Windows
1. Add a new profile and define basic settings.
1. Select **Inventory** → **Endpoints** → **Policy Management** → **Prevention** → **Profiles**. Click **+Add Profile**, and select whether to create a new profile or import a profile from a file.
Note
New profiles based on imported profiles are added, and do not replace existing ones.
Enable this option to operate display notifications in the notifications area on the endpoint. When you enable notifications, you can use the default notification messages that are displayed for each option, or provide custom text for each notification type. You can also customize a notification footer. Options include:
Note
You can enable the option to maintain a persistent notification regarding the disconnection of the endpoint from the network. The settings Persistent Isolation Notification and Blocked Connectivity Notification must be enabled. Until the threat on the endpoint has been removed, the endpoint remains disconnected from the network.
Note
In Traps 5.0.6 and later releases, when protection is enabled, access will be read-only. In earlier Traps releases, enabling protection disables all access to services, processes, files, and registry values.
Note
If you choose the Enable option, you must also enable XDR Agent Tampering Protection in the malware profile and set it to Block. Ensure that both profiles are assigned to the same endpoints.
Note
When you enable Cortex XDR agent registration with the Windows Security Center, Windows automatically shuts down Microsoft Defender on Windows-based workstation endpoints. If you still want to allow Microsoft Defender to run on a workstation endpoint where Cortex XSIAM is installed, you must use the Disable option. However, Palo Alto Networks does not recommend running Windows Defender and the Cortex XDR agent on the same endpoint, because this might cause performance and incompatibility issues with Global Protect and other applications.
On Windows-based servers, ensure that Windows Defender is disabled. This can be done using a Group Policy Object (GPO) or another group management tool of your choice.
The Cortex XDR agent registers with the Windows Security Center as an official Antivirus (AV) software product. As a result, Windows automatically shuts down Microsoft Defender on the endpoint, except for endpoints that are running Windows Server versions.
To avoid performance issues, Palo Alto Networks recommends that you disable or remove Windows Defender from Windows Server-based endpoints where the Cortex XDR agent is installed.
|
| Enabled No Patches | (Traps 5.0 release only) Select this option if you want to register the agent with the Windows Security Center, but prevent Windows from automatically installing Meltdown/Spectra vulnerability patches on the endpoint. | |
| Disabled | The Cortex XDR agent does not register with the Windows Action Center. As a result, Windows Action Center might indicate that virus protection is off, depending on other security products that are installed on the endpoint. | |
| Report Agent Out of Date Status to Windows Security Center | | When enabled, the Cortex XDR agent will report every time that the connection to the server is lost for more than seven days. Each time that the agent reconnects, the count restarts.
This setting is available when Windows Security Integration is set to either Enabled or Enabled No Patches.
|
7. Configure **Issues Data** collection options.
When the Cortex XDR agent generates issues for process-related activity on the endpoint, the agent collects the contents of memory and other data about the event, in what is known as an issue data dump file. You can configure the Cortex XDR agent to automatically upload issue data dump files to Cortex XDR.
| Item | Options | More details |
| ----------------------------------------- | --------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| Issue Data Dump File Size | | The **Full** option creates the largest and most complete set of information. |
| Automatically Upload Issue Data Dump File | | During event investigation, if automatic upload was disabled, you can still manually retrieve this data. |
8. Enable **XDR Pro Endpoint Capabilities**, and then configure the capabilities required by your organization. The Cortex XDR Pro features are hidden until you enable this option.
Notice
Requires a Cortex XDR Pro per Endpoint license. When you enable this feature, a Cortex XDR Pro per Endpoint license is consumed.
Notice
Requires Host Insights add-on.
When enabled, the various host insight capabilities can be configured.
|
| Endpoint Information Collection | | When enabled, the Cortex XDR agent collects host inventory information such as users, groups, services, drivers, hardware, and network shares, as well as information about applications installed on the endpoint, including CVE and installed KBs for Vulnerability Assessment. |
| File Search and Destroy Action Mode | | When enabled, the Cortex XDR agent collects detailed information about files on the endpoint to create a files inventory database. The agent locally monitors any actions performed on these files and updates the local files inventory database in real-time.
With this option you can also select the File Search and Destroy Monitored File Types where Cortex XSIAM monitors all the files on the endpoint, or only common file types. If you choose Common file types, Cortex XSIAM monitors the following file types:
bin, msi, doc, docx, docm, rtf, xls, xlsx, xlsm, pdf, ppt, pptx, pptm, ppsm, pps, ppsx, mpp, mppx, vsd, xsdx and wsf.
A hash will also be computed for these file types: zip, pe, and ole.
File size is limited to 30 MB by default. Searches of files larger than 30 MB by hash are not supported.
Additionally, you can exclude files that exist under a specific local path on the endpoint from inclusion in the files database.
|
| Monitor and Collect Forensics Data | | Notice
Requires Forensics Add-on.
When enabled, the Cortex XDR agent collects detailed information about what happened on your endpoint, to create a forensics database. Define the following to enable collection and collection time intervals for the following entity types:
- Process Execution
- File Access
- Persistence
- Command History
- Network
- Remote Access
- Search Collections
Data collected by the agent is displayed on the tenant's Forensics page.
|
| Distributed Network Scan | Note
To enable access to these options, scroll down to Network Location Configuration, and set Action Mode to Enabled.
