Cortex XDR Compatibility Matrix

The Cortex XDR agent is installed on supported physical and virtual endpoints.

Cortex XDR agent is a software component of the larger Cortex products. It provides both cloud workload and endpoint protection, depending on your license and deployment environment. Cortex XDR agent is installed on supported physical and virtual endpoints. As a comprehensive security solution, it secures a wide range of assets, from cloud environments (like containers and Kubernetes clusters) to traditional endpoints, and mobile devices. To ensure maximum protection of your endpoints, Palo Alto Networks recommends that you always deploy the latest maintenance version for each agent release.

Palo Alto Networks strives to support the latest major operating systems. When a new operating system is available, there may be a short delay in our support as we test interoperability.

Until a Cortex XDR agent release reaches its end-of-life status, the following support is provided:

• Microsoft operating systems are supported for three years beyond the end of Microsoft support.
• In general, other operating systems are supported until they reach end-of-life, or their extended life, as relevant.
• For Android, we support the latest Cortex XDR agent app that is available on the Google Play Store regardless of the app release date. An agent version that is no longer on Google Play will be supported for one year after the date of its release.

Note

The Cortex XDR agents for iOS, Android, 32-bit Windows, and version 7.5-CE agents, are not FedRamp compliant.

Agent releases

To ensure maximum protection of your endpoints, Palo Alto Networks recommends that you always deploy the latest maintenance version for each agent release.

Critical Environment (CE) versions must be enabled in your Cortex system before use. CE versions are designed for sensitive and highly regulated environments. These versions receive full content update coverage and contain the same feature set as the standard line it is based on. Please note, that some bug fixes, introducing higher stability risk, may not be incorporated into the maintenance releases of these lines. Support is provided for CE versions for 24 months, while support for standard versions is provided for 9 months.

See Cortex XDR Agent Releases for details and the release notes of the current agent versions. EOL versions may be shown in this document for information purposes only.

The following tables show the endpoint operating systems on which you can install each release of the Cortex XDR agent. These operating systems are also supported with supported Citrix and VMware virtual applications.

Supported Mac operating systems

The following Mac operating systems support the Cortex XDR agent.

Note

The Cortex Agent for macOS is FedRamp compliant from version 7.6.0 and later for Intel processors only.

Supported Windows operating systems

The following Windows operating systems support the Cortex XDR agent.

Note

Due to a limitation on Windows Servers, Cortex XDR agent will not register with the Microsoft Security Center.

Install the Cortex XDR agent on unsupported-ACS OS versions

Microsoft Trusted Signing (Azure Code Signing) Directive

Since March 2023, Microsoft request security vendors to sign binaries using Trusted Signing (formerly Azure Code Signing). As a result, Cortex XDR agent versions require a specific Microsoft Windows patch. Note that any machines without this Windows patch are not able to install or upgrade to newer versions of Cortex XDR agent. This mainly impacted Windows machines running Windows 10 or below; Windows 11 machines have this patch pre-installed. Windows 7 machines must have an extended support license in order to install the patch. Additional information about the security patch and the specific patch numbers required per operating system build, KB5022661/KB4474419 . In cases where the Microsoft security patch has since expired, ACS support is achieved by installing cumulative updates after the release of the initial KB patch.

Cortex XDR agent versions later than 8.3-CE will automatically detect an ACS-unsupported OS and allow the installation to complete successfully.

In agent versions 7.9.103-CE and 8.3-CE, to override the default behavior, admin must provide an MSI flag, NO_ACS_SUPPORT=1, as a parameter to the installer. This flag indicates that the installation is to be made on an ACS-unsupported operating system. A fresh installation is needed for using this flag.

Note

The NO_ACS_SUPPORT flag cannot be provided as part of an existing Cortex XDR agent upgrade.

If upgrading from a 7.5-CE release line, even without explicitly providing the installer flag, the installer will detect that ACS is unsupported and will treat the installation as if the flag was given.

Windows 7

Note

Cortex XDR agent 7.9 was the last version to support Windows 7. Release 7.9.103-CE gives extended support until December 31, 2026. No new capabilities will be developed for these OS versions.

Windows 8

All Windows 8 variants were supported until January 2023 (Microsoft EOL + 3 years). Release 7.9-CE, up to release 7.9.102-CE, offered support for Windows 8.1 until March 19, 2025. No new capabilities will be developed for these OS versions.

The extended-life agent 7.9.103-CE does not support Windows 8.1

Windows 10

The Enterprise edition is tested for compatibility. Unless specifically stated otherwise, assume that all sub-editions are also compatible.

