Cortex XDR Agent

Cortex XDR Agent at a glance

Cortex XDR Agent is the endpoint component of Palo Alto Networks' Cortex XDR platform. It runs on Windows, macOS, Linux, and Android, combining traditional malware protection with behavior-based exploit and ransomware prevention plus EDR capabilities such as process and network telemetry. System administrators use it to centrally monitor endpoints through a management console, investigate alerts, and trigger automated response actions.

The vendor ships both larger major/minor agent releases and separate, more frequent content or analytics updates (detection rules, BIOCs) that are rolled out independently of the agent version. In addition, there are Critical Environment (CE) lines based on an existing, already stable agent branch that receive only security and critical bug fixes throughout their support lifecycle.

When updating, note that new agent versions are typically rolled out via the central management console and should be validated in a test environment before broad deployment, since kernel modules and drivers integrate deeply with the operating system on endpoints. The support status of each release line should also be tracked, as older versions stop receiving security updates once their support period ends.