You can install the XDR Collector using three available packages for a Linux installation—Linux RPM, Linux DEB, and Linux SH. You can install the XDR Collector package on any Linux server, including a physical or virtual machine, and as temporary sessions.
You can install XDR Collectors in any Linux server period, whether its a physical or virtual machine. Temporary sessions can be in either of them.
We recommend that you perform a Linux RPM or Linux DEB installation.
Before completing this task, ensure that you create and download a Cortex XDR Collector installation package, and then upload these installation files to your Linux environment.
To install the XDR Collectors installation package for Linux.
Log on to the Linux server.
user@local ~ $
ssh firstname.lastname@example.orgWelcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-1041-aws x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage Get cloud support with Ubuntu Advantage Cloud Guest: http://www.ubuntu.com/business/services/cloud 0 packages can be updated. 0 updates are security updates. Last login: Tue Aug 26 22:14:15 2021 from 192.168.1.100
Extract the installation files you uploaded using one of the following commands, which is dependent on the Linux package you downloaded:
Create a directory and copy the
collector.confinstallation file to the
sudo mkdir -p /etc/panw sudo cp ./collector.conf /etc/panw/
Install the XDR Collectors software.
You can install the XDR Collectors on the collector machine manually using the shell installer or using the Linux package manager for
To deploy using package manager:
Depending on your Linux distribution, install the XDR Collectors using one of the following commands, where the
<file name>is taken from the files provided in the downloaded Linux installation package:
RHEL, CentOS, or Oracle
yum install ./
rpm -i ./
Ubuntu or Debian
apt-get install ./
dpkg -i ./
zypper install ./
rpm -i ./
Verify the XDR Collectors was installed on the collector machine.
Enter the following command on the collector machine:
dpkg -l | grep xdr-collectoror
rpm -qa | grep xdr-collector.
To deploy the shell installer:
Enable execution of the script using the
chmod +xcommand, where the
<file name>is taken from the file provided in the downloaded Linux installation package.
Run the install script as root or with root permissions.
chmod +x linux.shroot@ubuntu:/home#
./linux.shVerifying archive integrity... All good. Uncompressing XDR-Collector version 22.214.171.1247 100% Systemd: starting xdr-collector service Synchronizing state of xdr-collector.service with SysV service script with /lib/systemd/systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install enable xdr-collector Created symlink /etc/systemd/system/multi-user.target.wants/xdr-collector.service→ /lib/systemd/system/xdr-collector.service.
Additional options are available to help you customize your installation if needed. The following table describes common options and parameters.
If you are using
debinstallers, you must also add these parameters to the
/etc/panw/collector.conffile prior to installation.
Configure the XDR Collector to communicate through an intermediary such as a proxy.
To enable the XDR Collector to direct communication to an intermediary, you use this installation option to assign the IP address and port number you want the XDR Collector to use. You can also configure the proxy by entering the FQDN and port number. When you enter the FQDN, you can use both lowercase and uppercase letters. Avoid using special characters or spaces.
Use commas to separate multiple addresses. For example:
--proxy-list "My.Network.Name:808, 10.196.20.244:8080"
After the initial installation, you can change the proxy settings from using the configuration XML.
The XDR Collector does not support proxy communication in environments where proxy authentication is required.
The path for persistence, content, Filebeat application data, and transaction data.
If the XDR Collector does not connect to Cortex XDR , verify your Internet connection on the collector machine. If the XDR Collector still does not connect, verify the installation package has not been removed from the Cortex XDR management console.