When enabled, the Cortex XDR agent scans your network using Ping or Nmap to provide updated identifiers of your unmanaged network assets. Ping scans return the IP address, MAC address, Hostname, and Platform, whereas Nmap will scan the most common ports for the IP address, Hostname, Platform, and OS version.
Ping is a lighter scan, that generates icmp requests to peers and does not use external tools. Nmap will make more noise on the network, but the resulting can be better, and also supports operating system detection.
Ping scans are performed in 30 minute intervals. Nmap scans are performed in 60 minute intervals.
The scan is performed according to the subnets detected in each network interface found on the endpoint, and up to a maximum of \~1K IP addresses calculated according to agent\_ip/22. For example, an agent with the IP address 121.121.121.121 will be assigned the scan range: 121.121.120.1 - 121.121.123.254 (1024 addresses). Each agent is assigned scan ranges randomly from all the scannable subnets, so the same agent can scan multiple subnets.
The following criteria affect the scan:
- There must be at least two endpoints detected in order to assign a scan.
- Network Location Configuration must be enabled.
- Subnet masking settings and service name configurations influence the scan.
- Excluded IP address ranges are not scanned.
1. In the Network Location Configuration section, set the Action Mode to Enabled.
2. In the Distributed Network Scan section, set the Action Mode to Enabled.
3. In Scan Mode, select Nmap or Ping.
Note
When using Nmap, the Cortex XDR agent downloads an Nmap driver for the duration of the scan and removes the driver upon completion. If an Nmap scan is in process, Cortex XSIAM identifies the Nmap driver and places any additional scans in a queue.
The scan is performed according to the subnets detected in each network interface found on the endpoint.
4. If you want to exclude IP address ranges, select Excluded IP Address Ranges. The IP address ranges are populated from your network configurations.
5. If you selected Nmap, enable or disable OS Fingerprinting of the IP address.
Depending on the type of scan you defined, the agent Ping scan takes 30 minutes, and Nmap takes 60 minutes. Following each scan, Cortex XDR aggregates the IP addresses that were collected, and displays the results in the Asset Management table.
|
9. Configure **XDR Cloud** for hosts running on cloud platforms. By default (auto-detect mode), the agent detects whether an endpoint is a cloud-based (container) installation or a permanent installation, and uses license allocation accordingly.
| Item | Options | More details |
| --------- | --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| XDR Cloud | | If you set this to **Enabled** in the profile, any agent using this profile will be treated as if it is a cloud-based agent for licensing purposes. |
10. Configure **Response Actions** for specific applications or processes, using an Allow list.
If you need to isolate an endpoint, but want to allow access for a specific application or process, add it to the **Network Isolation Allow List**. Keep the following considerations in mind:
* When you add a specific application to your allow list from network isolation, the Cortex XDR agent continues to block some internal system processes. This is because some applications, for example, ping.exe, can use other processes to facilitate network communication. As a result, if the Cortex XDR agent continues to block an application you included in your allow list, you may need to perform additional network monitoring to determine the process that facilitates the communication, and then add that process to the allow list.
* For VDI sessions, use of the network isolation response action can disrupt communication with the VDI host management system, thereby stopping access to the VDI session. Therefore, before using the response action, you must add the VDI processes and corresponding IP addresses to your allow list.
1. Click **Add** to add an entry to the allow list.
2. Specify the Process Path that you want to allow, and the IPv4 or IPv6 address of the endpoint. Use the **`*`** wildcard on either side to match any process or IP address. For example, specify **`*`** as the process path and an IP address to allow any process to run on the isolated endpoint with that IP address. Conversely, specify **`*`** as the IP address and a specific process path to allow the process to run on any isolated endpoint that receives this profile.
3. Click the check mark.
11. Configure **Backup Management** to backup endpoint data.
| Item | Options | More details |
| --------------------- | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Shadowcopy Activation | | When enabled, the Cortex XDR agent automatically turns on the system protection of the endpoint. This ensures that the data is backed up and may be recovered in cases of any security breaches or loss of data. |
| Disk Space Limitation | Disk space in MB | Limits the amount of disk space in MB that can be used for endpoint data backup. |
12. Configure the method used to update content on your endpoints.
Warning
If you disable or delay automatic-content updates provided by Palo Alto Networks, it may affect the security level in your organization.
Note
- If you disable content updates for a newly installed agent, the agent retrieves the content for the first time from Cortex XSIAM, and then disables content updates on the endpoint.
- When you add a Cortex XDR agent to an endpoint group with a disabled content auto-upgrades policy, the policy is applied to the added agent as well.
- Enabled
- Disabled (default)
| By default, the Cortex XDR agent always retrieves the most updated content and deploys it on the endpoint, to ensure that it is always protected with the latest security measures.
If you disable content updates, the agent stops retrieving them from the Cortex XSIAM tenant, and keeps working with the current content on the endpoint.
|
| Content Staging | - Enabled
- Disabled (default)
| Enable users to deploy agent staging content on selected test environments. Staging content is released before production content, allowing for early evaluation of the latest content update. |
| Content Rollout | | The Cortex XDR agent can retrieve content updates immediately as they are available, or after a pre-configured delay period. When you delay content updates, the Cortex XDR agent will retrieve the content according to the configured delay. For example, if you configure a delay period of two days, the agent will not use any content released in the last 48 hours. |
13. Agent Auto-Upgrade is disabled by default. Before enabling Auto-Update for Cortex XDR agents, make sure to consult with all relevant stakeholders in your organization.
