> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/changes-to-default-behavior.md). # Changes to Default Behavior ### Changes to Default Behavior in Traps 6.1.9 There are no changes to default behavior in Traps 6.1.9. ### Changes to Default Behavior in Traps 6.1.8 There are no changes to default behavior in Traps 6.1.8. ### Changes to Default Behavior in Traps 6.1.7 There are no changes to default behavior in Traps 6.1.7. ### Changes to Default Behavior in Traps 6.1.6 | Feature | Change to Behavior | | ------------------------ | --------------------------------------------------------------------------------------- | | Agentfor Cortex XDR Only | Starting with the Traps agent 6.1.6 release, the agent is supported by Cortex XDR only. | ### Changes to Default Behavior in Traps 6.1.5 | Feature | Change to Behavior | | -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Random Selection of App-specific Proxy | If your agents communicate with the Cortex XDR server through app-specific proxies, now the proxy server for each communication is selected from the list of proxies randomly with equal probability, rather than according to their order of definition. | ### Changes to Default Behavior in Traps 6.1.4 | Feature | Change to Behavior | | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | AgentInstallation for Citrix App Layering | Due to a Citrix App Layering limitation, you must install the Traps agent on the OS layer according to this flow to enable the Traps agent provide full protection to your endpoints: 1. Install the Traps agent on OS layer during App Layering image preparation process, as a Terminal session, VDI or Standard installation. Traps agent installations on the Application layer or User layer are notsupported. 2. Before you finalize the OS layer, stop the Traps agent with the Cytool runtime stop command. 3. Delete the c:\ProgramData\Cyvera\LocalSystem\Download\content folder. 4. Delete the c:\ProgramData\Cyvera\LocalSystem\Persistence\cloud\_frontend\_db folder. 5. Add the following entry to the Registry: HKLM\SYSTEM\CurrentControlSet\Services\Unirsd\ExcludeKey \[REG\_SZ] = "\Registry\Machine\System\Cyvera" 6. Do not boot up the OS layer before it is finalized. | ### Changes to Default Behavior in Traps 6.1.3 There are no changes to default behavior in Traps 6.1.3. ### Changes to Default Behavior in Traps 6.1.2 There are no changes to default behavior in Traps 6.1.2. ### Changes to Default Behavior in Traps 6.1.1 There are no changes to default behavior in Traps 6.1.1. ### Changes to Default Behavior in Traps 6.1.0 | Feature | Change to Behavior | | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Immediate Response Actions Over Web Socket | Now when you perform the following response actions in the Traps management service or Cortex XDR for Traps agent 6.1 and later releases, they will be executed immediately on the endpoint through a web socket that is maintained between the sever and the Traps agent: • Quarantine file and restore file • Terminate process • Isolate endpoint and cancel endpoint isolation • Initiate Live Terminal • Set endpoint proxy disable endpoint proxy • Retrieve endpoint files • Retrieve security event data • Retrieve support file The actions that can be performed via web socket are only actionsthat your current agent version already supports. If the web socket communication fails, the action will be executed on the next successful Cortex XDR agent heartbeat. You can use Cytool to display the current websocket connection status by running the websocket command on the endpoint. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/changes-to-default-behavior.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.