Windows 11

The Enterprise edition is tested for compatibility. Unless specifically stated otherwise, assume that all sub-editions are also compatible.

Note

Windows running on ARM is subject to certain limitations, see Known limitations in the latest Cortex XDR agent release notes.

Windows Server

The Datacenter edition is tested for compatibility. Unless specifically stated otherwise, assume that all sub-editions are also compatible.

Note

Release 7.9-CE, up to release 7.9.102-CE, was supported Windows Server until March 19, 2025.

The extended-life agent 7.9.103-CE supports Windows Server 2008 R2 SP1 until December 31, 2027.

Supported Linux operating systems

The following Linux operating systems support the Cortex XDR agent.

The Cortex XDR agent protects Linux servers, there are two methods for agent protection; a Kernel module and a user-mode (eBPF-based) approach. To help you choose the best deployment for your environment, see the feature differences between these two modes in the latest Cortex XDR agent Admin guide Broken link.

For the latest Kernel modules support see here.

Note

Cortex XDR agent 9.1 was the last agent release supporting Linux kernels below 3.10. To avoid service disruption, hosts running kernels below 3.10 must not be upgraded beyond the 9.1 agent line. Disable auto-upgrades for endpoint profiles managing those machines, and prevent manual upgrades of the hosts to agent versions later than 9.1

Alibaba Cloud Linux

AlmaLinux

Amazon Linux/Amazon Linux 2/Amazon Linux 2023

Debian

CentOS

Fedora Server

openSUSE

Oracle Linux

*Oracle Linux 9.3 x86_64 notes:

Red Hat Enterprise Linux

*RHEL 9 requirement

RHEL 9.3 and later requires Cortex XDR agent version 8.2 or later.

Rocky Linux

SUSE Linux Enterprise Server

Ubuntu

View the Kubernetes platforms that are supported with Cortex XDR agents.

This table shows the Kubernetes platform versions that have been compatibility tested. The table shows the latest version that has been tested. All versions that are not EOL, up to the latest version tested for compatibility are supported.

For installation instructions refer to Cortex XDR Agent for Linux → Install the Cortex XDR Agent for Kubernetes Hosts in the latest Cortex XDR agent admin guide.

Notes

In Google Container-Optimized OS release 100 and earlier, where the FANOTIFY EXEC flag is not supported, the Kernel configuration may be partial for the user mode agent to properly function. In such cases, the agent will fallback to asynchronous mode.

In RHCOS version 4.12 and earlier, the Kernel configuration may be partial for the user mode agent to properly function. In such cases, the agent will fallback to asynchronous mode.

The following describes the supported software vendors you can use to deploy virtual applications and the minimum software version supported with each release of the Cortex XDR agent.

Citrix

• Citrix Virtual Apps and Desktops (previously XenApp and XenDesktop)—7.xx and later on all Cortex XDR agents.
• Citrix App Layering according to the installation process detailed in the Cortex XDR agent admin guide. Installation on the OS layer: Citrix App 4 and later on all Cortex XDR agents Installation on the Platform layer: Supported from Cortex XDR agent 9.2 and later

VMware

• VMware AppVolumes—2.13.1 & later on all Cortex XDR agents according to the installation process detailed.
• VMware Horizon View—7.8 & later for all Cortex XDR agents.
• VMware ThinApp—5.2.2 & later for all Cortex XDR agents.

Windows

• Windows Virtual PC—Azure Virtual Desktop (WVD or AVD) supported from Cortex XDR agent 7.5 and later.

The following tables show the mobile operating systems on which you can install each release of the agent. You can install the Cortex XDR agent on Android and iOS, mobile phones and tablets.

Android

iOS/iPadOS

Note

The SMS filtering and call blocking features offered by Cortex XDR are available only in iPhones. iPads do not support SMS messaging or cellular-based telephony, even when fitted with a SIM card.

Review the considerations related to third-party security software integration with Cortex XDR agent software.

This information outlines important considerations regarding the integration of third-party security software with Cortex XDR agent software. The following tables detail the supported security products that can run alongside Cortex XDR, along with their known limitations or the required additional actions to ensure proper integration with Cortex XDR agents.

It is important to note that while other third-party applications may be compatible with Cortex XDR agents, Palo Alto Networks has not conducted compatibility testing on these products. Customers who intend to install such applications alongside Cortex XDR agents are advised to perform thorough internal testing to ensure there are no conflicts or performance issues.

Should you encounter any problems during the integration process with the following third-party security software, please contact your support team for assistance.