Create an agent installation package - Administrator Guide - Cortex XSIAM - Cortex

Create an agent installation package - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2024-04-25

Category

Administrator Guide

Abstract

Learn how to create a Cortex XDR agent installation package to deploy to your endpoints.

To install the Cortex XDR agent on the endpoint for the first time, create an agent installation package. Review the Where can I install the Cortex XDR agent for supported versions and operating systems.

To install the Cortex XDR agent software, you must use a valid installation package that exists in your Cortex XSIAM management console. If you delete an installation package, new agents installed from this package are not able to register to Cortex XSIAM, however, existing agents may re-register using the Agent ID generated by the installation package.

From Cortex XSIAM, select Endpoints → Agent Installations.
Click Create to create a new installer.
Enter a unique name and an optional description to identify the installation package.
The package name can contain letters, numbers, hyphens, underscores, commas, and spaces, and should not exceed 100 characters.
Select the Package Type:
- Standalone Installer: Use for fresh installations and to upgrade agents on a registered endpoint that is connected to Cortex XSIAM.
- Upgrade from ESM: Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XSIAM. For more information, see Migrate from Traps Endpoint Security Manager.
- (Linux only) Kubernetes Installer: Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.
  Guidelines for Kubernetes installer
  Settings for the Kubernetes installer cannot be changed after you create the installation package.
  For the Agent Daemonset Namespace, it is recommended to use the default cortex-xdr namespace.
  For a more granular deployment, enter any labels or selectors in the Node Selector. The Cortex XDR agent will be deployed only on these nodes.
  To configure the Cortex XDR agent to communicate through a proxy, enter either the IP address and port number or enter the FQDN and port number. When you enter the FQDN, you can use both lowercase and uppercase letters. Avoid using special characters or spaces. Use commas to separate multiple addresses.
- Helm Installer: Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.
Select the platform and relevant settings, and then click Create.
Cortex XSIAM prepares your installation package and displays it on the Agent Installations page.
Download your installation package.
When the status of the package shows Completed, right-click the package, and click Download.

Cortex XSIAM provides out-of-the-box exploit and malware protection. However, at minimum, you must enable Data Collection in an Agent Settings profile to leverage endpoint data in Cortex XSIAM apps.