> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-6-perform-health-checks/monitor-agent-operational-status-in-cortex-xdr.md).

# Monitor agent operational status in Cortex XDR

Cortex XDR provides you with information about the XDR agent operational status on an endpoint and indicates whether the agent is protecting according to its predefined security policies and profiles. This can help you identify when the agent may suffer from a technical issue or misconfiguration that interferes with the agent’s protection capabilities or interaction with Cortex XDR and other applications.

The XDR agent reports the operational status as follows:

* **Protected:** Indicates that the XDR agent is running as configured and did not report any exceptions to Cortex XDR.
* **Partially protected:** Indicates that the XDR agent reported one or more exceptions to Cortex XDR.
* **Unprotected:** Indicates the XDR agent is not enforcing protection on the endpoint.
* **Local Resource Impact:** Indicates that the XDR agent machine resources currently available for use, are not enough for the agent to operate smoothly.

You can monitor the Cortex XDR agent **Operational Status** in Endpoints → **All Endpoints**.

The operational status that the agent reports varies according to the exceptions reported by the XDR agent.

| Status                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Protected**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | (Windows, Mac, and Linux) Indicates all protection modules are running as configured on the endpoint.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| **Partially protected**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | <p>Windows</p><ul><li>XDR data collection is not running, or not set</li><li>Behavioral threat protection is not running</li><li>Malware protection is not running</li><li>Exploit protection is not running</li></ul><p>Mac</p><ul><li>Operating system adaptive mode\*</li><li>XDR Data Collection is not running, or not set</li><li>Behavioral threat protection is not running</li><li>Malware protection is not running</li><li>Exploit protection is not running</li></ul><p>Linux</p><ul><li>Kernel module not loaded\*\*</li><li>Kernel module compatible but not loaded\*\*</li><li>Kernel version not compatible\*\*</li><li>XDR Data Collection is not running, or not set</li><li>Behavioral threat protection is not running</li><li>Anti-malware flow is asynchronous</li><li>Malware protection is not running</li><li><p>Exploit protection is not running</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Any of the listed items could lead to a partially protected state. Refer to the Cortex XDR management console for specific reasons for the state.</p></div></li></ul> |
| **Unprotected**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | <p>Windows, Mac, and Linux:</p><ul><li>Behavioral threat protection and Malware protection are not running</li><li>Exploit protection and malware protection are not running</li><li>The content is unavailable.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| **Local Resource Impact**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | <p>Windows, Mac, Linux</p><ul><li>Machine CPU impact on the agent operation</li><li>Machine memory impact on the agent operation</li></ul><p>In addition to the status, either one of the following sub-statuses appear:</p><ul><li>Low local available memory</li><li>No local available memory</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Caution</strong></p><p>Status can have the following implications on the endpoint:</p><ul><li>\*(<code>Status</code>): The exploit protection module is not running.</li><li><p>\*\*(<code>Status</code>):</p><ul><li>XDR data collection is not running</li><li>Behavioral threat protection is not running</li><li>Anti-malware flow is asynchronous</li><li>Local privilege escalation protection is asynchronous</li></ul></li></ul></div> |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-6-perform-health-checks/monitor-agent-operational-status-in-cortex-xdr.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.