Note
Automatic upgrades are not supported with non-persistent VDI and temporary sessions.
- Enabled
- Disabled (Default)
| |
| Automatic Upgrade Scope | - Latest agent release
- One release before the latest one
- Only maintenance releases
- Only maintenance releases in a specific version
| For One release before the latest one, Cortex XSIAM upgrades the agent to the previous release before the latest, including maintenance releases. Major releases are numbered X.X, such as release 8.0, or 8.2. Maintenance releases are numbered X.X.X, such as release 8.2.2.
For Only maintenance releases in a specific version, select the required release version.
|
| Upgrade Rollout | | For Delayed, set the delay period (number of days) to wait after the version release before upgrading endpoints. Choose a value between 7 and 45.
To control the number of parallel upgrades in your network, configure Global Agent Settings.
Note
The delay timer starts from the date of the target agent version's availability in the tenant.
Note
Limitations in the content download process:
- When you install the Cortex XDR agent, the agent retrieves the latest content update version available. A freshly installed agent can take between five to ten minutes (depending on your network and content update settings) to retrieve the content for the first time. During this time, your endpoint is not protected.
- When you upgrade a Cortex XDR agent to a newer Cortex XDR agent version, if the new agent cannot use the content version running on the endpoint, the new content update will start within one minute in P2P, and within five minutes from Cortex XSIAM.
- 33221 (default port)
- custom port
| Cortex XSIAM deploys serverless peer-to-peer distribution to Cortex XDR agents in your LAN network by default. Within the six hour randomization window during which the Cortex XDR agent attempts to retrieve the new version, it will broadcast its peer agents on the same subnet twice: once within the first hour, and once again during the following five hours. If the agent did not retrieve the files from other agents in both queries, it will proceed to the next download source defined in your profile.
To enable P2P, you must enable UDP and TCP over the port specified for P2P Port. By default, Cortex XSIAM uses port 33221. You can change the port number, if required by your organization.
|
| Broker VM | - Select all
- Brokers
- Clusters
(only Broker VMs that are connected and configured for caching can be selected)
| (Requires Broker VM 12.0 and later)
If you have a Palo Alto Networks Broker VM in your network, you can leverage the Local Agent Settings applet to cache release upgrades and content updates. When the Broker VM is enabled and configured appropriately (refer to Activate Local Agent Settings) , it retrieves the latest installers and content files every 15 minutes, downloading them only if they are not already stored locally. The Broker VM stores this content for 7 days and agent installers for up to 30 days from the agent's last request.
If the files are not available on the Broker VM at the time of the request, the agent proceeds to download the files directly from the Cortex XSIAM server.
When you select multiple Broker VMs, the agent chooses a Broker VM randomly for each download request.
|
15. Configure **Network Location Configuration** for your Cortex XDR agents. If you configure host firewall rules in your network, you must:
* Enable **Network Location Configuration Action Mode**, so that Cortex XDR can test the network location of your device.
* Configure your network's DNS name and its internal IP address.
If the Cortex XDR agent detects a network change on the endpoint, the agent triggers the device location test and re-calculates the policy according to the new location.
| Item | Options | More details |
| ----------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Action Mode | | When **Enabled**, a domain controller (DC) test checks whether the device is connected to the internal network or not. If the device is connected to the internal network, it is determined to be in the organization. If the DC test fails or returns an external domain, Cortex XSIAM performs a DNS connectivity test. |
| DNS Name | Your network's DNS name | The Cortex XDR agent tests network location by submitting a Domain Name Server (DNS) name that is known only to the internal network. If the DNS returns the pre-configured internal IP address, the device is determined to be within the organization. If the DNS IP address cannot be resolved, the device is deemed to be located elsewhere. |
| IP Address | Your network's DNS internal IP address | Enter the internal DNS IP address to be used by the DNS test. |
16. Define **Agent Proxy Settings**.
Select whether to **Enable** or **Disable** **Direct Server Access** for the agent when connected using a proxy.
17. Configure **Agent Certificates**. For improved security, enforce the use of root CA that is provided by Palo Alto Networks rather than on the local machine.
| Item | Options | More details |
| ----------------------- | -------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Certificate Enforcement | - Enabled
- Disabled
- Disabled (Notify)
| When enabled, certificate enforcement is enabled.
Note
If the Cortex XDR agent is initially unable to communicate without the local store, enforcement is not enabled and the agent will show as partially protected.
When set to Disabled (Notify), Cortex XDR agents with this policy will trigger a banner in the server to notify customers about potential risk, and will direct them to change the certificate and the setting. The Last Certificate Enforcement Fallback column of the All Endpoints table is updated, and management audit logs related to the local store fallback are received by the server.
