> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/cortex-xdr-agent-linux-operation-modes.md).

# Cortex XDR agent Linux operation modes

Compare Cortex XDR agent Kernel Mode and User Space (eBPF) operation modes for Linux endpoints in Cortex XDR.

The Cortex XDR agent combines lightweight kernel-level visibility, user-space processing, and cloud analysis. Heavy analysis, such as WildFire sandboxing and analytics baselining, runs in the cloud, not on the endpoint.

On Linux, you choose how the Cortex XDR agent collects data and enforces protection.

|                                                                                               | Kernel Mode                                                                                              | User Space (eBPF)                                           |
| --------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- |
| How it works                                                                                  | Loads a kernel module compatible with the endpoint kernel                                                | Uses eBPF; no Cortex kernel module is loaded                |
| Exploit and malware protection, EDR data collection                                           | Yes                                                                                                      | Yes                                                         |
| Kernel integrity monitoring, kernel module examination, local privilege escalation protection | Yes                                                                                                      | No                                                          |
| Requirements                                                                                  | Supported kernel module for your distribution. With UEFI Secure Boot, enroll the Cortex XDR certificate. | Cortex XDR agent 7.7 or later and Linux kernel 5.0 or later |

To use eBPF, set **Agent Operation Mode** to **User Space** in the Linux Agent Settings profile. You can also configure Kernel Mode Cortex XDR agents to fall back to User Space when a compatible kernel module isn't available. If neither mode's requirements are met, the Cortex XDR agent runs in asynchronous mode.

For hardware and package requirements, see the Linux requirements in the [Cortex XDR agent documentation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-docs/readme).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/cortex-xdr-agent-linux-operation-modes.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.