Set up agent settings profiles - Administrator Guide - Cortex XDR - Cortex - Security Operations

Tray Icon

Choose whether you want the Cortex XDR agent icon to be Visible or Hidden in the notification area (system tray).

XDR Agent Console Access

When enabled, allows access to Cortex XDR.

XDR Agent User Notifications

Enable this option to operate display notifications in the notifications area on the endpoint. When you enable notifications, you can use the default notification messages that are displayed for each option, or provide custom text for each notification type. You can also customize a notification footer. Options include:

Service Protection

Protects against stopping agent services. When this protection is enabled, agent services won't accept operating system stop requests.

Process Protection

Protects against attempts to tamper with agent processes; injecting into them, terminating them, reading, or writing into their virtual memory.

File Protection

Protects against attempts to tamper with agent files; deleting, replacing, renaming, moving, or writing files/directories.

Registry Protection

Protects against attempts to tamper with agent registry settings and agent policies, such as deleting, adding, and renaming registry keys or values which belong to the agent.

Pipe Protection

Protects against attempts to tamper with the agent's pipe-based inter-process communication (IPC) mechanism.

Windows Security Integration

Enabled

The Cortex XDR agent registers with the Windows Security Center as an official Antivirus (AV) software product. As a result, Windows automatically shuts down Microsoft Defender on the endpoint, except for endpoints that are running Windows Server versions.

To avoid performance issues, Palo Alto Networks recommends that you disable or remove Windows Defender from Windows Server-based endpoints where the Cortex XDR agent is installed.

Enabled No Patches

(Traps 5.0 release only) Select this option if you want to register the agent with the Windows Security Center, but prevent Windows from automatically installing Meltdown/Spectra vulnerability patches on the endpoint.

Disabled

The Cortex XDR agent does not register with the Windows Action Center. As a result, Windows Action Center might indicate that virus protection is off, depending on other security products that are installed on the endpoint.

Alert Data Dump File Size

The Full option creates the largest and most complete set of information.

Automatically Upload Alert Data Dump File

During event investigation, if automatic upload was disabled, you can still manually retrieve this data.

Monitor and Collect Enhanced Endpoint Data

(Not supported in Traps 5.0.x)

By default, the Cortex XDR agent collects information about events that occur on the endpoint. If you enable Behavioral Threat Protection in a Malware security profile, the Cortex XDR agent also collects information about all active file, process, network, and registry activity on an endpoint. When you enable the Cortex XDR agent to monitor and collect enhanced endpoint data, Cortex XDR shares the detailed endpoint information with other Cortex apps. The information can help to provide the endpoint context when a security event occurs, so that you can gain insight into the overall event scope during an investigation. The event scope includes all activities that took place during an attack, the endpoints that were involved, and the damage caused. When disabled, the Cortex XDR agent will not share endpoint activity logs.

Enable Host Insights Capabilities

When enabled, the various host insight capabilities can be configured.

Endpoint Information Collection

When enabled, the Cortex XDR agent collects host inventory information such as users, groups, services, drivers, hardware, and network shares, as well as information about applications installed on the endpoint, including CVE and installed KBs for Vulnerability Assessment.

File Search and Destroy Action Mode

(Not supported in Traps 5.0.x)

When enabled, the Cortex XDR agent collects detailed information about files on the endpoint to create a files inventory database. The agent locally monitors any actions performed on these files and updates the local files inventory database in real-time.

With this option you can also select the File Search and Destroy Monitored File Types where Cortex XDR monitors all the files on the endpoint, or only common file types. If you choose Common file types, Cortex XDR monitors the following file types:

bin, msi, doc, docx, docm, rtf, xls, xlsx, xlsm, pdf, ppt, pptx, pptm, ppsm, pps, ppsx, mpp, mppx, vsd, xsdx and wsf.

A hash will also be computed for these file types: zip, pe, and ole.

File size is limited to 30 MB by default. Searches of files larger than 30 MB by hash are not supported.

Additionally, you can exclude files that exist under a specific local path on the endpoint from inclusion in the files database.

XDR Cloud

If you set this to Enabled in the profile, any agent using this profile will be treated as if it is a cloud-based agent for licensing purposes.

Shadowcopy Activation

When enabled, the Cortex XDR agent automatically turns on the system protection of the endpoint. This ensures that the data is backed up and may be recovered in cases of any security breaches or loss of data.

Disk Space Limitation

Disk space in MB

Limits the amount of disk space in MB that can be used for endpoint data backup.

Content Auto-update

By default, the Cortex XDR agent always retrieves the most updated content and deploys it on the endpoint, to ensure that it is always protected with the latest security measures.

If you disable content updates, the agent stops retrieving them from the Cortex XDR tenant, and keeps working with the current content on the endpoint.

