlicensed agent attempts to connect to Traps management service, its status in the Traps console appears as Connecting instead of Unlicensed. | | CPA-6357 | Traps blocks processes signed by blacklisted signers when you configure the Action mode for Examine Portable Executables and DLLs as Report in a Malware Security profile. | | CPA-6356 | When you configure Traps to quarantine malicious files, processes signed by blacklisted signers are not quarantined when they run on a Windows endpoint. | | CPA-6344, CPA-6866 | This issue is resolved in 6.1.1. See Addressed Issues in Traps Agent 6.1.1. Agents on Mac endpoints running Symantec cannot be updated to Traps 6.1. | | CPA-5970 | In some cases, when Traps management service fails to retrieve files from an endpoint, the process is still reported as successful instead of failed. The downloaded manifest file includes the error description. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/6.1-eol/known-issues-in-traps-agent-6.1.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.