> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/7.x/7.7-eol/cortex-xdr-agent-7.7-release-information/changes-to-default-behavior-in-cortex-xdr-agent-7.7.md). # Changes to Default Behavior in Cortex XDR Agent 7.7 #### Changes to Default Behavior in Cortex XDR Agent 7.7 The following topic describes changes to default behavior in Cortex XDR agent 7.7. | Feature | Change to Behavior | | ---------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

WildFire Queries

(Windows)

| To support the Benign with Low Confidence verdict, a new field was added to the WildFire verdict local database. As a result, when you upgrade a Cortex XDR agent release prior to 7.6 to a Cortex XDR agent 7.5, the local WildFire cache is deleted, which could increase the number of initial WildFire queries on the endpoint after upgrade. | |

Retaining Cortex XDR extensions in macOS 11.3

(Mac)

| To comply with the new operating system behavior starting with macOS 11.3, where uploading a configuration file in MDM automatically unloads from the endpoint any previously uploaded extensions by the same vendor, the Cortex XDR agent 7.6 and later retains its extensions on the endpoint in such cases. | |

Aggregated pop-up for Agent Uninstall

(Mac)

| To improve user experience, now when you uninstall the Cortex XDR agent from endpoints running macOS 10.15.4 or later, you are prompted only once to enter your admin password. | |

Reverse Shell Protection

(Linux)

| Starting with this release, if the Cortex XDR agent is operating in asynchronous mode then Reverse Shell Protection is not supported. For more information on supported kernel modules, see the Palo Alto Networks Compatibility Matrix. | |

New process XDR Health improves upgrade process of the Cortex XDR agent

(Windows)

| To improve the upgrade process of the Cortex XDR agent, Cortex XDR now uses a new process called “XDR Health” to monitor the machine at startup time and initiate an upgrade rollback in case of a failed upgrade. This new service runs as the machine starts and checks if the installer has paused. If it has, the machine re-initiates the Windows installer to rollback to the status prior to the upgrade. As upgrades have multiple re-tries, the next try works on the agent of its original version with no interference. The service only runs at startup and remains in pause mode during other times. To ensure this service is not removed, a periodic task would re-instate the process in case it was removed. | |

Signed Cortex XDR Agent Installation for Linux

(Linux)

| To better secure your Cortex XDR agent installations on Linux machines, installation packages are now signed by Palo Alto Networks. The installation package contains a new configuration file which includes the tenant ID and registration key. When installing the agent installation package, if signature-checking is configured, you will need to install a Cortex XDR public key. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/7.x/7.7-eol/cortex-xdr-agent-7.7-release-information/changes-to-default-behavior-in-cortex-xdr-agent-7.7.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.