> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-3-install-cortex-xdr-agents/plan-your-agent-deployment.md).
# Plan your agent deployment
You typically deploy Cortex XDR agent software to endpoints across a network after an initial proof of concept (POC), which simulates your corporate production environment. During the POC or deployment stage, you analyze security events to determine which are triggered by malicious activity and which are due to legitimate processes behaving in a risky or incorrect manner. You also simulate the number and types of endpoints, the user profiles, and the types of applications that run on the endpoints in your organization, and, according to these factors, you define, test, and adjust the security policy for your organization.
The goal of this multi-step process is to provide maximum protection to the organization without interfering with legitimate workflows.
After the successful completion of the initial POC, we recommend a multi-step implementation in the corporate production environment for the following reasons:
* The POC doesn't always reflect all the variables that exist in your production environment.
* There is a rare chance that the XDR agent will affect business applications, which can reveal vulnerabilities in the software as a prevented attack.
* During the POC, it is much easier to isolate issues that appear and provide a solution before full implementation in a large environment where issues could affect a large number of users.
A multi-step deployment approach ensures a smooth implementation and deployment of the Cortex XDR
Cortex XDR solution throughout your network. Use the following steps for better support and control over the added protection.
| Step | Duration | Plan |
| --------------------------------------------------------------------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Prerequisite. Set up Cortex XDR access services | 1 week | Set up the following:
- Firewall configuration: Enable access to Cortex XDR communication servers, storage buckets, and resources.
- Required certificates to establish secure communication
- Enable access for Windows CRL checks (Windows only)
- Enable peer-to-peer content updates
- Validate compatibility with third-party security products
|
| 1. Calculate the bandwidth required to support the number of agents you plan to deploy. | As needed | For every 100,000 agents, you will need to allocate 120 Mbps of bandwidth. The bandwidth requirement scales linearly. For example, to support 300,000 agents, plan to allocate 360 Mbps of bandwidth (three times the amount required for 100,000 agents). |
| 2. Install Cortex XDR agent on a pilot group of endpoints. | 1 week | Install the Cortex XDR agent on a small number of endpoints (3 to 10).
Test the expected behavior of the Cortex XDR agents (injection and policy) and confirm that there is no change in the user experience.
Review Where can I install the cortex XDR Agent for supported versions and operating systems.
|
| 3. Expand the Cortex XDR deployment. | 2 weeks | Gradually expand agent distribution to larger groups that have similar attributes (hardware, software, and users). At the end of two weeks, you can have Cortex XDR deployed on up to 100 endpoints. |
| 4. Complete the Cortex XDR installation. | 2 or more weeks | Broadly distribute the Cortex XDR agent throughout the organization until all endpoints are protected. |
| 5. Define corporate policy and protected processes. | Up to 1 week | Add protection rules for third-party or in-house applications and then test them. |
| 6. Refine corporate policy and protected processes. | Up to 1 week | Deploy security policy rules to a small number of endpoints that use the applications frequently. Fine-tune the policy as needed. |
| 7. Finalize corporate policy and protected processes. | A few minutes | Deploy protection rules globally. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-3-install-cortex-xdr-agents/plan-your-agent-deployment.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.