> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/pause-endpoint-protection.md).

# Pause endpoint protection

Disable the Cortex XDR agent protection capabilities on an endpoint.

As of agent 7.7 and above, you can pause the agent protection capabilities on one or more endpoints while the agent remains fully connected to Cortex XDR. When protection is paused, the agent runs with all prevention profiles disabled, meaning nothing is blocked, quarantined, or terminated on the endpoint. EDR telemetry collection is not affected. The agent continues to collect and forward endpoint events to Cortex XDR, and the server can still push policy and response actions to the agent. When you are ready, you can resume the endpoint protection.

{% hint style="info" %}

### Note

Pausing your endpoint protection modules leaves your machines exposed to risks.
{% endhint %}

How to pause endpoint protection modules

1. Go to **Endpoints** → **All Endpoints**.
2. In the **All Endpoints** page, select the endpoints on which you want to pause protection, right-click and select **Endpoint** **Control** → **Pause Endpoint Protection**.
3. Verify the endpoints, add an optional comment that appears in the Management Audit log, and **Pause** the protection.

   Paused endpoints display a pause icon in the **Endpoint Name** field, and one of the following the action statuses in **Manual Protection Pause** field:

   * Protection Active
   * Pending Pause
   * Protection Paused
   * Pending Activation
4. When you are ready to resume protection, select the paused endpoints, right-click and select **Endpoint** **Control** → **Resume Endpoint Protection** and **Resume** protection on the listed endpoints.

   The **All Endpoint** table fields are updated accordingly.
5. Track your pause and resume endpoint protection actions.

   Go to **Incident** **Response** → **Response** → **Action Center** and locate **Action Type** **Pause Endpoint Protection** or **Resume Endpoint Protection**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/pause-endpoint-protection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.