> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/7.x/7.4-eol/cortex-xdr-agent-known-issues.md). # Cortex XDR Agent Known Issues The following table describes known issues in the Cortex XDR agent 7.4.X releases. ### Feature #### CPATR-14822 *This issue is resolved in Cortex XDR agent 7.5.1 release.* #### Description Scan on-demand continues to run when the endpoint is not connected. ### Feature #### CPATR-14741 *This issue is resolved in Cortex XDR agent 7.5.1 release.* #### Description When you install the agent on MacOS, a race occurs hat could cause the Cortex XDR agent to become disabled. ### Feature #### CTNGTR-4906 *This issue is resolved with content update 192 and later* #### Description The 7.4.1 agent can sometimes cause an infinite loop in a kernel driver. ### Feature #### CPATR-13725 (Linux) #### Description When you attempt to upgrade a Cortex XDR agent 7.2.0 to a later release from the Cortex XDR management console using an rpm installer, the upgrade action remains stuck In Progress and the agent upgrade fails due to a GPG signature check. Manual workaround: Disable the GPG signature check for the Cortex XDR agent installer by adding the `--nogpgcheck` parameter to the yum installation command line. ### Feature #### CPATR-13673 (Mac, Cortex XDR agent 7.1.2 and later running macOS 11.3) #### Description Following the changes Apple introduced in macOS 11.3 for MDMs, when you remove an MDM configuration profile that includes permissions for system extensions (for Cortex XDR agents or Global Protect), the system extensions will be instantly unloaded from all endpoints. As a result, the Cortex XDR protection status will be disabled. Suggested workaround: Restart the extensions or restart the Cortex XDR agent. When you make configuration changes that require you to remove an installed configuration profile, ensure that you remove the existing profile before you install the new profile. Otherwise, the new profile might not take effect on the endpoint even though it is installed. After you deploy the new MDM configuration profile, you must restart either the endpoint or the Cortex XDR agent in one of the following methods: * To reload the extensions, execute ``` ./cytool runtime start networkextension ./cytool runtime start securityextension ``` (Cortex XDR agent uninstall password is not required) * To restart the Cortex XDR agent, execute ``` ./cytool runtime stop all ./cytool runtime start all ``` (Cortex XDR agent uninstall password is required) Additionally, you can use your MDM to run these scripts on endpoints where the Cortex XDR agent was disabled as a result of this issue. Refer to the Cortex XDR Agent Administrator’s Guide on installation via MDM for more information. ### Feature #### CPATR-13678 (Mac) *This issue is resolved with content update 183-59522 and later* #### Description The following functionalities are not supported on new Apple Silicon (M1) Mac endpoints without Rosetta 2, running Cortex XDR agents 7.4: * Live Terminal * Script Execution * Host Insights Suggested workaround: Install Rosetta 2. Rosetta 2 is not pre-installed on new Apple Silicon (M1) Mac endpoints running macOS 11.X. Proceed to install it in one of the following methods: * Manual installation by the end user—Before you install the Cortex XDR agent on the endpoint, the end user must open the terminal and run one of the following commands: * `/usr/sbin/softwareupdate --install-rosetta` (root permission is not required) * `/usr/sbin/softwareupdate --install-rosetta --agree-to-license` (root permission is required) * Installation via MDM—Refer to the Cortex XDR agent Administrator’s Guide to learn how to execute these scripts on the endpoint using an MDM. ### Feature #### CPATR-12289 (Mac) #### Description On Apple Silicon (M1) Mac endpoints running Cortex XDR agents, if you attempt to restart the agent by running `./cytool runtime restart all` it could cause unexpected behavior which could disable the Cortex XDR agent. Suggested workaround: To restart the agent, run these commands instead— ``` ./cytool runtime stop all ./cytool runtime start all ``` (Cortex XDR agent uninstall password is required) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/7.x/7.4-eol/cortex-xdr-agent-known-issues.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.