> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/installation-workflows.md).

# Installation workflows

Install Cortex CLI for security scans in Cortex XSIAM.

Choose the installation workflow that fits your environment.

[Before installing the CLI, complete the prerequisites.](/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli.md#prerequisites)

## Install through a package manager

Using a package manager is the recommended method for installing the Cortex CLI. Use `Homebrew` for macOS and Linux, or `Scoop` for Windows.

### Homebrew for macOS and Linux

Supported on macOS, Apple Silicon and Intel, and Linux, x86\_64 and arm64.

Requires [Homebrew](https://brew.sh/).

#### Standard installation

```programlisting
brew tap paloaltonetworks/cortexcli
brew install cortexcli
cortexcli --version
```

#### Pin a specific version (optional)

If your workflow requires a specific version, use one of these methods.

**Pin a release line**

For example, stay on the `0.18.x` release line.

This locks the CLI to a minor version. Security patches continue automatically.

```programlisting
brew install cortexcli@0.18
# keg-only — add to PATH if needed:
echo 'export PATH="$(brew --prefix cortexcli@0.18)/bin:$PATH"' >> ~/.zprofile
```

**Pin an exact version**

For example, install exactly `0.18.0`.

This locks the CLI to one build. It prevents automatic updates.

### Scoop for Windows

Supported on Windows x64.

Requires [Scoop](https://scoop.sh/).

#### Standard installation

```programlisting
scoop bucket add cortexcli https://github.com/PaloAltoNetworks/homebrew-cortexcli
scoop install cortexcli
cortexcli --version
```

#### Install a specific version (optional)

If your workflow requires a specific version, use:

```programlisting
scoop install cortexcli@0.18.0
```

## Manual download

You can manually download the binaries for macOS, Linux, or Windows.

Download the archive from the [releases page](https://github.com/PaloAltoNetworks/homebrew-cortexcli/releases). Verify it against `SHA256SUMS`, then extract it.

| Step              | macOS / Linux                                             | Windows                                                                                  |
| ----------------- | --------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| **Download**      | Download the `.tar.gz` archive for your architecture      | Download the `.zip` archive                                                              |
| **Extract**       | The executable is named `cortexcli`                       | The executable is named `cortexcli.exe`                                                  |
| **Add to `PATH`** | Move `cortexcli` to a directory such as `/usr/local/bin/` | Move `cortexcli.exe` to a dedicated folder. Add that folder to **Environment Variables** |

## UI-based installation

Install the CLI directly from your Cortex tenant. The UI generates a tenant-specific command that downloads and authenticates the binary.

{% stepper %}
{% step %}

### Generate the installation command

1. Navigate to **Settings** → **Data Sources** → **+ Data Source**.
2. Search for **Cortex CLI**.
3. Select **Connect** or **Connect Another Instance** on the Cortex CLI card.
4. In **Configure**, select your operating system. Then click **Next**.
5. In **Authenticate**, generate an API key.
   * Select **With upload results permissions** to create a **CLI View/Edit** role.
   * Otherwise, the key receives a **CLI Read Only** role with **CLI View** permissions.

{% hint style="info" %}
The Cortex CLI requires an API key with the `Standard` security level.
{% endhint %}

6. Save the generated **API Key ID** and **API key**.
7. Copy the command from **Retrieve your API key**.

{% hint style="info" %}
On macOS ARM64, unpack the download to access the executable.
{% endhint %}

8. Verify the key appears in the API Keys inventory.
   {% endstep %}

{% step %}

### Download the CLI

Before you run the command, replace any placeholders with your credentials:

1. Replace `${API_KEY}` with the saved API key.
2. If needed, copy the API URL from **Settings** → **Configurations** → **API Keys**.
3. Paste the completed command into your terminal. Then press Enter.

The generated command follows this syntax:

```programlisting
curl -k -u $CORTEX_API_ID::$CORTEX_API_KEY --output ./cortexcli $CORTEX_FQDN/api/v2/remote-li/{version}/{platform}/artifacts
```

This securely connects to your specific Cortex tenant (`$CORTEX_FQDN`) and downloads the `cortexcli` application directly to your current folder.
{% endstep %}

{% step %}

### Make the CLI executable

On macOS and Linux, allow the downloaded binary to run:

```programlisting
chmod +x cortexcli
```

{% endstep %}

{% step %}

### Verify the installation

Run the command that matches the binary location:

{% tabs %}
{% tab title="On your PATH" %}

```programlisting
cortexcli -v
```

{% endtab %}

{% tab title="Current directory" %}

```programlisting
./cortexcli -v
```

{% endtab %}
{% endtabs %}

If the terminal displays a version, return to Cortex Cloud and click **Done**.
{% endstep %}
{% endstepper %}

Configure credentials before running scans. See [Authenticate credentials](/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/authenticate-credentials.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/installation-workflows.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.