Cortex XDR offers two methods for agent protection on Linux endpoints; a Kernel module and a user-mode (eBPF-based) approach. To help you choose the best deployment for your environment, see the feature differences between these two modes: Cortex XDR agent admin guide
See the latest Kernel Module versions that are supported.
Cortex XDR Agent Version | ||||||
|---|---|---|---|---|---|---|
Linux Operating System | 9.0 | 8.9 | 8.8 | 8.7-CE | 8.7 | 8.3-CE |
AlmaLinux 8 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
AlmaLinux 9 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
AlmaLinux 10 | ✓ | ✓ | — | ✓ | ✓ | — |
Cortex XDR Agent Version | ||||||
|---|---|---|---|---|---|---|
Linux Operating System | 9.0 | 8.9 | 8.8 | 8.7-CE | 8.7 | 8.3-CE |
AMI 2018.03 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Amazon Linux 2 AMI | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Amazon Linux 2 AMI (aarch64) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Amazon Linux 2023 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Amazon Linux 2023 (aarch64) | ✓ | ✓ | — | — | — | — |
Cortex XDR Agent Version | ||||||
|---|---|---|---|---|---|---|
Linux Operating System | 9.0 | 8.9 | 8.8 | 8.7-CE | 8.7 | 8.3‑CE |
Debian 9 (Stretch) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Debian 10 (Buster) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Debian 10 (Buster) aarch64 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Debian 11 (Bullseye) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Debian 12 (Bookworm) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Debian 13 (Trixie) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Cortex XDR Agent Version | ||||||
|---|---|---|---|---|---|---|
Linux Operating System | 9.0 | 8.9 | 8.8 | 8.7-CE | 8.7 | 8.3-CE |
CentOS 6 (supports 6.7 and above) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
CentOS 7 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
CentOS 7.9 aarch64 | ✓ User mode agent not supported | ✓ User mode agent not supported | ✓ User mode agent not supported | ✓ User mode agent not supported | ✓ User mode agent not supported | ✓ User mode agent not supported |
CentOS 8 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
CentOS 8 aarch64 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
CentOS Stream 8 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
CentOS Stream 8 aarch64 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
CentOS Stream 9 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Cortex XDR Agent Version | ||||||
|---|---|---|---|---|---|---|
Linux Operating System | 9.0 | 8.9 | 8.8 | 8.7-CE | 8.7 | 8.3‑CE |
Fedora Server (USM only) | ✓ | ✓ | ✓ | ✓ | ✓ | — |
Cortex XDR Agent Version | ||||||
|---|---|---|---|---|---|---|
Linux Operating System | 9.0 | 8.9 | 8.8 | 8.7-CE | 8.7 | 8.3‑CE |
openSUSE Leap 15.1 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
openSUSE Leap 15.2 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
openSUSE Leap 15.3 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Cortex XDR Agent Version | |||||||
|---|---|---|---|---|---|---|---|
Linux Operating System | 9.0 | 8.9 | 8.8 | 8.7-CE | 8.7 | 8.3‑CE | |
Oracle 6 (supports 6.7 and above) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | |
Oracle 7 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | |
Oracle 8 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | |
Oracle 8 aarch64 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | |
Oracle 9 x86_64 | Release 9.3 running with RHCK user mode only from agent version 8.2 and above. Release 9.3 running with UEK kernel operates on 7.9-CE and later. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Release 9.4 and later | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | |
Oracle 9 aarch64 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | |
Oracle 10 x86_64 | ✓ | ✓ From content release 1940-22526 | ✓ From content release 1940-22526 | ✓ From content release 1940-22526 | ✓ From content release 1940-22526 | ✓ From content release 1940-22526 | |
Oracle 10 aarch64 | ✓ | ✓ From content release 1940-22526 | ✓ From content release 1940-22526 | ✓ From content release 1940-22526 | ✓ From content release 1940-22526 | ✓ From content release 1940-22526 | |
Cortex XDR Agent Version | ||||||
|---|---|---|---|---|---|---|
Linux Operating System | 9.0 | 8.9 | 8.8 | 8.7-CE | 8.7 | 8.3‑CE |
RHEL 6 (supports 6.7 and above) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
RHEL 7 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
RHEL 8 x86_64 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
RHEL 8 aarch64 | ✓ User mode agent not supported | ✓ User mode agent not supported | ✓ User mode agent not supported | ✓ User mode agent not supported | ✓ User mode agent not supported | ✓ User mode agent not supported |
RHEL 9 x86_64 RHEL 9.3 and above require 8.2 and later | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
RHEL 9 aarch64 RHEL 9.3 and above require 8.2 and later | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
RHEL 10 x86_64 | ✓ | ✓ | ✓ From agent release 8.8.1.135038 | ✓ | ✓ From agent release 8.7.1.134036 | — |
RHEL 10 aarch64 | ✓ | ✓ | ✓ From agent release 8.8.1.135038 | ✓ | ✓ From agent release 8.7.1.134036 | — |
Cortex XDR Agent Version | ||||||
|---|---|---|---|---|---|---|
Linux Operating System | 9.0 | 8.9 | 8.8 | 8.7-CE | 8.7 | 8.3‑CE |
Rocky Linux 8 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Rocky Linux 9 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Rocky Linux 10 | ✓ | ✓ | — | ✓ | ✓ | — |
Cortex XDR Agent Version | ||||||
|---|---|---|---|---|---|---|
Linux Operating System | 9.0 | 8.9 | 8.8 | 8.7-CE | 8.7 | 8.3‑CE |
Server 11 SP4 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Server 12 SP4-SP5 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Server 15 SP0-SP6 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Server 15 SP7 | ✓ | ✓ From content release 1940-22526 | ✓ From content release 1940-22526 | ✓ From content release 1940-22526 | ✓ From content release 1940-22526 | ✓ From content release 1940-22526 |
Cortex XDR Agent Version | ||||||
|---|---|---|---|---|---|---|
Linux Operating System | 9.0 | 8.9 | 8.8 | 8.7-CE | 8.7 | 8.3‑CE |
12.04 LTS | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
14.04 LTS | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
16.04 LTS | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
18.04 LTS | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
18.04 LTS aarch64 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
20.04 LTS | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
20.04 LTS aarch64 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
22.04 LTS x86_64 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
22.04 LTS aarch64 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
24.04 LTS x86_64 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
24.04 LTS aarch64 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |