> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/endpoint-isolation-and-live-terminal.md).

# Endpoint isolation and live terminal

Isolate endpoints and investigate them with Live Terminal in Cortex XDR.

### Isolate an endpoint

Isolation blocks all network traffic on the endpoint except communication with Cortex XDR. This stops lateral movement and data exfiltration while you keep full control of the agent. DHCP and DNS remain allowed.

| Platform | Requirements                                                                                         |
| -------- | ---------------------------------------------------------------------------------------------------- |
| Windows  | Agent 6.0 or later. VDI requires an isolation allow list.                                            |
| macOS    | Agent 7.3 or later and macOS 10.15.4 or later. The Cortex network extension must be enabled.         |
| Linux    | Agent 7.7 or later, `iptables` and `ip6tables`, required kernel options, and an isolation allow list |
| iOS      | Agent 9.1 or later on supervised devices with Network Shield enabled. Android is not supported.      |

Isolate an endpoint manually from the endpoint, issue, or case, or automatically from a playbook or automation rule. The request reaches the agent at its next heartbeat. Isolated endpoints can't receive agent upgrades. See [Isolate an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/isolate-an-endpoint).

### Investigate with Live Terminal

Live Terminal opens a secure remote session to the endpoint, with no third-party remote-access tool required.

* **File Explorer:** Browse, download, delete, or move files, and check file hashes and verdicts. Network drives are not supported.
* **Task Manager:** View processes, and terminate, suspend, or resume processes or process trees.
* **Command Line:** Run operating-system commands and scripts. Each command runs independently.
* **Python:** Run Python 3 commands and scripts.
* **File transfer:** Download files up to 200 MB and upload files up to 40 MB.

Live Terminal commands are recorded in the management audit log. See [Initiate a Live Terminal session](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/initiate-a-live-terminal-session).

### Other response actions

You can also run scripts, scan for malware, search for and destroy files, and quarantine or restore files.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/endpoint-isolation-and-live-terminal.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.