> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/7.x/7.0-eol/cortex-xdr-agent-known-issues.md). # Cortex XDR Agent Known Issues In this version, Traps management service functionality has been integrated into the Cortex XDR app. As a result, the new agent is a Cortex-supported agent, and issues relating to Traps and the Traps management service directly are no longer applicable. The following table includes known issues in Cortex XDR agent 7.0 | Issue ID | Description | | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

CPATR-10688

This issue is resolved in Cortex XDR agent 7.0.4 release.

| When upgrading a 7.0.X Linux agent to a later release directly from the Cortex XDR management console, the upgrade fails and the agent halts. | | CPATR-10614 | The Cortex XDR agent does not create a post-detection event when it receives from WildFire a malware verdict for a macro file that had a previous non-malware verdict. | | CPATR-9265 | When the operating system on the endpoint is set to Advertise mode, you cannot install or upgrade a Cortex XDR agent 7.0.X or earlier releases using msiexec. | | CPATR-9609 | When the Cortex XDR agent performs a policy update on a Windows endpoint, the endpoint can freeze for a few seconds and you might not be able to open applications or menus until the update is completed. | | CPATR-9493 |

If you uninstall a Cortex XDR agent 7.0.1 running on a macOS 10.15.4 endpoint through the Cortex XDR management console when the user is not logged in on the endpoint or did not enter the user credentials as requested by the operating system, the uninstall process will be reported as completed successfully however the agent will leave software leftovers on the endpoint. As a workaround to address this issue, you can:

• Uninstall the agent directly from the endpoint, or upgrade to Cortex XDR 7.1 and uninstall the agent from the Cortex XDR server management.

• If you already uninstalled the agent from the management server and still want to clean the leftover files on the endpoint, you must re-install the same agent version that was installed before and then uninstall it directly from the endpoint.

| |

CPATR-8064

This issue is resolved in Cortex XDR agent 7.0.1 release.

| When a new VDI session starts, it may take up to 10 minutes for the Cortex XDR agent to protect the endpoint. | | CPATR-7825 | The Cortex XDR tray icon displays on a Windows endpoint even though the Agent Settings profile is set to hide the icon. | |

CPATR-7798

This issue is resolved in Cortex XDR agent 7.0.1 release.

| You cannot restore a quarantined file to a custom location using Cytool on a Mac endpoint running macOS 10.15. | | CPATR-7768 | If a previous version of Traps was previously installed on a Windows endpoint, the Traps icon saved in Windows cache might display in the new Cortex XDR agent console when alerting the user that access to the agent console has been disabled by policy. | | CPATR-7365 | After you whitelist an external USB-connected device, you have to unplug and plug it back to your machine for the whitelisting to take effect. If it is an integral device, you have to restart your machine for the whitelisting to take effect. | | CPATR-7317 | After you run a bash command on Mac or Linux agents using the Live Shell console, the command is printed again as a response. | | CPATR-6000 |

To enable the Cortex XDR agent 7.0.2 release to work in synchronous mode on Linux endpoints running kernels RHEL, or CentOS, or Oracle 8, you must disable UEFI Secure Boot on the machine. Otherwise, the Cortex XDR agent will operate in asynchronous mode: the agent will obtain a verdict for the executed ELF file in parallel to its execution and terminate it if a malware verdict is obtained. In addition, data collection for EDR and behavioral threat protection will not be supported.

To disable UEFI Secure Boot, enter the Advanced Boot Menu on your Linux machine and go to Troubleshoot > Advanced Options: UEFI Firmware Settings. Set the option to disable, save your changes and exit the menu. Your system will reboot, and the Cortex XDR agent will provide all its protections on the endpoint.

For full compatibility information, see the Compatibility Matrix.

| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/7.x/7.0-eol/cortex-xdr-agent-known-issues.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.