When set to Disabled, Cortex XDR agents with this policy will trigger a banner in the server to notify customers about potential risk, and will direct them to change the certificate and the setting. The Last Certificate Enforcement Fallback column of the All Endpoints table is not updated, and no management audit logs related to the local store fallback are received by the server.
|
18. Configure **IT Metrics**, to define setting for collecting IT metrics on the endpoint.
| Item | Options | More details |
| --------------- | ------------------------------------------ | -------------------------------------------------------------------------------------------------------------- |
| Collect IT Data | | When enabled, the Cortex XDR agent collects IT data that provides visibility into IT performance on the agent. |
19. Configure **Data Generation Providers**, to define data generation provider types from which endpoints collect data. By default, all data generation provider types are enabled. We do not recommend disabling data generation providers unless really necessary, because it has an impact on the security coverage of your endpoints. Consult with Customer Support before you disable any of these options.
| Item | Options | More details |
| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Disable Specific Data Generation Providers | - Data Generation Module
- Event Log Provider
- System Call Provider
- Remote Procedure Call Provider
- .NET Provider
- Device Driver IO Control Provider
| To disable data collection from specific data generation provider types, select one or more options. If you select **Data Generation Module**, all provider types are disabled. |
20. Configure **Agentic Endpoint Security (AES)** to secure the non-binary endpoint attack surface, including AI agents, AI coding tools, MCP servers, IDE extensions, browser plugins, and code packages such as npm and pip. The Cortex XDR agent discovers agentic software running on the endpoint and remediates risks based on your AES policy. To learn more, or for information about AES policies, discovered agentic software, and remediating findings, see [Agentic Endpoint Security with Koi](https://docs.koi.ai/).
License Type
Requires the Agentic Endpoint Security (AES) add-on license. AES is supported on Platform XDR and XSIAM tenants only (legacy tenants are not supported).
Note
You configure this setting per platform. AES is supported on Windows and Mac endpoints only.
Disabled (default)
AES only
XDR + AES
| Configure the integration run-mode for the AES module in Cortex XDR. The run-mode determines how the Cortex XDR agent operates on the endpoint. Changes take effect on each endpoint at its next check-in.
Disabled (default). AES is not active on the endpoint. If you change the run-mode from an active state (AES only or XDR + AES) to Disabled, the Cortex XDR agent runs the AES uninstall scripts on next check-in to remove AES-related persistent data and local artifacts from the endpoint. AES data already collected and sent to your AES tenant is retained on the AES side and is not affected by the endpoint cleanup.
AES only. The endpoint runs a lightweight agent configuration that provides only AES functionality plus agent management functions such as heartbeats, policy and content updates, and upgrades. No event collection or prevention modules run in this mode. The tray icon and Check-in option remain available, but the Cortex XDR agent Console UI is disabled on AES-only endpoints. Agent version downgrade is not supported from AES-only mode (mode changes back to XDR + AES or Disabled are supported).
XDR + AES. The endpoint runs the full Cortex XDR agent with all XDR protection modules, plus the AES module for agentic endpoint security. Cortex XDR anti-tampering protection covers the AES scripts along with the rest of the agent. Use this run-mode on endpoints that need both endpoint protection and AES.
You can switch between the three run-modes at any time by re-editing the Agent Settings profile and re-applying the policy. Switching from AES only to XDR + AES or from XDR + AES to AES only preserves AES data on the endpoint; only switching to Disabled (or uninstalling the Cortex XDR agent) removes it.
To restore the default value, select Use Default (Disabled).
|
21. To save the profile, click **Create**.
What to do next
If you are ready to apply your new profile to endpoints, you do this by adding it to a policy rule. If you still need to define other profiles, you can do this later. During policy rule creation or editing, you select the endpoints to which to assign the policy. There are different ways of doing this, such as:
macOS
1. Add a new profile and define basic settings.
1. Select **Inventory** → **Endpoints** → **Policy Management** → **Prevention** → **Profiles**. Click **+Add Profile**, and select whether to create a new profile or import a profile from a file.
Note
New profiles based on imported profiles are added, and do not replace existing ones.
Enable this option to operate display notifications in the notifications area on the endpoint. When you enable notifications, you can use the default notification messages that are displayed for each option, or provide custom text for each notification type. You can also customize a notification footer. Options include:
Device Control Violation Notifications
Note
Disabling Device Control Violation notifications is only supported on endpoints running Cortex XDR agent version 8.6 and above.
Live Terminal User Notifications: You can select to Request end-user permission to start the session. If the end user denies the request, you will not be able to initiate a Live Terminal session on the endpoint.
You can select to Request end-user permission to start the session. If the end user denies the request, you will not be able to initiate a Live Terminal session on the endpoint.
- Live Terminal Active Session Indication: Enable this option to display a blinking light (
) on the status bar for the duration of the remote session to indicate to the end user that a Live Terminal session is in progress. - Persistent Isolation Notification
- Endpoint Network Isolation Notification
- Endpoint Network Un-Isolation Notification
- Blocked Connectivity Notification
- Exploit/Malware Events Set to Block
- Restriction Events Set to Block
- Restriction Events Set to Notify User
- Notification Footer Text
- USB Device Was Blocked
USB Disk Drive Was Allowed in Read-Only Mode
Note
You can enable the option to maintain a persistent notification regarding the disconnection of the endpoint from the network. The settings Persistent Isolation Notification and Blocked Connectivity Notification must be enabled. Until the threat on the endpoint has been removed, the endpoint remains disconnected from the network.
|
4. For **Agent Security**, configure **XDR Agent Tampering Protection** (default is **Enabled**). By default, the Cortex XDR agent protects all agent components.
Note
If you choose the Enabled option, you must also set Anti Tampering Protection in the malware security profile to Block, and ensure that both profiles are assigned to the same endpoints.
Note
When protection is enabled, access to services, processes, files, and registry values will be read-only.
Notice
Requires a Cortex XDR Pro per Endpoint license. When you enable this feature, a Cortex XDR Pro per Endpoint license is consumed.
Notice
Requires Host Insights add-on.
