> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/about-content-updates.md). # About content updates To increase security coverage and quickly resolve any issues in policy, Palo Alto Networks can seamlessly deliver software packages for Cortex XDR called content updates. Content updates can contain changes or updates to any of the following: {% hint style="info" %} ### Note Cortex XDR delivers the content update to the agent in parts and not as a single file, allowing the agent to retrieve only the updates and additions it needs. {% endhint %} * Default security policy including exploit, malware, restriction, and agent settings profiles * Default compatibility rules per module * Protected processes * Local analysis logic * Trusted signers * Processes included in your block list by signers * Behavioral threat protection rules * Ransomware module logic including Windows network folders susceptible to ransomware attacks * Event Log for Windows event logs and Linux system authentication logs * Python scripts provided by Palo Alto Networks * Python modules supported in script execution * Maximum file size for hash calculations in File search and destroy * List of common file types included in File search and destroy * Network Packet Inspection Engine rules When a new update is available, Cortex XDR notifies the Cortex XDR agent. The Cortex XDR agent then randomly chooses a time within a six-hour window during which it will retrieve the content update from Cortex XDR. By staggering the distribution of content updates, Cortex XDR reduces the bandwidth load and prevents bandwidth saturation due to the high volume and size of the content updates across many endpoints. You can view the distribution of endpoints by content update version from the dashboard. The Cortex XDR research team releases more frequent content updates in-between major content versions to ensure your network is constantly protected against the latest and newest threats in the wild. When you enable minor content updates, the Cortex XDR agent receives minor content updates, starting with the next content releases. Otherwise, if you do not wish to deploy minor content updates, your Cortex XDR agents will keep receiving content updates for major releases which usually occur on a weekly basis. The content version numbering format remains `XXX-YYYY`, where `XXX` indicates the version and `YYYY` indicates the build number. To distinguish between major and minor releases, XXX is rounded up to the nearest ten for every major release, and incremented by one for a minor release. For example, `1280-` and `1290-` are major releases, and `1281-` , `1282-`, and `1291-` are minor releases. To adjust content update distribution for your environment, you can configure the following optional settings: * Content management settings as part of the Cortex XDR [global agent configurations](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-2-pre-installation-steps-for-cortex-xdr-agents/configure-global-agent-settings.md). * Content download source, as part of the Cortex XDR [agent setting profile](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-agent-settings-profiles.md). Otherwise, if you want the Cortex XDR agent to retrieve the latest content from the server immediately, you can force the Cortex XDR agent to connect to the server using one of the following methods. * (Windows and Mac only) Perform manual check-in from the Cortex XDR agent console. * Initiate a check-in using the `Cytool checkin` command. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/about-content-updates.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.