Learn more about how to control Cortex XDR agent and content upgrades.
This document covers a recommended strategy and best practices for managing agent and content updates to help reduce the risk of downtime in a production environment, while helping ensure timely delivery of security content and capabilities.
Keeping Cortex XDR agents up-to-date is essential for protecting against evolving threats and vulnerabilities. Regular updates ensure the latest security features for malware and exploit prevention, and compatibility with the latest software environments, which helps reduce the risk of attacks. This can also help organizations meet regulatory standards while maintaining strong overall protection.
Content updates, such as new threat intelligence or detection logic, are critical for defending against newly discovered cyber threats and malware and are designed to ensure that systems remain protected against the latest attacks. Content updates address compatibility issues as well, helping achieve smooth operations alongside the Cortex XDR agent. Without regular content updates, security solutions may fail to detect new or evolving threats, leaving systems vulnerable to attacks.
Important
When planning Cortex XDR agent upgrades and content updates, consult with the appropriate stakeholders and teams and follow the change management strategy in your organization.
The Cortex XDR agent can retrieve content updates immediately as they become available, after a pre-configured delay period of up to 30 days, or you can choose to select a specific version.
Cortex XDR can be configured to manage the deployment of agent and content updates by adjusting the following settings:
AGENT UPGRADE SETTINGS
Agent settings per endpoint:
Agent Auto-Upgrade is disabled by default. Before enabling agent auto-upgrade for Cortex XDR agents, make sure to consult with all relevant stakeholders in your organization. Enabling this option allows you to define the scope of the automatic updates, such as upgrading to the latest agent release, one release prior, only maintenance releases, or maintenance releases within a specific version.
Upgrade Rollout includes two options: Immediate, where the Cortex XDR agent automatically receives new releases, including maintenance updates and features, and Delayed, which lets you set a delay of 7 to 45 days after a version is released before upgrading endpoints.
Global agent settings: Configure the Cortex XDR agent upgrade scheduler and the number of parallel upgrades to apply to all endpoints in your organization. You can also schedule the upgrade task for specific days of the week and set a specific time range for the upgrades.
CONTENT UPDATE SETTINGS
Content updates per endpoint:
Content Auto-Update is enabled by default and automatically retrieves the latest content before deploying it on the endpoint. If you disable content updates, the agent will stop fetching updates from the Cortex XDR tenant and will continue to operate with the existing content on the endpoint.
Content Rollout: The Cortex XDR agent can retrieve content updates immediately as they become available, after a pre-configured delay period of up to 30 days, or you can choose to select a specific version.
Global content updates: Configure the content update cadence and bandwidth allocation within your organization. To enforce immediate protection against the latest threats, enable minor content updates. Otherwise, the content updates in your network occur only on major releases.
Guidelines for planning Cortex XDR agent upgrades
Use a phased rollout plan by creating batches for deploying updates. The specifics may vary based on your organization and its structure. Start with a control group, then deploy to 10% of your organization. Subsequently, allocate the remaining upgrades in batches that best suit your organization until achieving a full 100% rollout.
The following is an example of a rollout plan for deploying a Cortex XDR agent upgrade:
Phase 1: Control group rollout: Start by selecting a control group of endpoints as early adopters. This group should consist of a diverse range of operating systems, devices, applications, and servers, with a focus on low-risk endpoints. After a defined testing period, such as one week, assess for any issues. If no problems are found, move to the next phase.
Phase 2: 10% rollout: Expand the rollout to 10% of the organization’s endpoints. This group should maintain the same variety as the control group but include low- to medium-risk endpoints. Monitor performance during the set period. If the rollout is successful with no issues, proceed to the next phase.
Phase 3: 40% rollout: After confirming the success of the 10% rollout, extend the deployment to 40% of the organization. Continue including a variety of endpoints while gradually incorporating some medium-risk endpoints. Ensure thorough testing during this phase before moving forward.
Phase 4: 80% rollout: Extend the deployment to 80% of the organization's endpoints. This batch should include a wide variety of endpoints, incorporating both medium and high-risk systems. After a careful monitoring period and confirmation that everything is stable, move to the final phase.
Phase 5: Full rollout: Complete the rollout by updating the remaining 20% of the organization’s endpoints. By this point, the majority of systems should have been thoroughly tested, reducing the risk of issues in the final stage. Once complete, 100% of the organization will be updated.
Guidelines for planning content updates
Content updates are typically provided on a weekly basis. Use a phased rollout plan by creating batches for deploying updates. Start with a control group, then deploy to 10% of your organization. Subsequently, allocate the remaining upgrades in batches that best suit your organization until achieving a full 100% rollout.
The following is an example of a rollout plan over a period of one week for deploying content updates:
Phase 1: Control group rollout: Keep the default configuration set to deploy content updates immediately.
Phase 2: 10% rollout: Content is automatically deployed on day 2 following a delay period defined in the profile.
Phase 3: 60% rollout: Content is automatically deployed on day 3 following a delay period defined in the profile.
Phase 4: Full rollout: Increase the deployment to include medium and high-risk systems, until the entire organization is updated.
How to configure agent and content update settings
The following information will help you select and configure the update settings.
Cortex XDR agent upgrades
Configure one or more of the settings described in this section to keep your Cortex XDR agents up-to-date.
Content updates
When a new content update is available, Cortex XDR notifies the Cortex XDR agent. The Cortex XDR agent then randomly chooses a time within a six-hour window during which it will retrieve the content update from Cortex XDR. By staggering the distribution of content updates, Cortex XDR reduces the bandwidth load and prevents bandwidth saturation due to the high volume and size of the content updates across many endpoints. You can view the distribution of endpoints by content update version from the dashboard.
You can configure whether to update content per endpoint or use the global settings. The information in this topic will help you select and configure these methods.