> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/pause-endpoint-protection.md).

# Pause endpoint protection

Temporarily pause endpoint protection when required.

As of agent 7.7 and above, you can pause the agent protection capabilities on one or more endpoints while the agent remains fully connected to Cortex XDR. When protection is paused, the agent runs with all prevention profiles disabled, meaning nothing is blocked, quarantined, or terminated on the endpoint. EDR telemetry collection is not affected. The agent continues to collect and forward endpoint events to Cortex XDR, and the server can still push policy and response actions to the agent. When you are ready, you can resume the endpoint protection.

{% hint style="info" %}

### Note

Pausing your endpoint protection modules leaves your machines exposed to risks.
{% endhint %}

**How to pause endpoint protection modules**

1. Go to **Inventory+Endpoints** → **All Endpoints**.
2. In the **All Endpoints** page, select the endpoints on which you want to pause protection, right-click and select **Endpoint Control** → **Pause Endpoint Protection**.
3. Verify the endpoints, add an optional comment that appears in the Management Audit log, and **Pause** the protection.

   Paused endpoints display a pause icon in the **Endpoint Name** field, and one of the following the action statuses in **Manual Protection Pause** field:

   * Protection Active
   * Pending Pause
   * Protection Paused
   * Pending Activation
4. When you are ready to resume protection, select the paused endpoints, right-click and select **Endpoint Control** → **Resume Endpoint Protection** and **Resume** protection on the listed endpoints.

   The **All Endpoint** table fields are updated accordingly.
5. Track your pause and resume endpoint protection actions.

   Go to **Investigation & Response** → **Response** → **Action Center** and locate **Action Type** **Pause Endpoint Protection** or **Resume Endpoint Protection**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/pause-endpoint-protection.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.