Deploy agent installation packages - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Cortex XSIAM
Creation date
Last date published
Administrator Guide

Learn how to deploy an agent installation package on endpoints.

After you create and download an installation package, you can then install it directly on an endpoint or you can use a software deployment tool, such as JAMF or GPO, to distribute the software to multiple endpoints.

  • For Windows endpoints, select between the architecture type. You can download the installer msi file only or a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.

  • For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.

  • For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.

  • For Kubernetes clusters on Linux endpoints, download the YAML file. Cortex XDR strongly recommends that you do not edit this file.

  • For Android endpoints, Cortex XDR creates a tenant-specific download link that you can distribute to Android endpoints. When a newer agent version is available, Cortex XDR identifies older package versions as [Outdated].

Related information
  • Cortex XDR Agent Administrator Guide

  • Agent iOS Guide

  • Agent Android Guide