Step 3: Install Cortex XDR agents - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

The Cortex XDR agent monitors endpoint activity and collects endpoint data that Cortex XSIAM uses to raise alerts. Before you can begin collecting endpoint data, you must create an agent installation package and then install the Cortex XDR agent.