Content Rollout

The Cortex XDR agent can retrieve content updates immediately as they are available, or after a pre-configured delay period. When you delay content updates, the Cortex XDR agent will retrieve the content according to the configured delay. For example, if you configure a delay period of two days, the agent will not use any content released in the last 48 hours.

Automatic Upgrade Scope

For One release before the latest one, Cortex XDR upgrades the agent to the previous release before the latest, including maintenance releases. Major releases are numbered X.X, such as release 8.0, or 8.2. Maintenance releases are numbered X.X.X, such as release 8.2.2.

For Only maintenance releases in a specific version, select the required release version.

Upgrade Rollout

For Delayed, set the delay period (number of days) to wait after the version release before upgrading endpoints. Choose a value between 7 and 45.

To control the agent auto upgrade scheduler and number of parallel upgrades in your network, configure Global Agent Settings.

P2P

Cortex XDR deploys serverless peer-to-peer distribution to Cortex XDR agents in your LAN network by default. Within the six hour randomization window during which the Cortex XDR agent attempts to retrieve the new version, it will broadcast its peer agents on the same subnet twice: once within the first hour, and once again during the following five hours. If the agent did not retrieve the files from other agents in both queries, it will proceed to the next download source defined in your profile.

To enable P2P, you must enable UDP and TCP over the port specified for P2P Port. By default, Cortex XDR uses port 33221. You can change the port number, if required by your organization.

Broker VM

(only Broker VMs that are connected and configured for caching can be selected)

(Requires Broker VM 12.0 and later)

If you have a Palo Alto Networks Broker VM in your network, you can leverage the Local Agent Settings applet to cache release upgrades and content updates. When the Broker VM is enabled and configured appropriately (refer to Activate the Local Agent Settings) , it retrieves the latest installers and content every 15 minutes. The Broker VM stores them for a 30-day retention period since an agent last asked for them.

If the files are not available on the Broker VM at the time of the request, the agent proceeds to download the files directly from the Cortex XDR server.

When you select multiple Broker VMs, the agent chooses a Broker VM randomly for each download request.

Action Mode

When Enabled, a domain controller (DC) test checks whether the device is connected to the internal network or not. If the device is connected to the internal network, it is determined to be in the organization. If the DC test fails or returns an external domain, Cortex XDR performs a DNS connectivity test.

DNS Name

Your network's DNS name

The Cortex XDR agent tests network location by submitting a Domain Name Server (DNS) name that is known only to the internal network. If the DNS returns the pre-configured internal IP address, the device is determined to be within the organization. If the DNS IP address cannot be resolved, the device is deemed to be located elsewhere.

Certificate Enforcement

When enabled, certificate enforcement is enabled.

When set to Disabled (Notify), Cortex XDR agents with this policy will trigger a banner in the server to notify customers about potential risk, and will direct them to change the certificate and the setting. The Last Certificate Enforcement Fallback column of the All Endpoints table is updated, and management audit logs related to the local store fallback are received by the server.

When set to Disabled, Cortex XDR agents with this policy will trigger a banner in the server to notify customers about potential risk, and will direct them to change the certificate and the setting. The Last Certificate Enforcement Fallback column of the All Endpoints table is not updated, and no management audit logs related to the local store fallback are received by the server.

Tray Icon

Choose whether you want the Cortex XDR agent icon to be Visible or Hidden in the notification area (system tray).

XDR Agent Console Access

When enabled, allows access to Cortex XDR.

XDR Agent User Notifications

Enable this option to operate display notifications in the notifications area on the endpoint. When you enable notifications, you can use the default notification messages that are displayed for each option, or provide custom text for each notification type. You can also customize a notification footer. Options include:

Alert Data Dump File Size

The Full option creates the largest and most complete set of information.

Automatically Upload Alert Data Dump File

During event investigation, if automatic upload was disabled, you can still manually retrieve this data.

Monitor and Collect Enhanced Endpoint Data

(Not supported in Traps 5.0.x)

By default, the Cortex XDR agent collects information about events that occur on the endpoint. If you enable Behavioral Threat Protection in a Malware security profile, the Cortex XDR agent also collects information about all active file, process, network, and registry activity on an endpoint. When you enable the Cortex XDR agent to monitor and collect enhanced endpoint data, Cortex XDR shares the detailed endpoint information with other Cortex apps. The information can help to provide the endpoint context when a security event occurs, so that you can gain insight into the overall event scope during an investigation. The event scope includes all activities that took place during an attack, the endpoints that were involved, and the damage caused. When disabled, the Cortex XDR agent will not share endpoint activity logs.

Enable Host Insights Capabilities

When enabled, the various host insight capabilities can be configured.

Endpoint Information Collection

When enabled, the Cortex XDR agent collects Host Inventory information such as users, groups, services, drivers, hardware, and network shares, as well as information about applications installed on the endpoint, including CVE and installed KBs for Vulnerability Assessment.

