> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.9/cortex-xdr-agent-for-linux/cortex-xdr-agent-for-linux-requirements.md).

# Cortex XDR Agent for Linux Requirements

<table data-search="false"><thead><tr><th width="260.25">Requirement</th><th>Minimum specification</th></tr></thead><tbody><tr><td>Processor</td><td>Processor 2.3 GHz dual-core processor</td></tr><tr><td>RAM</td><td>4GB; 8GB recommended</td></tr><tr><td>Hard disk space</td><td>10 GB (available for the /opt/traps directory)</td></tr><tr><td>Architecture</td><td>x86_64 (x86 64bit) For aarch64 (ARM 64 bit) see <a href="/pages/vdYaD27InyPUiqR6fx22">Cortex XDR Agent for Linux Requirements</a> for details.</td></tr><tr><td>Operating system versions</td><td>See the <a href="/spaces/fZ8QSMnkjnXpuOeuRcam/pages/3efdc5ba88af9029f120242a51e879a655b6e31b">Cortex XDR Compatibility Matrix</a>.</td></tr><tr><td>Kernel version</td><td><strong>Kernel Mode</strong> On Linux endpoints, to perform malware analysis of Executable and Linkable Format (ELF) files and collect data for endpoint detection and response (EDR) and behavioral threat analysis, the Cortex XDR agent requires one of the Linux Kernels that are listed in <a href="/spaces/y29o8lwSBpbfPbvztsyt/pages/5owoDAWGuwzAovtOflFJ">supported Kernel Module Versions</a>. If you deploy the Cortex XDR agent on a Linux server that is not running one of the kernel versions required for these additional protection capabilities, the agent will operate in asynchronous mode. <strong>User Space Mode</strong> User Space operation mode is supported from Cortex XDR agent version 7.7 User space operation mode requires Kubernetes node to run one of the supported operation systems with Kernel version 5.0 or later.</td></tr><tr><td>Software packages</td><td><p>The following software packages are required to be installed on your endpoint, depending on the operating system.</p><ul><li>Verify that you have standard Unix programs installed.</li><li>ca-certificates</li><li><p>All Distributions require openssl 1.0.0 or a later release.</p><ul><li>In addition, SLES 11 requires openssl-certs</li><li>In addition, SLES 12 and 15 require ca-certificates</li></ul></li><li>glibc—Required for exploit protection of containerized processes using the ROP Mitigation and Brute Force Protection modules. If glibc is not installed, these modules are disabled but all other exploit and malware protection functionality work as expected.</li><li>CentOS 6.10—Enable the dynamic CA instead of the legacy CA: 1. Enable the dynamic CA configuration: <code>update-ca-trust force-enable</code> 2. Import the certificates: <code>cp XDR-certificate.crt /etc/pki/ca-trust/source/anchors/.</code> 3. Rebuild the certificate database: <code>update-ca-trust extract</code></li><li>For systems with SELinux enabled in enforcing or permissive mode, see the Required Packages table below.</li></ul></td></tr><tr><td>Networking</td><td><ul><li>Allow communication on the TCP port from the Cortex XDR agent to the server (the default is port 443).</li><li>Allow your Cortex management console and Cortex XDR agent to communicate with external and internal resources required for enforcing endpoint protection. For more information, see Enable Access to Required PANW Resources in the applicable Cortex product documentation.</li></ul></td></tr></tbody></table>

#### Required packages

<table data-search="false"><thead><tr><th>Operating System</th><th width="479">Packages</th></tr></thead><tbody><tr><td>RHEL 6, CentOS 6, CentOS Stream 6, Oracle Linux 6, AlmaLinux 6, Rocky Linux 6</td><td>policycoreutils-python</td></tr><tr><td>RHEL 7, CentOS 7, CentOS Stream 7, Oracle Linux 7, AlmaLinux 7, Rocky Linux 7</td><td>policycoreutils-python selinux-policy-devel selinux-policy-targeted</td></tr><tr><td>RHEL 8/9, CentOS 8/9, CentOS Stream 8/9, Oracle Linux 8/9, AlmaLinux 8/9, Rocky Linux 8/9</td><td>policycoreutils-python-utils selinux-policy-devel selinux-policy-targeted</td></tr><tr><td>Amazon Linux 1</td><td>policycoreutils-python, selinux-policy</td></tr><tr><td>Amazon Linux 2</td><td>policycoreutils-python, selinux-policy-devel</td></tr><tr><td>Amazon Linux 2023</td><td>policycoreutils-python-utils, selinux-policy-devel</td></tr><tr><td>TencentOS</td><td>policycoreutils-python-utils, selinux-policy-devel</td></tr><tr><td>Fedora Server</td><td>policycoreutils-python-utils, selinux-policy-devel</td></tr><tr><td>SLES and openSUSE</td><td>policycoreutils-python, selinux-policy-devel</td></tr><tr><td>Mariner</td><td>policycoreutils-python-utils, selinux-policy-devel</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.9/cortex-xdr-agent-for-linux/cortex-xdr-agent-for-linux-requirements.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.