When enabled, the various host insight capabilities can be configured.
|
| Endpoint Information Collection | | When enabled, the Cortex XDR agent collects Host Inventory information such as users, groups, services, drivers, hardware, and network shares, as well as information about applications installed on the endpoint, including CVE and installed KBs for Vulnerability Assessment. |
| File Search and Destroy Action Mode | | When enabled, the Cortex XDR agent collects detailed information about files on the endpoint to create a files inventory database. The agent locally monitors any actions performed on these files and updates the local files inventory database in real-time.
With this option you can also select the File Search and Destroy Monitored File Types where Cortex XSIAM monitors all the files on the endpoint, or only common file types. If you choose Common file types, Cortex XSIAM monitors the following file types:
acm, apk, ax, bat, bin, bundle, csv, dll, dmg, doc, docm, docx, dylib, efi, hta, jar, js, jse, jsf, lua, mpp, mppx, mui, o, ocx, pdf, pkg, pl, plx, pps, ppsm, ppsx, ppt, pptm, pptx, py, pyc, pyo, rb, rtf, scr, sh, vds, vsd, wsf, xls, xlsm, xlsx, xsdx, and zip.
Additionally, you can exclude files that exist under a specific local path on the endpoint from inclusion in the files database.
|
| Monitor and Collect Forensics Data | | Notice
Requires Forensics Add-on.
When enabled, the Cortex XDR agent collects detailed information about what happened on your endpoint, to create a forensics database. Define the following to enable collection and collection time intervals for the following entity types:
- Process Execution
- File Access
- Persistence
- Command History
- Network
- Search Collections
Data collected by the agent is displayed on the tenant's Forensics page.
|
8. Configure **XDR Cloud** for hosts running on cloud platforms. By default (auto-detect mode), the agent detects whether an endpoint is a cloud-based (container) installation or a permanent installation, and uses license allocation accordingly.
| Item | Options | More details |
| --------- | --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| XDR Cloud | | If you set this to **Enabled** in the profile, any agent using this profile will be treated as if it is a cloud-based agent for licensing purposes. |
9. Configure **Response Actions** for specific applications or processes, using an Allow list.
If you need to isolate an endpoint, but want to allow access for a specific application or process, add it to the **Network Isolation Allow List**. Keep the following considerations in mind:
When you add a specific application to your allow list from network isolation, the Cortex XDR agent continues to block some internal system processes. This is because some applications, for example, ping.exe, can use other processes to facilitate network communication. As a result, if the Cortex XDR agent continues to block an application you included in your allow list, you may need to perform additional network monitoring to determine the process that facilitates the communication, and then add that process to the allow list.
1. Click **Add** to add an entry to the allow list.
2. Specify the Process Path that you want to allow, and the IPv4 or IPv6 address of the endpoint. Use the **`*`** wildcard on either side to match any process or IP address. For example, specify **`*`** as the process path and an IP address to allow any process to run on the isolated endpoint with that IP address. Conversely, specify **`*`** as the IP address and a specific process path to allow the process to run on any isolated endpoint that receives this profile.
3. Click the check mark.
10. Configure **Backup Management**.
| Item | Options | More details |
| ----------------------- | ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Time Machine Activation | | When enabled, this option automatically turns on the **Time Machine** setting of the endpoint. This ensures that the data is backed up and may be recovered in cases of any security breaches or loss of data. |
11. Configure the method used to update content on your endpoints.
Warning
If you disable or delay automatic-content updates provided by Palo Alto Networks, it may affect the security level in your organization.
Note
If you disable content updates for a newly installed agent, the agent retrieves the content for the first time from Cortex XSIAM, and then disables content updates on the endpoint.
- Enabled (default)
- Disabled
| By default, the Cortex XDR agent always retrieves the most updated content and deploys it on the endpoint, to ensure that it is always protected with the latest security measures.
If you disable content updates, the agent stops retrieving them from the Cortex XSIAM tenant, and keeps working with the current content on the endpoint.
|
| Staging Content | - Enabled
- Disabled (default)
| Enable users to deploy agent staging content on selected test environments. Staging content is released before production content, allowing for early evaluation of the latest content update. |
| Content Rollout | | The Cortex XDR agent can retrieve content updates immediately as they are available, or after a pre-configured delay period. When you delay content updates, the Cortex XDR agent will retrieve the content according to the configured delay. For example, if you configure a delay period of two days, the agent will not use any content released in the last 48 hours. |
12. Agent Auto-Upgrade is disabled by default. Before enabling Auto-Update for Cortex XDR agents, make sure to consult with all relevant stakeholders in your organization.
Note
Automatic upgrades are not supported with non-persistent VDI and temporary sessions.
When a Cortex XDR agent is added to an endpoint group, it inherits the group's policy, including the disabled content auto-upgrades setting.
- Enabled
- Disabled (Default)
| |
| Automatic Upgrade Scope | - Latest agent release
- One release before the latest one
- Only maintenance releases
- Only maintenance releases in a specific version
| For One release before the latest one, Cortex XSIAM upgrades the agent to the previous release before the latest, including maintenance releases. Major releases are numbered X.X, such as release 8.0, or 8.2. Maintenance releases are numbered X.X.X, such as release 8.2.2.
For Only maintenance releases in a specific version, select the required release version.
|
| Upgrade Rollout | | For Delayed, set the delay period (number of days) to wait after the version release before upgrading endpoints. Choose a value between 7 and 45.
