> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security.md).

# Harden endpoint security

You can extend the security on your endpoints beyond the Cortex XDR agent built-in prevention capabilities to provide increased network security coverage within your organization. By leveraging existing mechanisms and added capabilities, the Cortex XDR agent can enforce additional protections on your endpoints to provide a comprehensive security posture.

From **Endpoints** → **Policy Management** → **Extensions** → **Profiles**, you can create profiles for the following hardened endpoint security capabilities.

* [Device control](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security/device-control.md)
* [Host firewall](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security/host-firewall.md)
  * [Host firewall for Windows](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security/host-firewall/host-firewall-for-windows.md)
  * [Host firewall for macOS](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security/host-firewall/host-firewall-for-macos.md)
* [Disk encryption](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security/disk-encryption.md)

The **Extensions Profiles** table lists the profile details per operating system. Profiles associated with one or more targets that are beyond your defined user scope are locked and cannot be edited.

| Field              | Description                                                              |
| ------------------ | ------------------------------------------------------------------------ |
| Associated Targets | Targets associated with the profile                                      |
| Created By         | Administrative user who created the profile                              |
| Created Time       | Date and time at which the profile was created                           |
| Description        | Optional description entered by an administrator to describe the profile |
| Modification Time  | Date and time at which the profile was modified                          |
| Modified By        | Administrative user who modified the profile                             |
| Name               | Name provided to identify the security profile                           |
| Platform           | Platform type of the profile                                             |
| Summary            | Summary of profile configuration                                         |
| Type               | Profile type                                                             |
| Usage Count        | Number of policy rules that use the profile                              |

To apply the profiles, from Endpoints → Policy Management → Extensions → **Policy Rules**, you can view all the policy rules per operating system. Rules associated with one or more targets that are beyond your defined user scope are locked and cannot be edited.

The following table describes for each capability the supported platforms and minimal agent version. A dash (—) indicates the setting is not supported.

{% hint style="warning" %}

### Caution

Hardened endpoint security capabilities are not supported for Android endpoints.
{% endhint %}

| Module                                                                                                                                                                                                      | Windows                                                                                     | Mac                                           | Linux |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | --------------------------------------------- | :---: |
| <p><strong>Device Control</strong></p><p>Protects endpoints from loading malicious files from USB-connected removable devices (CD-ROM, disk drives, floppy disks, and Windows portable devices drives).</p> | <p>✓</p><p>Cortex XDR agent 7.0 and later</p><p>For VDI, Cortex XDR agent 7.3 and later</p> | <p>✓</p><p>Cortex XDR agent 7.2 and later</p> |   –   |
| <p><strong>Host Firewall</strong></p><p>Protects endpoints from attacks originating in network communications to and from the endpoint.</p>                                                                 | <p>✓</p><p>Cortex XDR agent 7.1 and later</p>                                               | <p>✓</p><p>Cortex XDR agent 7.2 and later</p> |   –   |
| <p><strong>Disk Encryption</strong></p><p>Provides visibility into endpoints that encrypt their hard drives using BitLocker or FileVault.</p>                                                               | <p>✓</p><p>Cortex XDR agent 7.1 and later</p>                                               | <p>✓</p><p>Cortex XDR agent 7.2 and later</p> |   –   |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.