Create an agent installation package ↗

To install the Cortex XDR agent on the endpoint for the first time, create an agent installation package. Review Where can I install the Cortex XDR agent for supported versions and operating systems.

To install the Cortex XDR agent software, you must use a valid installation package that exists in your Cortex XSIAM management console. If you delete an installation package, new agents installed from this package are not able to register with Cortex XSIAM; however, existing agents may re-register using the Agent ID generated by the installation package.

  1. From Cortex XSIAM, select Inventory → Endpoints → Agent Installations.
  2. Click Create to create a new installer.

  3. Enter a unique name and an optional description to identify the installation package.

    The package name can contain letters, numbers, hyphens, underscores, commas, and spaces, and should not exceed 100 characters.

  4. Select the Package Type:
    • Standalone Installer: Use for fresh installations and to upgrade agents on a registered endpoint that is connected to Cortex XSIAM.
    • Upgrade from ESM: Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XSIAM. For more information, see Migrate from Traps Endpoint Security Manager.
    • (Linux only) Kubernetes Installer: Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.
    • CaaS: Create the Cortex XDR container-embedded agent Dockerfile.
    • Helm Installer: Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.
    • Serverless Installer: Create an installation package for a serverless function to deploy to your runtime platform.

Guidelines for Kubernetes installer

  • Settings for the Kubernetes installer cannot be changed after you create the installation package.

  • For Version, select the desired Cortex XDR agent version.

    If the option Always deploy the latest agent version is displayed, do not select it.

  • For the Agent Daemonset Namespace, it is recommended to use the default cortex-xdr namespace.
  • For a more granular deployment, enter any labels or selectors in the Node Selector. The Cortex XDR agent will be deployed only on these nodes.
  • To configure the Cortex XDR agent to communicate through a proxy, enter either the IP address and port number or the FQDN and port number. When you enter the FQDN, you can use both lowercase and uppercase letters. Avoid using special characters or spaces. Use commas to separate multiple addresses.


Guidelines for CaaS container-embedded installer

How to create an agent package for CaaS Workloads:

Before you deploy the container-embedded agent, verify the following:

Requires the Cortex Cloud Runtime Security or Cortex XSIAM Premium license. Every 10 container-embedded agents will consume a single Cortex Runtime Security license.

Prerequisites

Supported Environments <p>The following managed container services are supported:</p><ul><li>AWS ECS Fargate; containers using x86_64 and AArch64 architecture</li></ul>
Requirements <p>Cortex XDR agent version 9.2.0 or later</p><p>Required resources per container:</p><ul><li>Disk space: 1.5 GB</li><li>1 CPU</li><li>Memory: 512 MB</li></ul><p>Dockerfile requirements:</p><ul><li>SYS_PTRACE must be enabled</li></ul><p>Assets discovery: Onboard the relevant AWS environments</p><p>Drift detection: Container registry image scanning</p>
Limitations Alpine Linux and other musl-based distributions are not supported for container-embedded deployments.

Create the container-embedded agent Dockerfile via API:

See the API reference guide: Create Distributions

Create the container-embedded agent Dockerfile via user interface:

  1. Go to Inventory → Endpoints → Installations, click Create.
  2. Select CaaS Deployment as the Package Type and Container Embedded as the Deployment Type.
    1. Select the installer details to define the configuration settings for version and proxy (optional).
    2. Upload your Dockerfile. Cortex XSIAM validates your Dockerfile against the technical prerequisites.
  3. A new Agent Installation instance will be created. Right-click it and download the newly generated Dockerfile.

Embed the Agent container-embedded agent Dockerfile into your container image:

  1. Select the newly generated Dockerfile.
  2. Re-build your container image using the newly generated Dockerfile.
  3. During the build process, the agent binary will be fetched from the Cortex repository and baked into the image.
  4. Once the build process is successfully finished, you are ready to use the new container image in your CaaS environments, based on the prerequisites above.

Guidelines for serverless installer

How to create an agent package for a serverless function:

  1. Go to Inventory+Endpoints+Installations and click Create.
  2. Add a name and description, and add any endpoint tags that will be added to the agent as part of the installation process.
  3. For Package Type, select Serverless Function.
  4. Configure the following settings for Serverless Function:
    1. For Version, select the required Cortex agent version.
    2. For Cloud Provider, AWS is configured for this release.
    3. For Runtime, select one of the environments:
      • node.js
      • python
    4. For Deployment Type, select the type:
      • Embedded
      • AWS Layers
    5. If node.js and the deployment type AWS Layers are selected, select one of the Modules:
      • ECMAScript
      • CommonJS
    6. For Embed Default Profile From, select from the profile rules configured for serverless functions.

NOTE:

The profile will be applied if the security policy cannot be retrieved in real-time.

The package is created and ready to be deployed.

How to deploy the package to your runtime environment:

  1. From Cortex XSIAM, go to Inventory+Endpoints+Installations and from the Agent Installations page, right click and select View Installation Instructions.
  2. Depending on the runtime environment, the instructions are slightly different.
    • Agent installation package for embedded python:
      1. Download the serverless agent bundle.
      2. Log in to your AWS Management Console.
      3. Navigate to the AWS Lambda service, and unzip the serverless agent bundle in the main folder.
      4. Add the serverless agent to the function by importing the Cortex library and wrapping the function’s handler.\
        The Cortex serverless library must be imported after other libraries to activate the hooks that enable auditing.
    • Agent installation package for embedded node.js:
      1. Download the serverless agent bundle.
      2. Log in to your AWS Management Console.
      3. Navigate to the AWS Lambda service, and unzip the serverless agent bundle in the main folder.
      4. Add the serverless agent to the function by importing the Cortex library and wrapping the function’s handler.
    • Agent installation package for node.js using AWS Layers in ECMAScript (JavaScript) runtime/Agent installation package for node.js in AWS Lambda using AWS Layers with CommonJS module format:
      1. Download the serverless agent bundle.
      2. Log in to your AWS Management Console.
      3. Navigate to the AWS Lambda service, and upload the layer and add it to the function’s configuration.
      4. Save the current Lamba handler setting in the ORIGINAL_HANDLER environment variable.
      5. Change the Lambda handler setting to cortex.handler.
    • Agent installation package for python using AWS Layers in python runtime/Agent installation package for python in AWS Lambda using AWS Layers with python module format:
      1. Download the serverless agent bundle.
      2. Log in to your AWS Management Console.
      3. Create a new AWS layer with the downloaded bundle, copy the new layer ARN value, and add the new layer using the copied ARN.
      4. Save the current Lamba handler setting in the ORIGINAL_HANDLER environment variable.
      5. Change the Lambda handler setting to cortex.handler.
  3. Select the platform and relevant settings, and then click Create.\
    Cortex XSIAM prepares your installation package and displays it on the Agent Installations page.

  4. Download your installation package.\
    When the status of the package shows Completed, right-click the package, and click Download.

  5. Select the platform and relevant settings, and then click Create.

    Cortex XSIAM prepares your installation package and displays it on the Agent Installations page.

  6. Download your installation package.

    When the status of the package shows Completed, right-click the package, and click Download.