To control the agent auto upgrade scheduler and number of parallel upgrades in your network, configure Global Agent Settings.
Note
The delay timer starts from the date of the target agent version's availability in the tenant.
Note
Limitations in the content download process:
- When you install the Cortex XDR agent, the agent retrieves the latest content update version available. A freshly installed agent can take between five to ten minutes (depending on your network and content update settings) to retrieve the content for the first time. During this time, your endpoint is not protected.
- When you upgrade a Cortex XDR agent to a newer Cortex XDR agent version, if the new agent cannot use the content version running on the endpoint, the new content update will start within one minute in P2P, and within five minutes from Cortex XSIAM.
- 33221 (default port)
- custom port
| Cortex XSIAM deploys serverless peer-to-peer distribution to Cortex XDR agents in your LAN network by default. Within the six hour randomization window during which the Cortex XDR agent attempts to retrieve the new version, it will broadcast its peer agents on the same subnet twice: once within the first hour, and once again during the following five hours. If the agent did not retrieve the files from other agents in both queries, it will proceed to the next download source defined in your profile.
To enable P2P, you must enable UDP and TCP over the port specified for P2P Port. By default, Cortex XSIAM uses port 33221. You can change the port number, if required by your organization.
|
| Broker VM | - Select all
- Brokers
- Clusters
(only Broker VMs that are connected and configured for caching can be selected)
| (Requires Broker VM 12.0 and later)
If you have a Palo Alto Networks Broker VM in your network, you can leverage the Local Agent Settings applet to cache release upgrades and content updates. When the Broker VM is enabled and configured appropriately (refer to Activate the Local Agent Settings) , it retrieves the latest installers and content every 6 hours. The Broker VM stores them for a 24-hour retention period since an agent last asked for them.
If the files are not available on the Broker VM at the time of the request, the agent proceeds to download the files directly from the Cortex XSIAM server.
When you select multiple Broker VMs, the agent chooses a Broker VM randomly for each download request.
|
15. Configure **Network Location Configuration** for your Cortex XDR agents. If you configure host firewall rules in your network, you must:
* Enable **Network Location Configuration Action Mode**, so that Cortex XSIAM can test the network location of your device.
* Configure your network's DNS name and its internal IP address.
If the Cortex XDR agent detects a network change on the endpoint, the agent triggers the device location test and re-calculates the policy according to the new location.
| Item | Options | More details |
| ----------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Action Mode | | When **Enabled**, a domain controller (DC) test checks whether the device is connected to the internal network or not. If the device is connected to the internal network, it is determined to be in the organization. If the DC test fails or returns an external domain, Cortex XSIAM performs a DNS connectivity test. |
| DNS Name | Your network's DNS name | The Cortex XDR agent tests network location by submitting a Domain Name Server (DNS) name that is known only to the internal network. If the DNS returns the pre-configured internal IP address, the device is determined to be within the organization. If the DNS IP address cannot be resolved, the device is deemed to be located elsewhere. |
| IP Address | Your network's DNS internal IP address | Enter the internal DNS IP address to be used by the DNS test. |
16. Define **Agent Proxy Settings**.
Select whether to **Enable** or **Disable** **Direct Server Access** for the agent when connected using a proxy.
17. Configure **Agent Certificates**. For improved security, enforce the use of root CA that is provided by Palo Alto Networks rather than on the local machine.
| Item | Options | More details |
| ----------------------- | -------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Certificate Enforcement | - Enabled
- Disabled
- Disabled (Notify)
| When enabled, certificate enforcement is enabled.
Note
If the Cortex XDR agent is initially unable to communicate without the local store, enforcement is not enabled and the agent will show as partially protected.
When set to Disabled (Notify), Cortex XDR agents with this policy will trigger a banner in the server to notify customers about potential risk, and will direct them to change the certificate and the setting. The Last Certificate Enforcement Fallback column of the All Endpoints table is updated, and management audit logs related to the local store fallback are received by the server.
When set to Disabled, Cortex XDR agents with this policy will trigger a banner in the server to notify customers about potential risk, and will direct them to change the certificate and the setting. The Last Certificate Enforcement Fallback column of the All Endpoints table is not updated, and no management audit logs related to the local store fallback are received by the server.
|
18. Configure **Agentic Endpoint Security (AES)** to secure the non-binary endpoint attack surface, including AI agents, AI coding tools, MCP servers, IDE extensions, browser plugins, and code packages such as npm and pip. The Cortex XDR agent discovers agentic software running on the endpoint and remediates risks based on your AES policy. To learn more, or for information about AES policies, discovered agentic software, and remediating findings, see [Agentic Endpoint Security with Koi](https://docs.koi.ai/).
License Type
Requires the Agentic Endpoint Security (AES) add-on license. AES is supported on Platform XDR and XSIAM tenants only (legacy tenants are not supported).
Note
You configure this setting per platform. AES is supported on Windows and Mac endpoints only.
Disabled (default)
AES only
XDR + AES
| Configure the integration run-mode for the AES module in Cortex XDR. The run-mode determines how the Cortex XDR agent operates on the endpoint. Changes take effect on each endpoint at its next check-in.
Disabled (default). AES is not active on the endpoint. If you change the run-mode from an active state (AES only or XDR + AES) to Disabled, the Cortex XDR agent runs the AES uninstall scripts on next check-in to remove AES-related persistent data and local artifacts from the endpoint. AES data already collected and sent to your AES tenant is retained on the AES side and is not affected by the endpoint cleanup.
