> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/cortex-xdr-agent-resource-usage.md).

# Cortex XDR agent resource usage

Understand Cortex XDR agent resource usage, minimum system requirements, performance factors, and troubleshooting steps for Windows, macOS, and Linux in Cortex XDR.

The Cortex XDR agent prevents threats in real time, when files and processes run. It doesn't continuously sweep the disk, so I/O stays low during normal operation. Heavy analysis, such as WildFire sandboxing and analytics, runs in the cloud rather than on the endpoint.

### Minimum system requirements

| Platform | RAM                             | Disk                             |
| -------- | ------------------------------- | -------------------------------- |
| Windows  | 2 GB minimum                    | 5 GB minimum; 20 GB recommended  |
| macOS    | 512 MB minimum                  | 5 GB minimum                     |
| Linux    | 4 GB minimum (8 GB recommended) | 10 GB available for `/opt/traps` |

These are prerequisites, not consumption figures. Requirements can change between releases, so check the requirements page for your release in the [Cortex XDR agent documentation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-docs/readme).

### What affects resource usage

* **Scans:** Periodic and on-demand malware scans use more CPU and I/O while they run. Schedule periodic scans outside working hours, and disable scheduled scans on VDI instances that are built from a scanned golden image.
* **Content and upgrade downloads:** Control network use with content bandwidth management and the number of parallel upgrades in [global agent settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/configure-global-agent-settings).
* **Running alongside another security product:** During a migration, resource usage is additive. Keep the coexistence period short. 
* **Exceptions:** Broad, preemptive exclusions for common server roles (such as Exchange, Hyper-V, or database engines) are not required. Add exceptions only when you see a specific issue.

### Troubleshoot performance

If you see high resource usage on an endpoint, collect Cortex XDR agent logs and use the troubleshooting resources for your platform in the [Cortex XDR agent documentation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-docs/readme) before contacting support.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/cortex-xdr-agent-resource-usage.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.