File Search and Destroy Action Mode

(Not supported in Traps 5.0.x)

When enabled, the Cortex XDR agent collects detailed information about files on the endpoint to create a files inventory database. The agent locally monitors any actions performed on these files and updates the local files inventory database in real-time.

With this option you can also select the File Search and Destroy Monitored File Types where Cortex XDR monitors all the files on the endpoint, or only common file types. If you choose Common file types, Cortex XDR monitors the following file types:

acm, apk, ax, bat, bin, bundle, csv, dll, dmg, doc, docm, docx, dylib, efi, hta, jar, js, jse, jsf, lua, mpp, mppx, mui, o, ocx, pdf, pkg, pl, plx, pps, ppsm, ppsx, ppt, pptm, pptx, py, pyc, pyo, rb, rtf, scr, sh, vds, vsd, wsf, xls, xlsm, xlsx, xsdx, and zip.

Additionally, you can exclude files that exist under a specific local path on the endpoint from inclusion in the files database.

XDR Cloud

If you set this to Enabled in the profile, any agent using this profile will be treated as if it is a cloud-based agent for licensing purposes.

Time Machine Activation

When enabled, this option automatically turns on the Time Machine setting of the endpoint. This ensures that the data is backed up and may be recovered in cases of any security breaches or loss of data.

Content Auto-update

By default, the Cortex XDR agent always retrieves the most updated content and deploys it on the endpoint, to ensure that it is always protected with the latest security measures.

If you disable content updates, the agent stops retrieving them from the Cortex XDR tenant, and keeps working with the current content on the endpoint.

Content Rollout

The Cortex XDR agent can retrieve content updates immediately as they are available, or after a pre-configured delay period. When you delay content updates, the Cortex XDR agent will retrieve the content according to the configured delay. For example, if you configure a delay period of two days, the agent will not use any content released in the last 48 hours.

Agent Auto-Upgrade

Automatic Upgrade Scope

For One release before the latest one, Cortex XDR upgrades the agent to the previous release before the latest, including maintenance releases. Major releases are numbered X.X, such as release 8.0, or 8.2. Maintenance releases are numbered X.X.X, such as release 8.2.2.

For Only maintenance releases in a specific version, select the required release version.

Upgrade Rollout

For Delayed, set the delay period (number of days) to wait after the version release before upgrading endpoints. Choose a value between 7 and 45.

To control the agent auto upgrade scheduler and number of parallel upgrades in your network, configure Global Agent Settings.

Select all

When selected, all download source options are enabled.

P2P

Cortex XDR deploys serverless peer-to-peer distribution to Cortex XDR agents in your LAN network by default. Within the six hour randomization window during which the Cortex XDR agent attempts to retrieve the new version, it will broadcast its peer agents on the same subnet twice: once within the first hour, and once again during the following five hours. If the agent did not retrieve the files from other agents in both queries, it will proceed to the next download source defined in your profile.

To enable P2P, you must enable UDP and TCP over the port specified for P2P Port. By default, Cortex XDR uses port 33221. You can change the port number, if required by your organization.

Broker VM

(only Broker VMs that are connected and configured for caching can be selected)

(Requires Broker VM 12.0 and later)

If you have a Palo Alto Networks Broker VM in your network, you can leverage the Local Agent Settings applet to cache release upgrades and content updates. When the Broker VM is enabled and configured appropriately (refer to Activate the Local Agent Settings) , it retrieves the latest installers and content every 15 minutes. The Broker VM stores them for a 30-day retention period since an agent last asked for them.

If the files are not available on the Broker VM at the time of the request, the agent proceeds to download the files directly from the Cortex XDR server.

When you select multiple Broker VMs, the agent chooses a Broker VM randomly for each download request.

Action Mode

When Enabled, a domain controller (DC) test checks whether the device is connected to the internal network or not. If the device is connected to the internal network, it is determined to be in the organization. If the DC test fails or returns an external domain, Cortex XDR performs a DNS connectivity test.

DNS Name

Your network's DNS name

The Cortex XDR agent tests network location by submitting a Domain Name Server (DNS) name that is known only to the internal network. If the DNS returns the pre-configured internal IP address, the device is determined to be within the organization. If the DNS IP address cannot be resolved, the device is deemed to be located elsewhere.

IP Address

Your network's DNS internal IP address

Enter the internal DNS IP address to be used by the DNS test.

Certificate Enforcement

When enabled, certificate enforcement is enabled.

When set to Disabled (Notify), Cortex XDR agents with this policy will trigger a banner in the server to notify customers about potential risk, and will direct them to change the certificate and the setting. The Last Certificate Enforcement Fallback column of the All Endpoints table is updated, and management audit logs related to the local store fallback are received by the server.

