> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-linux.md).

# Cortex XDR Agent 7.9 for Linux

The Cortex XDR agent protects Linux servers by preventing known and unknown malware from running by halting any attempts to leverage software exploits and vulnerabilities to compromise the server. The agent also extends exploit and malware protection to processes that run in Linux containers. When you install the agent on a Linux server that uses containers, it automatically protects any new and existing containerized processes regardless of the container solution (for example, docker). Because Cortex XDR issues the license per Linux server, each container does not consume any additional licenses.

The protection capabilities and features that the Cortex XDR agent for Linux provide depend on the operation modes you choose to deploy the Cortex XDR agent on your Linux server:

* Kernel Mode

  Cortex XDR agent installs a Kernel module which must be compatible with the endpoint's kernel. See the list of [supported Linux Kernel versions](https://app.gitbook.com/s/fZ8QSMnkjnXpuOeuRcam/README).
* User Mode (eBPF based)

  This mode allows you to leverage the protection provided by Cortex XDR agent on Linux distributions running Kernel 5.0 and above without loading a kernel module. The Palo Alto Networks [Compatibility Matrix](https://app.gitbook.com/s/fZ8QSMnkjnXpuOeuRcam/README) provides more information about supported Linux distribution versions.

  To operate in user mode, make sure of the following:

  * In the Agent Profile, configure the **Agent Operation Mode** as **User Space**.
  * Linux agents support fallback from Kernel mode to user mode via the Agent Settings, if Kernel is not supported or cannot be loaded for other reasons.
  * If fallback from Kernel mode to user mode is not set up, then you must create and deploy the new YAML installer for Kubernetes based installations.

The following table details protection capabilities provided according to each operation mode.

| Protection Capabilities                                   | Kernel | User Mode (eBPF based) |
| --------------------------------------------------------- | :----: | :--------------------: |
| Exploit Protection                                        |    ✓   |            ✓           |
| Malware Protection                                        |    ✓   |            ✓           |
| Endpoint EDR Data Collection                              |    ✓   |            ✓           |
| Event Monitoring                                          |    ✓   |            ✓           |
| Kernel Integrity Monitoring and Kernel Module Examination |    ✓   |            —           |
| Local Privilege Escalation Protection                     |    ✓   |            —           |

The following topics describe how to install and use the Cortex XDR agent for Linux:

* Cortex XDR for Linux Requirements
* [Use the Cortex XDR Agent for Linux](/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-linux/use-the-cortex-xdr-agent-for-linux.md)
* [Uninstall the Cortex XDR Agent for Linux](/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-linux/uninstall-the-cortex-xdr-agent-for-linux.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-linux.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.