> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/pause-endpoint-protection.md).

# Pause endpoint protection

As of agent 7.7 and above, you can pause the agent protection capabilities on one or more endpoints while maintaining connectivity with Cortex XDR. By only pausing the protection and retaining connectivity, the agent will run with all the profiles disabled, but continue to send data and take actions from the server. When you are ready, you can resume the endpoint protection.

{% hint style="info" %}

### Note

Pausing your endpoint protection modules leaves your machines exposed to risks.
{% endhint %}

How to pause endpoint protection modules

1. Go to Endpoints → **All Endpoints**.
2. In the **All Endpoints** page, select the endpoints on which you want to pause protection, right-click and select Endpoint Control → **Pause Endpoint Protection**.
3. Verify the endpoints, add an optional comment that appears in the Management Audit log, and **Pause** the protection.

   Paused endpoints display a pause icon in the **Endpoint Name** field, and one of the following the action statuses in **Manual Protection Pause** field:

   * Protection Active
   * Pending Pause
   * Protection Paused
   * Pending Activation
4. When you are ready to resume protection, select the paused endpoints, right-click and select Endpoint Control → **Resume Endpoint Protection** and **Resume** protection on the listed endpoints.

   The **All Endpoint** table fields are updated accordingly.
5. Track your pause and resume endpoint protection actions.

   Go to Incident Response → Response → **Action Center** and locate **Action Type** **Pause Endpoint Protection** or **Resume Endpoint Protection**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/pause-endpoint-protection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.