> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/cortex-xdr-agent-migration.md).

# Cortex XDR agent migration

Plan a phased migration to the Cortex XDR agent in Cortex XDR, including compatibility checks, rollout, validation, and rollback.

You can move to the Cortex XDR agent without a protection gap by running it alongside your existing product for a short period, then removing the legacy agent. Use the following phased approach and adapt the batch sizes to your environment.

### Before you start

1. Confirm that your endpoint operating systems are supported. See [Where can I install the Cortex XDR agent?](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/where-can-i-install-the-cortex-xdr-agent).
2. Check the existing product against [Cortex XDR agent compatibility with third-party security products](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr-agent-compatibility-with-third-party-security-products). This page lists tested products and any required actions. Products that aren't listed have not been compatibility-tested by Palo Alto Networks; test them internally before broad deployment.
3. Allow the network access that the Cortex XDR agent requires, and size content-update bandwidth in [global agent settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/configure-global-agent-settings).

### Phased rollout

| Phase        | Scope                                                                  | Goal                                                                                                                   |
| ------------ | ---------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| 1. Pilot     | A small group of representative endpoints                              | Validate application compatibility with prevention profiles in report mode, where available, or with a limited policy. |
| 2. Expansion | A larger group across departments, operating systems, and server roles | Tune exceptions for business applications.                                                                             |
| 3. Enforce   | Endpoints that completed validation                                    | Switch security profiles to **Block** (prevention) mode.                                                               |
| 4. Cutover   | Endpoints in prevention mode                                           | Uninstall the legacy agent.                                                                                            |

Repeat phases 2–4 in batches until all endpoints are migrated.

{% hint style="info" %}
While both agents run, CPU and memory usage are additive. Keep each batch's coexistence period short (for example, one to two weeks), and uninstall the legacy product once the batch is validated.
{% endhint %}

### Validate

* Confirm Cortex XDR agent health and status in **All Endpoints**.
* Review issues raised during the pilot, and add exceptions only for confirmed false positives. See [Exception configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/exception-configuration).

### Roll back

If you need to stop the migration, you can uninstall Cortex XDR agents in bulk from the console. See [Uninstall the Cortex XDR agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/uninstall-the-cortex-xdr-agent). Cortex XDR agent installation, upgrade, and uninstallation normally don't require a reboot.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/cortex-xdr-agent-migration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.