When set to Disabled, Cortex XDR agents with this policy will trigger a banner in the server to notify customers about potential risk, and will direct them to change the certificate and the setting. The Last Certificate Enforcement Fallback column of the All Endpoints table is not updated, and no management audit logs related to the local store fallback are received by the server.

Alert Data Dump File Size

The Full option creates the largest and most complete set of information.

Automatically Upload Alert Data Dump File

During event investigation, if automatic upload was disabled, you can still manually retrieve this data.

Monitor and Collect Enhanced Endpoint Data

(Not supported in Traps 5.0.x)

By default, the Cortex XDR agent collects information about events that occur on the endpoint. If you enable Behavioral Threat Protection in a Malware security profile, the Cortex XDR agent also collects information about all active file, process, network, and registry activity on an endpoint. When you enable the Cortex XDR agent to monitor and collect enhanced endpoint data, Cortex XDR shares the detailed endpoint information with other Cortex apps. The information can help to provide the endpoint context when a security event occurs, so that you can gain insight into the overall event scope during an investigation. The event scope includes all activities that took place during an attack, the endpoints that were involved, and the damage caused. When disabled, the Cortex XDR agent will not share endpoint activity logs.

Enable Host Insights Capabilities

When enabled, the various host insight capabilities can be configured.

Endpoint Information Collection

When enabled, the Cortex XDR agent collects Host Inventory information such as users, groups, services, drivers, hardware, and network shares, as well as information about applications installed on the endpoint, including CVE and installed KBs for Vulnerability Assessment.

Enable Compliance Collection

XDR Cloud

If you set this to Enabled in the profile, any agent using this profile will be treated as if it is a cloud-based agent for licensing purposes.

Content Auto-update

By default, the Cortex XDR agent always retrieves the most updated content and deploys it on the endpoint, to ensure that it is always protected with the latest security measures.

If you disable content updates, the agent stops retrieving them from the Cortex XDR tenant, and keeps working with the current content on the endpoint.

Content Rollout

The Cortex XDR agent can retrieve content updates immediately as they are available, or after a pre-configured delay period. When you delay content updates, the Cortex XDR agent will retrieve the content according to the configured delay. For example, if you configure a delay period of two days, the agent will not use any content released in the last 48 hours.

Agent Auto-Upgrade

Automatic Upgrade Scope

For One release before the latest one, Cortex XDR upgrades the agent to the previous release before the latest, including maintenance releases. Major releases are numbered X.X, such as release 8.0, or 8.2. Maintenance releases are numbered X.X.X, such as release 8.2.2.

For Only maintenance releases in a specific version, select the required release version.

Upgrade Rollout

For Delayed, set the delay period (number of days) to wait after the version release before upgrading endpoints. Choose a value between 7 and 45.

To control the agent auto upgrade scheduler and number of parallel upgrades in your network, configure Global Agent Settings.

Select all

When selected, all download source options are enabled.

P2P

Cortex XDR deploys serverless peer-to-peer distribution to Cortex XDR agents in your LAN network by default. Within the six hour randomization window during which the Cortex XDR agent attempts to retrieve the new version, it will broadcast its peer agents on the same subnet twice: once within the first hour, and once again during the following five hours. If the agent did not retrieve the files from other agents in both queries, it will proceed to the next download source defined in your profile.

To enable P2P, you must enable UDP and TCP over the port specified for P2P Port. By default, Cortex XDR uses port 33221. You can change the port number, if required by your organization.

Broker VM

(only Broker VMs that are connected and configured for caching can be selected)

(Requires Broker VM 12.0 and later)

If you have a Palo Alto Networks Broker VM in your network, you can leverage the Local Agent Settings applet to cache release upgrades and content updates. When the Broker VM is enabled and configured appropriately (refer to Activate the Local Agent Settings) , it retrieves the latest installers and content every 15 minutes. The Broker VM stores them for a 30-day retention period since an agent last asked for them.

If the files are not available on the Broker VM at the time of the request, the agent proceeds to download the files directly from the Cortex XDR server.

When you select multiple Broker VMs, the agent chooses a Broker VM randomly for each download request.

Advanced Vulnerability Scanning

Mode

We recommend using Kernel mode. 

Content Auto-update

By default, the Cortex XDR agent always retrieves the most updated content and deploys it on the endpoint, to ensure that it is always protected with the latest security measures.

If you disable content updates, the agent stops retrieving them from the Cortex XDR tenant, and keeps working with the current content on the endpoint.

Content Rollout

The Cortex XDR agent can retrieve content updates immediately as they are available, or after a pre-configured delay period. When you delay content updates, the Cortex XDR agent will retrieve the content according to the configured delay. For example, if you configure a delay period of two days, the agent will not use any content released in the last 48 hours.