> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/7.x/7.6-eol/features-introduced-in-cortex-xdr-agent-7.6/mac-features.md). # Mac Features The following features were added to Cortex XDR agents running on Mac endpoints: ### Host Firewall macOS 11 Support and Enhancements To streamline management of your Host Firewall rules and profiles, Cortex XDR now supports host firewall for macOS versions 11 and above and introduces the following enhancements: Host Firewall * Rule Platform Visibility Cortex XDR now displays the corresponding platform associated with your Host Firewall rule. In the Host Firewall Rules Group > Group Name > Rules table, you can now view the new Platform field, displaying the operating systems associated with a specific rule. * Improved New Policy Rule Creation Cortex XDR now enables you to create rules for Windows and macOS platforms in the same window. When selecting Protocol of type TCP or UDP, in addition to the Windows Settings section, the macOS Settings is enabled for your to define. macOS Host Firewall Profile * When editing or creating a macOS Host Firewall Profile, Cortex XDR has updated the configuration design to align with the Windows profile window and allows you to define Report Settings, Internal and External Rule Groups and Rules. With the introduction of macOS 11, Host Firewall Rules created on macOS 10 and Cortex XDR agent 7.5 and prior are managed in the Legacy Host Firewall Rules section. * When editing or creating new groups, Cortex XDR now displays the Applicable Rules Count field. The field displays the number of rules in the specific group that are associated with the platform profile. * In the View Rules table, Cortex XDR now displays the Group Name and Platform fields, and only displays rules associated with the platform profile. ### Cortex XDR Agent Tampering Protection for macOS You can now prevent unauthorized access or tampering with the Cortex XDR agent components on macOS. With this configuration, manual upgrades and changes to any of the daemons, files, or processes will now require entering the agent uninstall password. ### Extending Gatekeeper Protection to Bundles The Cortex XDR Gatekeeper Enhancement protection module now provides coverage also for suspicious bundle executions. ### Audit Log for Unauthorized Agent Shutdown Now when a deliberate termination of the agent is detected on the endpoint, an audit log is reported to Cortex XDR. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/7.x/7.6-eol/features-introduced-in-cortex-xdr-agent-7.6/mac-features.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.