Cytool for Linux
Cytool is a command-line tool integrated into the Cortex XDR agent that enables you to query and manage both basic and advanced functions of the agent.
Cytool is a command-line tool that is integrated into the Cortex XDR agent that enables you to query and manage both basic and advanced functions of the agent. Unless stated otherwise, changes you make using Cytool take effect when the agent receives the next heartbeat communication (every five minutes) from Cortex XDR.
The following table displays the Cytool options available on Linux endpoints. Where there is a password required for admin commands, this is the same password as was defined as the Uninstall Password.
Command Option
Description
adaptive_policy
Adaptive policy agent commands.
Usage: cytool adaptive_policy [<interval> <collect_stats> <recalc> <query>]
where:
interval—Sets a recalculation interval override (in seconds), or reset an override. Options are:seconds,policycollect_stats—Initiates a collection of internal statisticsrecalc—Triggers a recalculation of the adaptive policyquery—Queries the current interval and APEX
anti_malware
Perform Anti Malware related operations.
[version <query> | cache <print, status>]
Usage: cytool anti_malware <version> <cache>
where:
version— Input:querycache— Input:printstatusla, wf, and ltee are for internal use
cert_enforcement
Perform Certificate enforcement related operations.
Usage: cytool cert_enforcement <operation>
Where <operation> is one of the following:
query—Displays current enforcement statusdisable—Forcibly disables enforcementpolicy—Sets enforcement by policyimport <certificate file path>—Imports a proprietary certificate in PEM format as root CAimport clear—Clears all custom root CA certificates
checkin
Initiate check-in to the server.
Usage: cytool checkin
To verify the check in, view the check-in time on the Cortex XDR agent console.
connectivity_test
Perform a connectivity test to Cortex XDR servers.
Usage: cytool connectivity_test [request_count]
dump
Enable/disable dump generation or restore policy settings.
Usage:
cytool dump enablecytool dump disablecytool dump restore
endpoint_tags
Usage: cytool endpoint_tags <action>
where <action> can be:
add—Adds tags to the endpoint tags.remove—Removes the given tags from the list of endpoint tags.list—Displays the available endpoint tags.
For example:
cytool endpoint_tags add "tag1[,tag2,...,tagN]"cytool endpoint_tags remove "tag1[,tag2,...,tagN]"cytool endpoint_tags list
enum
Enumerate protected processes.
Usage: cytool enum
For example:
To view processes for all users including those initiated by the operating system, specify the /a option.
event_collection
Stop or start event collection status (EDR/DSE).
Usage: cytool event_collection <operation>
Options are: query, enable, disable, logstat.
health
Shows the agent status, protection level and connectivity.
-h --help
Displays the available help information
import suex
Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.
isolate stop
Release machine from network isolation.
last_checkin
Display last successful check-in time.
log
Set the log level for the desired process.
Usage: cytool log set_level <log_level> <components>
where:
<log_level> is an integer value corresponding to the log level:
0—Disable logging
1—Fatal
2—Critical
3—Error
4—Warning
5—Notice
6—Information
7—Debug
8—Trace
<components> is
allor one or more of the following agent components:authorized,pmd,cortex xdr,kproc-ctrl.
For example:
Then use the cytool log collect command to generate a support file.
log collect
Generate support file archive of all logs in a TGZ file.
persist
The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events. Use cytool persist operations to import, export, and view information stored in the local database.
Usage: cytool persist <action>
where <action>:
list—List the local databases on the endpoint.export [<database name> | <databasepath>]—Export database table to a file in the/Library/Application Support/PaloAltoNetworks/Traps/bin/directory.import [<database name> | <databasepath>] <file name>—Add records in a JSON file to the database.print <database name> | <databasepath>—Print the database, in comma-separated values (CSV) format, to the command prompt.
To view a list of all local databases, use the cytool persist list command.
queryall
The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.
reconnect
Try reconnecting to the server if communication has been disabled, or force registration with a new distribution_id.
Usage:
cytool reconnect—Reconnects the Cortex XDR agent to the management application on the server.cytool reconnect [force <distribution_id]>
runtime
Stop or start product components.
Usage: cytool runtime <action> <component>
where:
<action>—Change startup runtime action for an agent component.
Options are:
start,stop,query. The query option displays the startup status for each component.<component>—Target components for which to set the runtime action, or
allcomponents.To change the runtime action for multiple components, list them with spaces separating each component.
Options:
cortex xdr,authorized,pmd,kproc-ctrl
For example:
scan
Perform Scan operations on the endpoint.
Options: start, stop, query
startup
Enable, disable, or query the startup state of Cortex XDR agent components.
Usage: cytool startup <action> <component>
where:
<action>—Change startup action for an agent component.
Options are:
enable,disable,query.The query option displays the startup status for each component.
<component>—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are:
cortex xdr,authorized,pmd,kproc-ctrl
For example:
Last updated
Was this helpful?