> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.4-cortex-xdr-agent-admin-guide/cortex-xdr-agent-for-linux/cloud-optimized-agent-for-linux.md).

# Cloud Optimized agent for Linux

The Cloud Optimized agent type is a low-footprint Linux agent for cloud workloads, such as virtual machines and Kubernetes nodes. It provides essential runtime protection and detection while using fewer of the endpoint's resources than the Standard agent. For a comparison of agent types, see [Agent types](/cortex-xdr-agent/9.4-cortex-xdr-agent-admin-guide/introduction.md#agent-types).

The agent type is set when you install the agent and is kept when you upgrade it. To change the agent type, reinstall the agent with an installation package of the other type.

### How the Cloud Optimized agent runs

Cloud Optimized agents always run in [User Space mode](/cortex-xdr-agent/9.4-cortex-xdr-agent-admin-guide/cortex-xdr-agent-for-linux.md). They don't load a kernel module, and they collect events using eBPF. They also have restrictions that prevent the agent from over consuming the following resources:

* **Memory cap:** 350MB
* **CPU limit:** 1 core 
* **CPU request**: 0.1 core x (number of cores)

### Install a Cloud Optimized agent

Before you install, check the [Cloud Optimized requirements](/cortex-xdr-agent/9.4-cortex-xdr-agent-admin-guide/cortex-xdr-agent-for-linux/cortex-xdr-agent-for-linux-requirements.md#cortex-xdr-agent-for-linux-requirements-cloud-optimized).

1. [Create an agent installation package](/cortex-xdr/protect-your-endpoints/install-and-manage-endpoints.md) and select **Cloud Optimized** under **Agent Type**. You can create a Standalone, Kubernetes, or Helm package. Only agent versions 9.4 and later are listed.
2. Install the package the same way you install a Standard agent:
   * For virtual machines, see [Install the Cortex XDR agent for Linux](/cortex-xdr-agent/9.4-cortex-xdr-agent-admin-guide/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-linux.md).
   * For Kubernetes nodes, see [Install the Cortex XDR Agent for Kubernetes Hosts](/cortex-xdr-agent/9.4-cortex-xdr-agent-admin-guide/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-kubernetes-hosts.md).

### Verify the agent type

In the Cortex XDR tenant, go to **Inventory** → **Endpoints** → **All Endpoints**. The **Agent Type** field shows **Cloud Optimized**.

### Protection on Cloud Optimized agents

Cloud Optimized agents enforce the settings on the **Cloud Optimized** tab of Agent Settings, Malware, and Exploit profiles. You configure each tab separately.

* **Malware profiles:** The Cloud Optimized tab includes a subset of the Linux malware protection modules. For the list of modules, see [Modules by agent type](/cortex-xdr/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-malware-prevention-profiles.md#modules-by-agent-type).
* **Exploit profiles:** The Cloud Optimized tab includes all Linux exploit protection modules.
* **Agent Settings profiles:** For the settings that apply, see [Set up agent settings profiles](/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-agent-settings-profiles.md).

Exceptions apply to Cloud Optimized agents in the same way as to Standard agents.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.4-cortex-xdr-agent-admin-guide/cortex-xdr-agent-for-linux/cloud-optimized-agent-for-linux.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.