AES only. The endpoint runs a lightweight agent configuration that provides only AES functionality plus agent management functions such as heartbeats, policy and content updates, and upgrades. No event collection or prevention modules run in this mode. The tray icon and Check-in option remain available, but the Cortex XDR agent Console UI is disabled on AES-only endpoints. Agent version downgrade is not supported from AES-only mode (mode changes back to XDR + AES or Disabled are supported).
XDR + AES. The endpoint runs the full Cortex XDR agent with all XDR protection modules, plus the AES module for agentic endpoint security. Cortex XDR anti-tampering protection covers the AES scripts along with the rest of the agent. Use this run-mode on endpoints that need both endpoint protection and AES.
You can switch between the three run-modes at any time by re-editing the Agent Settings profile and re-applying the policy. Switching from AES only to XDR + AES or from XDR + AES to AES only preserves AES data on the endpoint; only switching to Disabled (or uninstalling the Cortex XDR agent) removes it.
To restore the default value, select Use Default (Disabled).
|
19. To save the profile, click **Create**.
What to do next
If you are ready to apply your new profile to endpoints, you do this by adding it to a policy rule. If you still need to define other profiles, you can do this later. During policy rule creation or editing, you select the endpoints to which to assign the policy. There are different ways of doing this, such as:
Linux
1. Add a new profile and define basic settings.
1. Select **Inventory** → **Endpoints** → **Policy Management** → **Prevention** → **Profiles**. Click **+Add Profile**, and select whether to create a new profile or import a profile from a file.
Note
New profiles based on imported profiles are added, and do not replace existing ones.
Notice
Requires a Cortex XDR Pro per Endpoint license. When you enable this feature, a Cortex XDR Pro per Endpoint license is consumed.
Notice
Requires Host Insights add-on
When enabled, the various host insight capabilities can be configured.
|
| Endpoint Information Collection | | When enabled, the Cortex XDR agent collects Host Inventory information such as users, groups, services, drivers, hardware, and network shares, as well as information about applications installed on the endpoint, including CVE and installed KBs for Vulnerability Assessment. |
| Enable Compliance Collection | | |
5. Configure **XDR Cloud** for hosts running on cloud platforms. By default (auto-detect mode), the agent detects whether an endpoint is a cloud-based (container) installation or a permanent installation, and uses license allocation accordingly.
| Item | Options | More details |
| --------- | --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| XDR Cloud | | If you set this to **Enabled** in the profile, any agent using this profile will be treated as if it is a cloud-based agent for licensing purposes. |
6. Configure **Response Actions** for specific applications or processes, using an Allow list.
If you need to isolate an endpoint, but want to allow access for a specific application or process, add it to the **Network Isolation Allow List**. Keep the following considerations in mind:
* When you add a specific application to your allow list from network isolation, the Cortex XDR agent continues to block some internal system processes. This is because some applications, for example, ping.exe, can use other processes to facilitate network communication. As a result, if the Cortex XDR agent continues to block an application you included in your allow list, you may need to perform additional network monitoring to determine the process that facilitates the communication, and then add that process to the allow list.
1. Click **Add** to add an entry to the allow list.
2. Specify the Process Path that you want to allow, and the IPv4 or IPv6 address of the endpoint. Use the **`*`** wildcard on either side to match any process or IP address. For example, specify **`*`** as the process path and an IP address to allow any process to run on the isolated endpoint with that IP address. Conversely, specify **`*`** as the IP address and a specific process path to allow the process to run on any isolated endpoint that receives this profile.
3. Click the check mark.
7. Configure settings to automatically **Revert Endpoint Isolation** of an agent. When this feature is enabled, agent isolation will be cancelled when a connection with the managing server is lost for the defined continuous period of time.
1. Either keep the recommended default setting (**Enabled**), or change it by selecting **Disabled** in the **Revert Isolation** field.
2. Set a time unit and enter the number of hours or days. We recommend 24 hours (default).
8. Configure the method used to update content on your endpoints.
Warning
If you disable or delay automatic-content updates provided by Palo Alto Networks, it may affect the security level in your organization.
Note
- If you disable content updates for a newly installed agent, the agent retrieves the content for the first time from Cortex XSIAM, and then disables content updates on the endpoint.
- When you add a Cortex XDR agent to an endpoint group with a disabled content auto-upgrades policy, the policy is applied to the added agent as well.
- Enabled (default)
- Disabled
| By default, the Cortex XDR agent always retrieves the most updated content and deploys it on the endpoint, to ensure that it is always protected with the latest security measures.
If you disable content updates, the agent stops retrieving them from the Cortex XSIAM tenant, and keeps working with the current content on the endpoint.
|
| Staging Content | - Enabled
- Disabled (default)
| Enable users to deploy agent staging content on selected test environments. Staging content is released before production content, allowing for early evaluation of the latest content update. |
| Content Rollout | | The Cortex XDR agent can retrieve content updates immediately as they are available, or after a pre-configured delay period. When you delay content updates, the Cortex XDR agent will retrieve the content according to the configured delay. For example, if you configure a delay period of two days, the agent will not use any content released in the last 48 hours. |
9. Agent Auto-Upgrade is disabled by default. Before enabling Auto-Update for Cortex XDR agents, make sure to consult with all relevant stakeholders in your organization.
Note
Automatic upgrades are not supported with non-persistent VDI and temporary sessions.
Note
Automatic upgrades are not supported for XDR agents running on K8s.
- Enabled
- Disabled (Default)
| |
| Automatic Upgrade Scope | - Latest agent release
- One release before the latest one
- Only maintenance releases
- Only maintenance releases in a specific version
| For One release before the latest one, Cortex XSIAM upgrades the agent to the previous release before the latest, including maintenance releases. Major releases are numbered X.X, such as release 8.0, or 8.2. Maintenance releases are numbered X.X.X, such as release 8.2.2.
For Only maintenance releases in a specific version, select the required release version.
|
| Upgrade Rollout | | For Delayed, set the delay period (number of days) to wait after the version release before upgrading endpoints. Choose a value between 7 and 45.
To control the agent auto upgrade scheduler and number of parallel upgrades in your network, configure Global Agent Settings.
Note
The delay timer starts from the date of the target agent version's availability in the tenant.
Note
Limitations in the content download process:
- When you install the Cortex XDR agent, the agent retrieves the latest content update version available. A freshly installed agent can take between five to ten minutes (depending on your network and content update settings) to retrieve the content for the first time. During this time, your endpoint is not protected.
- When you upgrade a Cortex XDR agent to a newer Cortex XDR agent version, if the new agent cannot use the content version running on the endpoint, the new content update will start within one minute in P2P, and within five minutes from Cortex XSIAM.
- 33221 (default port)
- custom port
| Cortex XSIAM deploys serverless peer-to-peer distribution to Cortex XDR agents in your LAN network by default. Within the six hour randomization window during which the Cortex XDR agent attempts to retrieve the new version, it will broadcast its peer agents on the same subnet twice: once within the first hour, and once again during the following five hours. If the agent did not retrieve the files from other agents in both queries, it will proceed to the next download source defined in your profile.
To enable P2P, you must enable UDP and TCP over the port specified for P2P Port. By default, Cortex XSIAM uses port 33221. You can change the port number, if required by your organization.
|
| Broker VM | - Select all
- Brokers
- Clusters
(only Broker VMs that are connected and configured for caching can be selected)
| (Requires Broker VM 12.0 and later)
If you have a Palo Alto Networks Broker VM in your network, you can leverage the Local Agent Settings applet to cache release upgrades and content updates. When the Broker VM is enabled and configured appropriately (refer to Activate the Local Agent Settings) , it retrieves the latest installers and content every 6 hours. The Broker VM stores them for a 24-hour retention period since an agent last asked for them.
If the files are not available on the Broker VM at the time of the request, the agent proceeds to download the files directly from the Cortex XSIAM server.
When you select multiple Broker VMs, the agent chooses a Broker VM randomly for each download request.
|
11. Define **Agent Proxy Settings**.
Select whether to **Enable** or **Disable** **Direct Server Access** for the agent when connected using a proxy.
12. Configure **Advanced Vulnerability Scanning** for periodic Active Vulnerability Analysis (AVA) scans. This option is only available for tenants that are paired with Prisma Cloud.
| Item | Options | More details |
| ------------------------------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Advanced Vulnerability Scanning | | |
| Periodic Scan | | For the default setting, select 24 Hours.
For other time frames, select Custom, and then configure the desired time frame. Where relevant, select the start day and time for the periodic scans. If you select monthly scans, you can also configure a timeout period, in hours.
|
13. Configure **Agent Operation Mode**. Three modes of operation exist:
* Kernel module-based operation, offering synchronous anti-malware protection, event collection from kernel level, and anti-lpe protection
* User Space Agent: user mode agent, for agents running Linux kernel 5.0.0 or higher, offering synchronous anti-malware and event collection from kernel level
* Neither of the above. When working in Kernel module-based operation running on an endpoint with an unsupported kernel, or installing with installation flag `--no-km` , or when working in User Space Agent mode on a Linux kernel older than 5.0.0, the agent will run in Asynchronous mode. In such cases, the anti-malware protection is asynchronous, and there is no event collection, no BTP, no EDR and no anti-lpe. This operation mode frequently shows "partially protected" endpoints. To avoid this, you can configure the profile to give preference to Kernel mode, but to switch to User Space Agent mode when the kernel module for an endpoint is not supported by a content update, and switch back when a the kernel module in use is supported in a newer content update.
Endpoints running the Cortex XDR agent in Kernel mode can now be configured to automatically fall back to User Space Agent mode when a content update does not contain a kernel module for the kernel used by an endpoint.
| Item | Options | More details |
| ---------------------------------------------------- | ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Mode | | We recommend using Kernel mode.
Danger
User Space Agent mode requires Linux kernel 5.0.0 or higher.
When Kernel mode is used, to ensure continued full protection when a kernel version is not supported by a content update, select the Enabled option.
Note
User Space Agent mode requires Linux kernel 5.0.0 or higher. Endpoints running an older Linux kernel version with this fallback enabled, will not start using User Space Agent mode, and will operate asynchronously.
When a newer content update supports the endpoint's kernel module, fallback is canceled, and Kernel mode is automatically resumed.
|
14. To save the profile, click **Create**.
What to do next
If you are ready to apply your new profile to endpoints, you do this by adding it to a policy rule. If you still need to define other profiles, you can do this later. During policy rule creation or editing, you select the endpoints to which to assign the policy. There are different ways of doing this, such as: