Documentation — August 11, 2026

▸ Navigation manifest (xsiam) modified +1 −1 .meta/xsiam

The book's page tree and ordering — not a documentation page, so no diff is kept. The counts above still say how much moved.

▸ Cortex XDR Agent for Linux Requirements modified +1 −10 The whole requirements table was re-emitted as a header-hidden HTML table; processor, RAM, disk, kernel and networking values are unchanged. agent/cortex-xdr-agent-for-linux/cortex-xdr-agent-for-linux-requirements

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -7,18 +7,9 @@ description: >-

# Cortex XDR Agent for Linux Requirements

The Cortex XDR agent for Linux has the following requirements:

### Cortex XDR Agent for Linux Requirements

The Cortex XDR agent for Linux has the following requirements:

Requirement│Minimum Specification


Requirement	Minimum Specification
Processor	Processor 2.3 GHz dual-core processor
RAM	4GB; 8GB recommended
Hard disk space	10 GB (available for the /opt/traps directory)
Architecture	x86_64 (x86 64bit) For aarch64 (ARM 64 bit) see Cortex XDR agent for Linux compatibilty matrix for details.
Operating system versions	See the Cortex XDR Compatibility Matrix.
Kernel version	Kernel Mode On Linux endpoints, to perform malware analysis of Executable and Linkable Format (ELF) files and collect data for endpoint detection and response (EDR) and behavioral threat analysis, the Cortex XDR agent requires one of the Linux Kernels that are listed in supported Kernel Module Versions. If you deploy the Cortex XDR agent on a Linux server that is not running one of the kernel versions required for these additional protection capabilities, the agent will operate in asynchronous mode. User Space Mode User Space operation mode is supported from Cortex XDR agent version 7.7 User space operation mode requires Kubernetes node to run one of the supported operation systems with Kernel version 5.0 or later.
Software packages	The following software packages are required to be installed on your endpoint, depending on the operating system. Verify that you have standard Unix programs installed. ca-certificates All Distributions require openssl 1.0.0 or a later release. In addition, SLES 11 requires openssl-certs In addition, SLES 12 and 15 require ca-certificates glibc—Required for exploit protection of containerized processes using the ROP Mitigation and Brute Force Protection modules. If glibc is not installed, these modules are disabled but all other exploit and malware protection functionality work as expected. CentOS 6.10—Enable the dynamic CA instead of the legacy CA: Enable the dynamic CA configuration: `update-ca-trust force-enable` Import the certificates: `cp XDR-certificate.crt /etc/pki/ca-trust/source/anchors/.` Rebuild the certificate database: `update-ca-trust extract`
Networking	Allow communication on the TCP port from the Cortex XDR agent to the server (the default is port 443). Allow your Cortex management console and Cortex XDR agent to communicate with external and internal resources required for enforcing endpoint protection. For more information, see Enable Access to Required PANW Resources in the applicable Cortex product documentation.

| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Processor│Processor 2.3 GHz dual-core processor

RAM│4GB; 8GB recommended

Hard disk space│10 GB (available for the /opt/traps directory)

Architecture│x86_64 (x86 64bit)

For aarch64 (ARM 64 bit) see Cortex XDR agent for Linux compatibilty matrix for details.

Operating system versions│See the Cortex XDR Compatibility Matrix.

Kernel version│Kernel Mode

On Linux endpoints, to perform malware analysis of Executable and Linkable Format (ELF) files and collect data for endpoint detection and response (EDR) and behavioral threat analysis, the Cortex XDR agent requires one of the Linux Kernels that are listed in supported Kernel Module Versions.

If you deploy the Cortex XDR agent on a Linux server that is not running one of the kernel versions required for these additional protection capabilities, the agent will operate in asynchronous mode.

User Space Mode

User Space operation mode is supported from Cortex XDR agent version 7.7

User space operation mode requires Kubernetes node to run one of the supported operation systems with Kernel version 5.0 or later.

Software packages│

The following software packages are required to be installed on your endpoint, depending on the operating system.

Verify that you have standard Unix programs installed.
ca-certificates
All Distributions require openssl 1.0.0 or a later release.
- In addition, SLES 11 requires openssl-certs
- In addition, SLES 12 and 15 require ca-certificates
glibc—Required for exploit protection of containerized processes using the ROP Mitigation and Brute Force Protection modules. If glibc is not installed, these modules are disabled but all other exploit and malware protection functionality work as expected.
CentOS 6.10—Enable the dynamic CA instead of the legacy CA:
1. Enable the dynamic CA configuration: update-ca-trust force-enable
2. Import the certificates: cp XDR-certificate.crt /etc/pki/ca-trust/source/anchors/.
3. Rebuild the certificate database: update-ca-trust extract

Networking│

Allow communication on the TCP port from the Cortex XDR agent to the server (the default is port 443).
Allow your Cortex management console and Cortex XDR agent to communicate with external and internal resources required for enforcing endpoint protection. For more information, see Enable Access to Required PANW Resources in the applicable Cortex product documentation.

Show markdown source

@@ -7,18 +7,9 @@ description: >-
 # Cortex XDR Agent for Linux Requirements
 
 The Cortex XDR agent for Linux has the following requirements:
 
 ### Cortex XDR Agent for Linux Requirements
 
 The Cortex XDR agent for Linux has the following requirements:
 
-| Requirement               | Minimum Specification                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Processor                 | Processor 2.3 GHz dual-core processor                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| RAM                       | 4GB; 8GB recommended                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| Hard disk space           | 10 GB (available for the /opt/traps directory)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| Architecture              | <p>x86_64 (x86 64bit)</p><p>For aarch64 (ARM 64 bit) see <a href="https://app.gitbook.com/s/fZ8QSMnkjnXpuOeuRcam/where-can-i-install-the-cortex-xdr-agent/endpoint-operating-systems-supported/linux">Cortex XDR agent for Linux compatibilty matrix</a> for details.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| Operating system versions | See the [Cortex XDR Compatibility Matrix](https://app.gitbook.com/s/fZ8QSMnkjnXpuOeuRcam/where-can-i-install-the-cortex-xdr-agent/endpoint-operating-systems-supported).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| Kernel version            | <p><strong>Kernel Mode</strong></p><p>On Linux endpoints, to perform malware analysis of Executable and Linkable Format (ELF) files and collect data for endpoint detection and response (EDR) and behavioral threat analysis, the Cortex XDR agent requires one of the Linux Kernels that are listed in <a href="https://app.gitbook.com/s/y29o8lwSBpbfPbvztsyt/">supported Kernel Module Versions</a>.</p><p>If you deploy the Cortex XDR agent on a Linux server that is not running one of the kernel versions required for these additional protection capabilities, the agent will operate in asynchronous mode.</p><p><strong>User Space Mode</strong></p><p>User Space operation mode is supported from Cortex XDR agent version 7.7</p><p>User space operation mode requires Kubernetes node to run one of the supported operation systems with Kernel version 5.0 or later.</p>                                                                                                                                                                               |
-| Software packages         | <p>The following software packages are required to be installed on your endpoint, depending on the operating system.</p><ul><li>Verify that you have standard Unix programs installed.</li><li>ca-certificates</li><li><p>All Distributions require openssl 1.0.0 or a later release.</p><ul><li>In addition, SLES 11 requires openssl-certs</li><li>In addition, SLES 12 and 15 require ca-certificates</li></ul></li><li>glibc—Required for exploit protection of containerized processes using the ROP Mitigation and Brute Force Protection modules. If glibc is not installed, these modules are disabled but all other exploit and malware protection functionality work as expected.</li><li><p>CentOS 6.10—Enable the dynamic CA instead of the legacy CA:</p><ol><li>Enable the dynamic CA configuration: <code>update-ca-trust force-enable</code></li><li>Import the certificates: <code>cp XDR-certificate.crt /etc/pki/ca-trust/source/anchors/.</code></li><li>Rebuild the certificate database: <code>update-ca-trust extract</code></li></ol></li></ul> |
-| Networking                | <ul><li>Allow communication on the TCP port from the Cortex XDR agent to the server (the default is port 443).</li><li>Allow your Cortex management console and Cortex XDR agent to communicate with external and internal resources required for enforcing endpoint protection. For more information, see Enable Access to Required PANW Resources in the applicable Cortex product documentation.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+<table data-header-hidden><thead><tr><th width="262.5625"></th><th></th></tr></thead><tbody><tr><td>Requirement</td><td>Minimum Specification</td></tr><tr><td>Processor</td><td>Processor 2.3 GHz dual-core processor</td></tr><tr><td>RAM</td><td>4GB; 8GB recommended</td></tr><tr><td>Hard disk space</td><td>10 GB (available for the /opt/traps directory)</td></tr><tr><td>Architecture</td><td><p>x86_64 (x86 64bit)</p><p>For aarch64 (ARM 64 bit) see <a href="https://app.gitbook.com/s/fZ8QSMnkjnXpuOeuRcam/where-can-i-install-the-cortex-xdr-agent/endpoint-operating-systems-supported/linux">Cortex XDR agent for Linux compatibilty matrix</a> for details.</p></td></tr><tr><td>Operating system versions</td><td>See the <a href="https://app.gitbook.com/s/fZ8QSMnkjnXpuOeuRcam/where-can-i-install-the-cortex-xdr-agent/endpoint-operating-systems-supported">Cortex XDR Compatibility Matrix</a>.</td></tr><tr><td>Kernel version</td><td><p><strong>Kernel Mode</strong></p><p>On Linux endpoints, to perform malware analysis of Executable and Linkable Format (ELF) files and collect data for endpoint detection and response (EDR) and behavioral threat analysis, the Cortex XDR agent requires one of the Linux Kernels that are listed in <a href="https://app.gitbook.com/s/y29o8lwSBpbfPbvztsyt/">supported Kernel Module Versions</a>.</p><p>If you deploy the Cortex XDR agent on a Linux server that is not running one of the kernel versions required for these additional protection capabilities, the agent will operate in asynchronous mode.</p><p><strong>User Space Mode</strong></p><p>User Space operation mode is supported from Cortex XDR agent version 7.7</p><p>User space operation mode requires Kubernetes node to run one of the supported operation systems with Kernel version 5.0 or later.</p></td></tr><tr><td>Software packages</td><td><p>The following software packages are required to be installed on your endpoint, depending on the operating system.</p><ul><li>Verify that you have standard Unix programs installed.</li><li>ca-certificates</li><li><p>All Distributions require openssl 1.0.0 or a later release.</p><ul><li>In addition, SLES 11 requires openssl-certs</li><li>In addition, SLES 12 and 15 require ca-certificates</li></ul></li><li>glibc—Required for exploit protection of containerized processes using the ROP Mitigation and Brute Force Protection modules. If glibc is not installed, these modules are disabled but all other exploit and malware protection functionality work as expected.</li><li><p>CentOS 6.10—Enable the dynamic CA instead of the legacy CA:</p><ol><li>Enable the dynamic CA configuration: <code>update-ca-trust force-enable</code></li><li>Import the certificates: <code>cp XDR-certificate.crt /etc/pki/ca-trust/source/anchors/.</code></li><li>Rebuild the certificate database: <code>update-ca-trust extract</code></li></ol></li></ul></td></tr><tr><td>Networking</td><td><ul><li>Allow communication on the TCP port from the Cortex XDR agent to the server (the default is port 443).</li><li>Allow your Cortex management console and Cortex XDR agent to communicate with external and internal resources required for enforcing endpoint protection. For more information, see Enable Access to Required PANW Resources in the applicable Cortex product documentation.</li></ul></td></tr></tbody></table>

▸ Install the Cortex XDR Agent for Kubernetes Hosts modified +4 −4 agent/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-kubernetes-hosts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -11,20 +11,20 @@ You can deploy the Cortex XDR agent for Linux on Kubernetes Clusters as a Daemon

Palo Alto Networks supports only Cortex XDR agent deployments carried out with the original YAML installation package generated directly from the Cortex XDR management console and carried out as a DaemonSet. If you attempt to edit the YAML settings after you created the package, the installation could fail or cause the agent to display unexpected behavior.

endhint

The Helm Installer package may be used for fresh installations and upgrades of agents running on Kubernetes clusters.

Prerequisites

Requirement/Limitation│Description

| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Requirements│

A Cortex XDR agent 7.9 or later.
To enable User Space operation mode you must deploy YAML installer for Cortex XDR agent 7.7 or later.
A Cortex XDR Cloud per Host license.
A supported Kubernetes deployment according to cloud provider and OS (both docker and containerd). See also Kubernetes platforms supported with Cortex XDR and Cloud platforms supported.
Managed Kubernetes, such as GKE Autopilot, are supported from Cortex XDR agent version 9.0.
For GKE Autopilot running a privileged workload requires adding the path (Palo-Alto-Networks/cortex-agent/*) to the corresponding allowlist file to an AllowlistSynchronizer custom resource. Then deploy the AllowlistSynchronizer to your cluster. For more details, visit https://cloud.google.com/kubernetes-engine/docs/how-to/run-autopilot-partner-workloads#create-allowlistsynchronizer

Requirements│

A Cortex XDR agent 7.9 or later.
To enable User Space operation mode you must deploy YAML installer for Cortex XDR agent 7.7 or later.
A Cortex XDR Cloud per Host license.
A supported Kubernetes deployment according to cloud provider and OS (both docker and containerd). See also Kubernetes platforms supported with Cortex XDR and Cloud platforms supported.
Managed Kubernetes, such as GKE Autopilot, are supported from Cortex XDR agent version 9.0.
For GKE Autopilot running a privileged workload requires adding the path (Palo-Alto-Networks/cortex-agent/*) to the corresponding allowlist file to an AllowlistSynchronizer custom resource. Then deploy the AllowlistSynchronizer to your cluster. For more details, visit https://cloud.google.com/kubernetes-engine/docs/how-to/run-autopilot-partner-workloads#create-allowlistsynchronizer

Limitations│

You cannot upgrade, uninstall, or change the management server of a Cortex XDR agent running on Kubernetes Clusters directly from the Cortex XDR management console. These actions must be performed from your Kubernetes cluster.
If the Kubernetes clusters are based on Google Cloud Container-Optimized OS (COS), on some Google COS milestones, the Cortex XDR agent operates in asynchronous mode, due to kernel configuration limitations.
- Kernel Mode (KM) is not supported, due to restrictions on loading 3rd party kernel modules.
- Cortex XDR agent deployment in a COS environment will enforce User Space Mode (overriding the settings in the profile).
If the Kubernetes clusters are based on Red Hat OpenShift Container Platform with RHCOS, on some RHCOS versions, the Cortex XDR agent operates in asynchronous mode without its kernel module support due to kernel configuration limitations.
- Kernel Mode (KM) is not supported, due to restrictions on loading 3rd party kernel modules.
- Cortex XDR agent deployment in an RHCOS environment will enforce User Space Mode (overriding the settings in the profile).
GKE Autopilot, as a managed platform, does not allow running live terminal instances or initiate remote script execution.
If you are installing Cortex XDR alongside Prisma Cloud Compute, you must disable Runtime protection in Prisma Cloud Compute for as long as the two agents are working together. You can do so by either deleting any Runtime policy that exists in Prisma Cloud Compute, or moving Prisma Cloud Compute policies to Runtime Disabled.
From the Prisma Cloud Compute console, go to Defend → Runtime and delete or move all policies to Disable accordingly (Container policy, Host policy, Server policy, App-Embedded policy).
Installing Cortex XDR within Kubernetes in Docker (or any other container) is not supported.
Installing Cortex XDR on Kubernetes version 1.29 and below requires one of the following actions:
- Run the 'kubectl apply' command with the flag: --validate = false
- Remove the following from the deamonset.yaml file:
  appArmorProfile: type: Unconfined

Limitations│

You cannot upgrade, uninstall, or change the management server of a Cortex XDR agent running on Kubernetes Clusters directly from the Cortex XDR management console. These actions must be performed from your Kubernetes cluster.
If the Kubernetes clusters are based on Google Cloud Container-Optimized OS (COS), on some Google COS milestones, the Cortex XDR agent operates in asynchronous mode, due to kernel configuration limitations.
- Kernel Mode (KM) is not supported, due to restrictions on loading 3rd party kernel modules.
- Cortex XDR agent deployment in a COS environment will enforce User Space Mode (overriding the settings in the profile).
If the Kubernetes clusters are based on Red Hat OpenShift Container Platform with RHCOS, on some RHCOS versions, the Cortex XDR agent operates in asynchronous mode without its kernel module support due to kernel configuration limitations.
- Kernel Mode (KM) is not supported, due to restrictions on loading 3rd party kernel modules.
- Cortex XDR agent deployment in an RHCOS environment will enforce User Space Mode (overriding the settings in the profile).
GKE Autopilot, as a managed platform, does not allow running live terminal instances or initiate remote script execution.
If you are installing Cortex XDR alongside Prisma Cloud Compute, you must disable Runtime protection in Prisma Cloud Compute for as long as the two agents are working together. You can do so by either deleting any Runtime policy that exists in Prisma Cloud Compute, or moving Prisma Cloud Compute policies to Runtime Disabled.
From the Prisma Cloud Compute console, go to Defend → Runtime and delete or move all policies to Disable accordingly (Container policy, Host policy, Server policy, App-Embedded policy).
Installing Cortex XDR within Kubernetes in Docker (or any other container) is not supported.
Installing Cortex XDR on Kubernetes version 1.29 and below requires one of the following actions:
- Run the 'kubectl apply' command with the flag: --validate = false
- Remove the following from the deamonset.yaml file:
  appArmorProfile: type: Unconfined

To install the agent on your cluster

hint info

### Note

Setting up the system and creating installation packages can be found in the Install and Manage endpoints section in the documentation for your license.

endhint

Show markdown source

@@ -11,20 +11,20 @@ You can deploy the Cortex XDR agent for Linux on Kubernetes Clusters as a Daemon
 
 Palo Alto Networks supports only Cortex XDR agent deployments carried out with the original YAML installation package generated directly from the Cortex XDR management console and carried out as a DaemonSet. If you attempt to edit the YAML settings after you created the package, the installation could fail or cause the agent to display unexpected behavior.
 {% endhint %}
 
 The Helm Installer package may be used for fresh installations and upgrades of agents running on Kubernetes clusters.
 
 **Prerequisites**
 
-| Requirement/Limitation | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Requirements           | <ul><li>A Cortex XDR agent 7.9 or later.</li><li>To enable User Space operation mode you must deploy YAML installer for Cortex XDR agent 7.7 or later.</li><li>A Cortex XDR Cloud per Host license.</li><li>A supported Kubernetes deployment according to cloud provider and OS (both docker and containerd). See also <a href="https://app.gitbook.com/s/fZ8QSMnkjnXpuOeuRcam/where-can-i-install-the-cortex-xdr-agent/kubernetes-platforms-supported">Kubernetes platforms supported with Cortex XDR</a> and <a href="https://app.gitbook.com/s/fZ8QSMnkjnXpuOeuRcam/where-can-i-install-the-cortex-xdr-agent/cloud-platforms-supported-with-cortex-xdr-agent">Cloud platforms supported</a>.</li><li>Managed Kubernetes, such as GKE Autopilot, are supported from Cortex XDR agent version 9.0.</li><li>For <strong>GKE Autopilot</strong> running a privileged workload requires adding the path <code>(Palo-Alto-Networks/cortex-agent/*)</code> to the corresponding allowlist file to an AllowlistSynchronizer custom resource. Then deploy the AllowlistSynchronizer to your cluster. For more details, visit <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/run-autopilot-partner-workloads#create-allowlistsynchronizer">https://cloud.google.com/kubernetes-engine/docs/how-to/run-autopilot-partner-workloads#create-allowlistsynchronizer</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| Limitations            | <ul><li>You cannot upgrade, uninstall, or change the management server of a Cortex XDR agent running on Kubernetes Clusters directly from the Cortex XDR management console. These actions must be performed from your Kubernetes cluster.</li><li><p>If the Kubernetes clusters are based on Google Cloud Container-Optimized OS (COS), on some Google COS milestones, the Cortex XDR agent operates in asynchronous mode, due to kernel configuration limitations.</p><ul><li>Kernel Mode (KM) is not supported, due to restrictions on loading 3rd party kernel modules.</li><li>Cortex XDR agent deployment in a COS environment will enforce User Space Mode (overriding the settings in the profile).</li></ul></li><li><p>If the Kubernetes clusters are based on Red Hat OpenShift Container Platform with RHCOS, on some RHCOS versions, the Cortex XDR agent operates in asynchronous mode without its kernel module support due to kernel configuration limitations.</p><ul><li>Kernel Mode (KM) is not supported, due to restrictions on loading 3rd party kernel modules.</li><li>Cortex XDR agent deployment in an RHCOS environment will enforce User Space Mode (overriding the settings in the profile).</li></ul></li><li>GKE Autopilot, as a managed platform, does not allow running live terminal instances or initiate remote script execution.</li><li><p>If you are installing Cortex XDR alongside Prisma Cloud Compute, you must disable Runtime protection in Prisma Cloud Compute for as long as the two agents are working together. You can do so by either deleting any Runtime policy that exists in Prisma Cloud Compute, or moving Prisma Cloud Compute policies to <strong>Runtime Disabled</strong>.</p><p>From the Prisma Cloud Compute console, go to Defend → <strong>Runtime</strong> and delete or move all policies to <strong>Disable</strong> accordingly (Container policy, Host policy, Server policy, App-Embedded policy).</p></li><li>Installing Cortex XDR within Kubernetes in Docker (or any other container) is not supported.</li><li><p>Installing Cortex XDR on Kubernetes version 1.29 and below requires one of the following actions:</p><ul><li>Run the 'kubectl apply' command with the flag: --validate = false</li><li><p>Remove the following from the deamonset.yaml file:</p><p>appArmorProfile: type: Unconfined</p></li></ul></li></ul> |
+| Requirement/Limitation | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Requirements           | <ul><li>A Cortex XDR agent 7.9 or later.</li><li>To enable User Space operation mode you must deploy YAML installer for Cortex XDR agent 7.7 or later.</li><li>A Cortex XDR Cloud per Host license.</li><li>A supported Kubernetes deployment according to cloud provider and OS (both docker and containerd). See also <a href="https://app.gitbook.com/s/fZ8QSMnkjnXpuOeuRcam/where-can-i-install-the-cortex-xdr-agent/kubernetes-platforms-supported">Kubernetes platforms supported with Cortex XDR</a> and <a href="https://app.gitbook.com/s/fZ8QSMnkjnXpuOeuRcam/where-can-i-install-the-cortex-xdr-agent/cloud-platforms-supported-with-cortex-xdr-agent">Cloud platforms supported</a>.</li><li>Managed Kubernetes, such as GKE Autopilot, are supported from Cortex XDR agent version 9.0.</li><li>For <strong>GKE Autopilot</strong> running a privileged workload requires adding the path <code>(Palo-Alto-Networks/cortex-agent/*)</code> to the corresponding allowlist file to an AllowlistSynchronizer custom resource. Then deploy the AllowlistSynchronizer to your cluster. For more details, visit <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/run-autopilot-partner-workloads#create-allowlistsynchronizer">https://cloud.google.com/kubernetes-engine/docs/how-to/run-autopilot-partner-workloads#create-allowlistsynchronizer</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| Limitations            | <ul><li>You cannot upgrade, uninstall, or change the management server of a Cortex XDR agent running on Kubernetes Clusters directly from the Cortex XDR management console. These actions must be performed from your Kubernetes cluster.</li><li><p>If the Kubernetes clusters are based on Google Cloud Container-Optimized OS (COS), on some Google COS milestones, the Cortex XDR agent operates in asynchronous mode, due to kernel configuration limitations.</p><ul><li>Kernel Mode (KM) is not supported, due to restrictions on loading 3rd party kernel modules.</li><li>Cortex XDR agent deployment in a COS environment will enforce User Space Mode (overriding the settings in the profile).</li></ul></li><li><p>If the Kubernetes clusters are based on Red Hat OpenShift Container Platform with RHCOS, on some RHCOS versions, the Cortex XDR agent operates in asynchronous mode without its kernel module support due to kernel configuration limitations.</p><ul><li>Kernel Mode (KM) is not supported, due to restrictions on loading 3rd party kernel modules.</li><li>Cortex XDR agent deployment in an RHCOS environment will enforce User Space Mode (overriding the settings in the profile).</li></ul></li><li>GKE Autopilot, as a managed platform, does not allow running live terminal instances or initiate remote script execution.</li><li><p>If you are installing Cortex XDR alongside Prisma Cloud Compute, you must disable Runtime protection in Prisma Cloud Compute for as long as the two agents are working together. You can do so by either deleting any Runtime policy that exists in Prisma Cloud Compute, or moving Prisma Cloud Compute policies to <strong>Runtime Disabled</strong>.</p><p>From the Prisma Cloud Compute console, go to <strong>Defend</strong> → <strong>Runtime</strong> and delete or move all policies to <strong>Disable</strong> accordingly (Container policy, Host policy, Server policy, App-Embedded policy).</p></li><li>Installing Cortex XDR within Kubernetes in Docker (or any other container) is not supported.</li><li><p>Installing Cortex XDR on Kubernetes version 1.29 and below requires one of the following actions:</p><ul><li>Run the 'kubectl apply' command with the flag: --validate = false</li><li><p>Remove the following from the deamonset.yaml file:</p><p>appArmorProfile: type: Unconfined</p></li></ul></li></ul> |
 
 To install the agent on your cluster
 
 {% hint style="info" %}
 ### Note
 
 Setting up the system and creating installation packages can be found in the Install and Manage endpoints section in the documentation for your license.
 {% endhint %}

▸ Install the Cortex XDR agent for Linux modified +2 −13 The distribution install-command table and the installer-options table both became HTML; the commands and options themselves did not change. agent/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-linux

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -60,21 +60,17 @@ To install a Cortex XDR agent:

**To deploy using package manager:**

1. (Optional) For Linux distributions RHEL, CentOS, Oracle, or SUSE that have signature-checking configured or you would like to manually check the integrity of the Cortex XDR package:

1. Download the Cortex XDR Public Key.

2. Unzip the public key by running unzip cortex-xdr-agent.zip.

3. Import the public key by running rpm --import cortex-xdr-agent.asc.

2. Depending on your Linux distribution, install the Cortex XDR agent using one of the following commands:

Distribution│Install Command

    <table><thead><tr><th width="257.5816650390625">Distribution</th><th>Install Command</th></tr></thead><tbody><tr><td>RHEL, CentOS, or Oracle</td><td><strong><code>yum install ./</code></strong><em><strong><code>filename</code></strong></em><strong><code>.rpm</code></strong> or <strong><code>rpm -i ./</code></strong><em><strong><code>filename</code></strong></em><strong><code>.rpm</code></strong></td></tr><tr><td>Ubuntu or Debian</td><td><strong><code>apt-get install ./</code></strong><em><strong><code>filename</code></strong></em><strong><code>.deb</code></strong> or <strong><code>dpkg -i ./</code></strong><em><strong><code>filename</code></strong></em><strong><code>.deb</code></strong></td></tr><tr><td>SUSE</td><td><strong><code>zypper install ./</code></strong><em><strong><code>filename</code></strong></em><strong><code>.rpm</code></strong> or <strong><code>rpm -i ./</code></strong><em><strong><code>filename</code></strong></em><strong><code>.rpm</code></strong></td></tr></tbody></table>

    | ----------------------- | ------------------------------------------------------------------------------------------------ |

RHEL, CentOS, or Oracle│yum install ./filename.rpm or rpm -i ./filename.rpm

Ubuntu or Debian│apt-get install ./filename.deb or dpkg -i ./filename.deb

SUSE│zypper install ./filename.rpm or rpm -i ./filename.rpm

3. Verify the agent was installed on the endpoint.

Enter the following command on the endpoint:

**`dpkg -l | grep cortex-agent`** or **`rpm -qa | grep cortex-agent`**. **To deploy the shell installer:**

1. Enable execution of the script using the chmod +x filename command.

@@ -140,24 +136,17 @@ To install a Cortex XDR agent:

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If you are using <code>rpm</code>, <code>deb</code> or <code>sh</code> installers, you must also add these parameters to the <code>/etc/panw/cortex.conf</code> file prior to installation.</p></div>

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If you are using <code>rpm</code>, <code>deb</code> or <code>sh</code> installers, you must also add these parameters to the <code>/etc/panw/cortex.conf</code> file prior to installation.</p></div>

    Make sure to remove the first couple of leading double dashes. For example, instead of :**`-- --proxy-list ”`**_**`<proxyserver>`**_**`:`**_**`<port>`**_**`”`**, add this: **`--proxy-list="10.196.21.223:808"`**.

    Make sure to remove the first couple of leading double dashes. For example, instead of :**`-- --proxy-list ”`**_**`<proxyserver>`**_**`:`**_**`<port>`**_**`”`**, add this: **`--proxy-list="10.196.21.223:808"`**.

Applies to:

**`--proxy-list="10.196.21.223:808" --no-km --restrict=live_terminal`**

Option│Description

    <table><thead><tr><th width="244.243896484375">Option</th><th>Description</th></tr></thead><tbody><tr><td><strong><code>--no-km</code></strong></td><td><p><strong>Without Kernel Module Installation</strong></p><p>Use the <strong><code>--no-km</code></strong> option if you do not want to install the Cortex XDR agent kernel module. If you install the agent without the Cortex XDR kernel module or your Linux server runs an unsupported kernel version, the Cortex XDR agent will operate in asynchronous mode.</p></td></tr><tr><td><strong><code>--install-path=</code></strong><em><strong><code>&#x3C;/custom/path></code></strong></em></td><td><p><strong>Custom Agent Installation Directory</strong></p><p>Install the Cortex XDR agent in a custom directory on the endpoint instead of using the default <code>./opt</code> directory. Custom installation directory is a persistent change, and after you install the Cortex XDR to the custom path, all following upgrades and the removal of the agent from the endpoint are executed in the same location.</p><p>Before you start, ensure the custom directory exists on the endpoint and has user and group executable permissions.</p><ul><li><p><strong>SH installer</strong>—Run the following command for example:</p><p><strong><code>root@ubuntu:/tmp# ./linuxshell.sh -- --install-path=</code></strong><em><strong><code>/home/customDir</code></strong></em></p></li><li><p><strong>RPM and DEB installers</strong>—</p><p>1. Create a <code>cortex.conf</code> file on the endpoint, under <code>/ect/panw/</code></p><p>2. Add to the <code>cortex.conf</code> your custom directory parameter, for example:</p><p><strong><code>--install-path=</code></strong><em><strong><code>/home/customDir</code></strong></em></p></li></ul><p>If you are installing Cortex XDR to a custom directory on SELinux enabled systems, ensure:</p><p>1. The custom installation directory must have an SELinux context that allows:</p><ul><li>File execution (execute permission)</li><li>Library loading (execute permission for shared libraries)</li></ul><p>Recommended contexts:</p><ul><li>usr_t - Standard user application files</li><li>bin_t - Executable binaries (for the bin/ subdirectory)</li></ul><p>2. Pre-Installation Steps</p><p><strong>Option A: Set context on the parent directory (Recommended)</strong></p><p>Before installation, configure the SELinux file context for the custom directory.</p><p>Example: If installing to <code>/data/cortex/traps</code>, set the context for the entire directory tree:</p><p><code>sudo semanage fcontext -a -t usr_t "/data/cortex(/.</code><em><code>)?"</code></em></p><p><em><code>sudo mkdir -p /data/cortex</code></em></p><p><em><code>sudo restorecon -Rv /data/cortex</code></em></p><p><em><strong>Option B: Set context after installation</strong></em></p><p><em>If the agent is already installed but failing to start, set <code>bin_t</code> context for executable binaries:</em></p><p><em><code>sudo semanage fcontext -a -t bin_t "/data/cortex/traps/bin(/.</code></em><code>)?"sudo restorecon -Rv /data/cortex/traps/bin</code></p><p>3. Verification - After setting the contexts, verify they are applied correctly.</p><p>Check the context of the installation directory:</p><p><code>ls -laZ /data/cortex/traps/</code></p><p>Check the context of binaries:</p><p><code>ls -laZ /data/cortex/traps/bin/</code></p><p>Expected output should show <code>bin_t</code> or <code>usr_t</code>, NOT default_t</p><p>Example: <code>-rwx------. root root system_u:object_r:bin_t:s0 pmd</code></p><p>4. Verify Cortex XDR agent starts successfully</p><p>Start the agent</p><p><code>sudo systemctl start traps_pmd</code></p><p>Check status</p><p><code>sudo systemctl status traps_pmd</code></p><p>Check for SELinux denials</p><p><code>sudo ausearch -m avc -ts recent</code></p></td></tr><tr><td><strong><code>-- --proxy-list ”</code></strong><em><strong><code>&#x3C;proxyserver></code></strong></em><strong><code>:</code></strong><em><strong><code>&#x3C;port></code></strong></em><strong><code>”</code></strong></td><td><p><strong>Proxy Communication</strong></p><p>Configure the Cortex XDR agent to communicate through an intermediary such as a proxy or the Palo Alto Networks Broker Service.</p><p>To enable the agent to direct communication to an intermediary, you use this installation option to assign the IP address and port number you want the Cortex XDR agent to use. You can also configure the proxy by entering the FQDN and port number. When you enter the FQDN, you can use both lowercase and uppercase letters. Avoid using special characters or spaces.</p><p>Use commas to separate multiple addresses. For example:</p><p><strong><code>-- --proxy-list "My.Network.Name:808, 10.196.20.244:8080"</code></strong></p><p>You can assign up to five different proxies per agent, and the proxy for communication is selected randomly with equal probability.</p><p>To enable the agent to use the Broker Service, you must set up broker VM in your network and use this option to assign the agent the Broker VM IP address with port number 8888.</p><p>After the initial installation, you can change the proxy settings from Cortex XDR.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The Cortex XDR agent does not support proxy communication in environments where proxy authentication is required.</p></div></td></tr><tr><td><p>VM Template</p><p><strong><code>--vm-template</code></strong></p><p>Temporary session</p><p><strong><code>--temporary-session</code></strong></p></td><td><p><strong>Virtual Installation</strong></p><p>Deploy Cortex XDR agents on virtual Linux endpoints as temporary instances, ensuring the Cortex XDR agent license returns back to the license pool after 90 minutes of session inactivity and improving your network temporary workloads. Choose your preferred workflow:</p><p><strong>Pre-install</strong>—Install the Cortex XDR agent only on the Linux endpoint you are using to create the VM template. Every instance you create using this template, will include the pre-installed Cortex XDR agent. For example:</p><p><code>$ ./installer.sh -- --vm-template</code></p><p><strong>Fresh install</strong>—Install the Cortex XDR agent on the Linux VM after creating the VM template, as part of provisioning. For example:</p><p><code>$ ./installer.sh -- --temporary-session</code></p></td></tr><tr><td><strong><code>-- --restrict=</code></strong><em><strong><code>&#x3C;flag></code></strong></em></td><td><p><strong>Disable Live Terminal, script execution, and file retrieval on the endpoint</strong></p><p>Use to permanently disable the option for Cortex XDR to perform all, or a combination, of the following actions on endpoints running a Cortex XDR agent: initiate a remote session on the endpoint, (see Run Scripts on an Endpoint), and from the endpoint to the management console.</p><div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Caution</strong></p><p>Disabling any of these actions is an irreversible action, so if you later want to enable the action on the endpoint, you must uninstall the Cortex XDR agent and install a new package without this flag.</p></div><p>To disable all actions, use the corresponding flag: <strong><code>--restrict=all</code></strong></p><p>To disable a specific action, use the corresponding flag:</p><ul><li><strong><code>--restrict=live_terminal</code></strong>—Use to disable Live Terminal.</li><li><strong><code>--restrict=script_execution</code></strong>—Use to disable script execution.</li><li><strong><code>--restrict=file_retrieval</code></strong>—Use to disable file retrieval.</li></ul><p>To disable more than one option, use any combination of these flags.</p></td></tr><tr><td><strong><code>-- --endpoint-tags`` ``</code></strong><em><strong><code>&#x3C;tag></code></strong></em></td><td><p><strong>Add Endpoint Tags</strong></p><p>Add tags to the endpoint tags list.</p><ul><li><p><strong>SH installer</strong>—Run the following command for example:</p><p><strong><code>traps_linux.sh -- --endpoint-tags </code></strong><em><strong><code>tag1,tag2,tag3</code></strong></em></p><p>Spaces in tags are not allowed, if spaces are required, use the configuration file method below.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The double dash (--) before the --endpoint-tags argument is mandatory, and the argument and the value must be separated by a space.</p></div></li><li><p><strong>RPM/DEB/Shell installers</strong>—</p><p>1. Create a <code>cortex.conf</code> file on the endpoint, under <code>/ect/panw/</code></p><p>2. Add to the <code>cortex.conf</code> your custom directory parameter, for example:</p><p><strong><code>--endpoint-tags </code></strong><em><strong><code>tag1,tag2,tag3</code></strong></em></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If one or more tags contains spaces, the entire tags string must be enclosed in quotes ("), for example: <strong><code>--endpoint-tags "tag1,tag multi word2,tag3"</code></strong>.</p></div></li></ul></td></tr></tbody></table>

    | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

--no-km│Without Kernel Module Installation

Use the --no-km option if you do not want to install the Cortex XDR agent kernel module. If you install the agent without the Cortex XDR kernel module or your Linux server runs an unsupported kernel version, the Cortex XDR agent will operate in asynchronous mode.

--install-path=</custom/path>│Custom Agent Installation Directory

Install the Cortex XDR agent in a custom directory on the endpoint instead of using the default ./opt directory. Custom installation directory is a persistent change, and after you install the Cortex XDR to the custom path, all following upgrades and the removal of the agent from the endpoint are executed in the same location.

Before you start, ensure the custom directory exists on the endpoint and has user and group executable permissions.

SH installer—Run the following command for example:
root@ubuntu:/tmp# ./linuxshell.sh -- --install-path=/home/customDir
RPM and DEB installers—
1. Create a cortex.conf file on the endpoint, under /ect/panw/
2. Add to the cortex.conf your custom directory parameter, for example:
--install-path=/home/customDir

If you are installing Cortex XDR to a custom directory on SELinux enabled systems, ensure:

1. The custom installation directory must have an SELinux context that allows:

File execution (execute permission)
Library loading (execute permission for shared libraries)

Recommended contexts:

usr_t - Standard user application files
bin_t - Executable binaries (for the bin/ subdirectory)

2. Pre-Installation Steps

Option A: Set context on the parent directory (Recommended)

Before installation, configure the SELinux file context for the custom directory.

Example: If installing to /data/cortex/traps, set the context for the entire directory tree:

sudo semanage fcontext -a -t usr_t "/data/cortex(/.)?"

sudo mkdir -p /data/cortex

sudo restorecon -Rv /data/cortex

Option B: Set context after installation

If the agent is already installed but failing to start, set bin_t context for executable binaries:

sudo semanage fcontext -a -t bin_t "/data/cortex/traps/bin(/.)?"sudo restorecon -Rv /data/cortex/traps/bin

3. Verification - After setting the contexts, verify they are applied correctly.

Check the context of the installation directory:

ls -laZ /data/cortex/traps/

Check the context of binaries:

ls -laZ /data/cortex/traps/bin/

Expected output should show bin_t or usr_t, NOT default_t

Example: -rwx------. root root system_u:object_r:bin_t:s0 pmd

4. Verify Cortex XDR agent starts successfully

Start the agent

sudo systemctl start traps_pmd

Check status

sudo systemctl status traps_pmd

Check for SELinux denials

sudo ausearch -m avc -ts recent

-- --proxy-list ”<proxyserver>:<port>”│

Proxy Communication

Configure the Cortex XDR agent to communicate through an intermediary such as a proxy or the Palo Alto Networks Broker Service.

To enable the agent to direct communication to an intermediary, you use this installation option to assign the IP address and port number you want the Cortex XDR agent to use. You can also configure the proxy by entering the FQDN and port number. When you enter the FQDN, you can use both lowercase and uppercase letters. Avoid using special characters or spaces.

Use commas to separate multiple addresses. For example:

-- --proxy-list "My.Network.Name:808, 10.196.20.244:8080"

You can assign up to five different proxies per agent, and the proxy for communication is selected randomly with equal probability.

To enable the agent to use the Broker Service, you must set up broker VM in your network and use this option to assign the agent the Broker VM IP address with port number 8888.

After the initial installation, you can change the proxy settings from Cortex XDR.

Note

The Cortex XDR agent does not support proxy communication in environments where proxy authentication is required.

VM Template

--vm-template

Temporary session

--temporary-session

│Virtual Installation

Deploy Cortex XDR agents on virtual Linux endpoints as temporary instances, ensuring the Cortex XDR agent license returns back to the license pool after 90 minutes of session inactivity and improving your network temporary workloads. Choose your preferred workflow:

Pre-install—Install the Cortex XDR agent only on the Linux endpoint you are using to create the VM template. Every instance you create using this template, will include the pre-installed Cortex XDR agent. For example:

$ ./installer.sh -- --vm-template

Fresh install—Install the Cortex XDR agent on the Linux VM after creating the VM template, as part of provisioning. For example:

$ ./installer.sh -- --temporary-session

-- --restrict=<flag>│Disable Live Terminal, script execution, and file retrieval on the endpoint

Use to permanently disable the option for Cortex XDR to perform all, or a combination, of the following actions on endpoints running a Cortex XDR agent: initiate a remote session on the endpoint, (see Run Scripts on an Endpoint), and from the endpoint to the management console.

Caution

Disabling any of these actions is an irreversible action, so if you later want to enable the action on the endpoint, you must uninstall the Cortex XDR agent and install a new package without this flag.

To disable all actions, use the corresponding flag: --restrict=all

To disable a specific action, use the corresponding flag:

--restrict=live_terminal—Use to disable Live Terminal.
--restrict=script_execution—Use to disable script execution.
--restrict=file_retrieval—Use to disable file retrieval.

To disable more than one option, use any combination of these flags.

-- --endpoint-tags <tag>│

Add Endpoint Tags

Add tags to the endpoint tags list.

SH installer—Run the following command for example:
traps_linux.sh -- --endpoint-tags tag1,tag2,tag3
Spaces in tags are not allowed, if spaces are required, use the configuration file method below.
Note
The double dash (--) before the --endpoint-tags argument is mandatory, and the argument and the value must be separated by a space.
RPM/DEB/Shell installers—
1. Create a cortex.conf file on the endpoint, under /ect/panw/
2. Add to the cortex.conf your custom directory parameter, for example:
--endpoint-tags tag1,tag2,tag3
Note
If one or more tags contains spaces, the entire tags string must be enclosed in quotes ("), for example: --endpoint-tags "tag1,tag multi word2,tag3".

5. (For Kernel Mode only) Load SecureBoot Certificates.

    If you enabled the SecureBoot kernel, perform the following to add the Cortex XDR kernel module certificate, available for:

    If you enabled the SecureBoot kernel, perform the following to add the Cortex XDR kernel module certificate, available for:

• RHEL 8, AlmaLinux 8, RockyLinux 8, Oracle 8 and later

• Ubuntu 18 and later

• SLES 15 and later

Show markdown source

@@ -60,21 +60,17 @@ To install a Cortex XDR agent:
     **To deploy using package manager:**
 
     1. (Optional) For Linux distributions RHEL, CentOS, Oracle, or SUSE that have signature-checking configured or you would like to manually check the integrity of the Cortex XDR package:
        1. Download the [Cortex XDR Public Key](#cortex-xdr-public-key).
        2. Unzip the public key by running **`unzip cortex-xdr-agent.zip`**.
        3. Import the public key by running **`rpm --import cortex-xdr-agent.asc`**.
     2. Depending on your Linux distribution, install the Cortex XDR agent using one of the following commands:
 
-    | Distribution            | Install Command                                                                                  |
-    | ----------------------- | ------------------------------------------------------------------------------------------------ |
-    | RHEL, CentOS, or Oracle | **`yum install ./`**_**`filename`**_**`.rpm`** or **`rpm -i ./`**_**`filename`**_**`.rpm`**      |
-    | Ubuntu or Debian        | **`apt-get install ./`**_**`filename`**_**`.deb`** or **`dpkg -i ./`**_**`filename`**_**`.deb`** |
-    | SUSE                    | **`zypper install ./`**_**`filename`**_**`.rpm`** or **`rpm -i ./`**_**`filename`**_**`.rpm`**   |
+    <table><thead><tr><th width="257.5816650390625">Distribution</th><th>Install Command</th></tr></thead><tbody><tr><td>RHEL, CentOS, or Oracle</td><td><strong><code>yum install ./</code></strong><em><strong><code>filename</code></strong></em><strong><code>.rpm</code></strong> or <strong><code>rpm -i ./</code></strong><em><strong><code>filename</code></strong></em><strong><code>.rpm</code></strong></td></tr><tr><td>Ubuntu or Debian</td><td><strong><code>apt-get install ./</code></strong><em><strong><code>filename</code></strong></em><strong><code>.deb</code></strong> or <strong><code>dpkg -i ./</code></strong><em><strong><code>filename</code></strong></em><strong><code>.deb</code></strong></td></tr><tr><td>SUSE</td><td><strong><code>zypper install ./</code></strong><em><strong><code>filename</code></strong></em><strong><code>.rpm</code></strong> or <strong><code>rpm -i ./</code></strong><em><strong><code>filename</code></strong></em><strong><code>.rpm</code></strong></td></tr></tbody></table>
 
     3. Verify the agent was installed on the endpoint.
 
     Enter the following command on the endpoint:
 
     **`dpkg -l | grep cortex-agent`** or **`rpm -qa | grep cortex-agent`**. **To deploy the shell installer:**
 
     1. Enable execution of the script using the **` chmod +x`` `` `**_**`filename`**_ command.
@@ -140,24 +136,17 @@ To install a Cortex XDR agent:
     <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If you are using <code>rpm</code>, <code>deb</code> or <code>sh</code> installers, you must also add these parameters to the <code>/etc/panw/cortex.conf</code> file prior to installation.</p></div>
 
     Make sure to remove the first couple of leading double dashes. For example, instead of :**`-- --proxy-list ”`**_**`<proxyserver>`**_**`:`**_**`<port>`**_**`”`**, add this: **`--proxy-list="10.196.21.223:808"`**.
 
     Applies to:
 
     **`--proxy-list="10.196.21.223:808" --no-km --restrict=live_terminal`**
 
-    | Option                                                                                                                                               | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-    | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-    | **`--no-km`**                                                                                                                                        | <p><strong>Without Kernel Module Installation</strong></p><p>Use the <strong><code>--no-km</code></strong> option if you do not want to install the Cortex XDR agent kernel module. If you install the agent without the Cortex XDR kernel module or your Linux server runs an unsupported kernel version, the Cortex XDR agent will operate in asynchronous mode.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-    | **`--install-path=`**_**`</custom/path>`**_                                                                                                          | <p><strong>Custom Agent Installation Directory</strong></p><p>Install the Cortex XDR agent in a custom directory on the endpoint instead of using the default <code>./opt</code> directory. Custom installation directory is a persistent change, and after you install the Cortex XDR to the custom path, all following upgrades and the removal of the agent from the endpoint are executed in the same location.</p><p>Before you start, ensure the custom directory exists on the endpoint and has user and group executable permissions.</p><ul><li><p><strong>SH installer</strong>—Run the following command for example:</p><p><strong><code>root@ubuntu:/tmp# ./linuxshell.sh -- --install-path=</code></strong><em><strong><code>/home/customDir</code></strong></em></p></li><li><p><strong>RPM and DEB installers</strong>—</p><p>1. Create a <code>cortex.conf</code> file on the endpoint, under <code>/ect/panw/</code></p><p>2. Add to the <code>cortex.conf</code> your custom directory parameter, for example:</p><p><strong><code>--install-path=</code></strong><em><strong><code>/home/customDir</code></strong></em></p></li></ul><p>If you are installing Cortex XDR to a custom directory on SELinux enabled systems, ensure:</p><p>1. The custom installation directory must have an SELinux context that allows:</p><ul><li>File execution (execute permission)</li><li>Library loading (execute permission for shared libraries)</li></ul><p>Recommended contexts:</p><ul><li>usr_t - Standard user application files</li><li>bin_t - Executable binaries (for the bin/ subdirectory)</li></ul><p>2. Pre-Installation Steps</p><p><strong>Option A: Set context on the parent directory (Recommended)</strong></p><p>Before installation, configure the SELinux file context for the custom directory.</p><p>Example: If installing to <code>/data/cortex/traps</code>, set the context for the entire directory tree:</p><p><code>sudo semanage fcontext -a -t usr_t "/data/cortex(/.</code><em><code>)?"</code></em></p><p><em><code>sudo mkdir -p /data/cortex</code></em></p><p><em><code>sudo restorecon -Rv /data/cortex</code></em></p><p><em><strong>Option B: Set context after installation</strong></em></p><p><em>If the agent is already installed but failing to start, set <code>bin_t</code> context for executable binaries:</em></p><p><em><code>sudo semanage fcontext -a -t bin_t "/data/cortex/traps/bin(/.</code></em><code>)?"sudo restorecon -Rv /data/cortex/traps/bin</code></p><p>3. Verification - After setting the contexts, verify they are applied correctly.</p><p>Check the context of the installation directory:</p><p><code>ls -laZ /data/cortex/traps/</code></p><p>Check the context of binaries:</p><p><code>ls -laZ /data/cortex/traps/bin/</code></p><p>Expected output should show <code>bin_t</code> or <code>usr_t</code>, NOT default_t</p><p>Example: <code>-rwx------. root root system_u:object_r:bin_t:s0 pmd</code></p><p>4. Verify Cortex XDR agent starts successfully</p><p>Start the agent</p><p><code>sudo systemctl start traps_pmd</code></p><p>Check status</p><p><code>sudo systemctl status traps_pmd</code></p><p>Check for SELinux denials</p><p><code>sudo ausearch -m avc -ts recent</code></p> |
-    | **`-- --proxy-list ”`**_**`<proxyserver>`**_**`:`**_**`<port>`**_**`”`**                                                                             | <p><strong>Proxy Communication</strong></p><p>Configure the Cortex XDR agent to communicate through an intermediary such as a proxy or the Palo Alto Networks Broker Service.</p><p>To enable the agent to direct communication to an intermediary, you use this installation option to assign the IP address and port number you want the Cortex XDR agent to use. You can also configure the proxy by entering the FQDN and port number. When you enter the FQDN, you can use both lowercase and uppercase letters. Avoid using special characters or spaces.</p><p>Use commas to separate multiple addresses. For example:</p><p><strong><code>-- --proxy-list "My.Network.Name:808, 10.196.20.244:8080"</code></strong></p><p>You can assign up to five different proxies per agent, and the proxy for communication is selected randomly with equal probability.</p><p>To enable the agent to use the Broker Service, you must set up broker VM in your network and use this option to assign the agent the Broker VM IP address with port number 8888.</p><p>After the initial installation, you can change the proxy settings from Cortex XDR.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The Cortex XDR agent does not support proxy communication in environments where proxy authentication is required.</p></div>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-    | <p>VM Template</p><p><strong><code>--vm-template</code></strong></p><p>Temporary session</p><p><strong><code>--temporary-session</code></strong></p> | <p><strong>Virtual Installation</strong></p><p>Deploy Cortex XDR agents on virtual Linux endpoints as temporary instances, ensuring the Cortex XDR agent license returns back to the license pool after 90 minutes of session inactivity and improving your network temporary workloads. Choose your preferred workflow:</p><p><strong>Pre-install</strong>—Install the Cortex XDR agent only on the Linux endpoint you are using to create the VM template. Every instance you create using this template, will include the pre-installed Cortex XDR agent. For example:</p><p><code>$ ./installer.sh -- --vm-template</code></p><p><strong>Fresh install</strong>—Install the Cortex XDR agent on the Linux VM after creating the VM template, as part of provisioning. For example:</p><p><code>$ ./installer.sh -- --temporary-session</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-    | **`-- --restrict=`**_**`<flag>`**_                                                                                                                   | <p><strong>Disable Live Terminal, script execution, and file retrieval on the endpoint</strong></p><p>Use to permanently disable the option for Cortex XDR to perform all, or a combination, of the following actions on endpoints running a Cortex XDR agent: initiate a remote session on the endpoint, (see Run Scripts on an Endpoint), and from the endpoint to the management console.</p><div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Caution</strong></p><p>Disabling any of these actions is an irreversible action, so if you later want to enable the action on the endpoint, you must uninstall the Cortex XDR agent and install a new package without this flag.</p></div><p>To disable all actions, use the corresponding flag: <strong><code>--restrict=all</code></strong></p><p>To disable a specific action, use the corresponding flag:</p><ul><li><strong><code>--restrict=live_terminal</code></strong>—Use to disable Live Terminal.</li><li><strong><code>--restrict=script_execution</code></strong>—Use to disable script execution.</li><li><strong><code>--restrict=file_retrieval</code></strong>—Use to disable file retrieval.</li></ul><p>To disable more than one option, use any combination of these flags.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-    | **` -- --endpoint-tags`` `` `**_**`<tag>`**_                                                                                                         | <p><strong>Add Endpoint Tags</strong></p><p>Add tags to the endpoint tags list.</p><ul><li><p><strong>SH installer</strong>—Run the following command for example:</p><p><strong><code>traps_linux.sh -- --endpoint-tags </code></strong><em><strong><code>tag1,tag2,tag3</code></strong></em></p><p>Spaces in tags are not allowed, if spaces are required, use the configuration file method below.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The double dash (--) before the --endpoint-tags argument is mandatory, and the argument and the value must be separated by a space.</p></div></li><li><p><strong>RPM/DEB/Shell installers</strong>—</p><p>1. Create a <code>cortex.conf</code> file on the endpoint, under <code>/ect/panw/</code></p><p>2. Add to the <code>cortex.conf</code> your custom directory parameter, for example:</p><p><strong><code>--endpoint-tags </code></strong><em><strong><code>tag1,tag2,tag3</code></strong></em></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If one or more tags contains spaces, the entire tags string must be enclosed in quotes ("), for example: <strong><code>--endpoint-tags "tag1,tag multi word2,tag3"</code></strong>.</p></div></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+    <table><thead><tr><th width="244.243896484375">Option</th><th>Description</th></tr></thead><tbody><tr><td><strong><code>--no-km</code></strong></td><td><p><strong>Without Kernel Module Installation</strong></p><p>Use the <strong><code>--no-km</code></strong> option if you do not want to install the Cortex XDR agent kernel module. If you install the agent without the Cortex XDR kernel module or your Linux server runs an unsupported kernel version, the Cortex XDR agent will operate in asynchronous mode.</p></td></tr><tr><td><strong><code>--install-path=</code></strong><em><strong><code>&#x3C;/custom/path></code></strong></em></td><td><p><strong>Custom Agent Installation Directory</strong></p><p>Install the Cortex XDR agent in a custom directory on the endpoint instead of using the default <code>./opt</code> directory. Custom installation directory is a persistent change, and after you install the Cortex XDR to the custom path, all following upgrades and the removal of the agent from the endpoint are executed in the same location.</p><p>Before you start, ensure the custom directory exists on the endpoint and has user and group executable permissions.</p><ul><li><p><strong>SH installer</strong>—Run the following command for example:</p><p><strong><code>root@ubuntu:/tmp# ./linuxshell.sh -- --install-path=</code></strong><em><strong><code>/home/customDir</code></strong></em></p></li><li><p><strong>RPM and DEB installers</strong>—</p><p>1. Create a <code>cortex.conf</code> file on the endpoint, under <code>/ect/panw/</code></p><p>2. Add to the <code>cortex.conf</code> your custom directory parameter, for example:</p><p><strong><code>--install-path=</code></strong><em><strong><code>/home/customDir</code></strong></em></p></li></ul><p>If you are installing Cortex XDR to a custom directory on SELinux enabled systems, ensure:</p><p>1. The custom installation directory must have an SELinux context that allows:</p><ul><li>File execution (execute permission)</li><li>Library loading (execute permission for shared libraries)</li></ul><p>Recommended contexts:</p><ul><li>usr_t - Standard user application files</li><li>bin_t - Executable binaries (for the bin/ subdirectory)</li></ul><p>2. Pre-Installation Steps</p><p><strong>Option A: Set context on the parent directory (Recommended)</strong></p><p>Before installation, configure the SELinux file context for the custom directory.</p><p>Example: If installing to <code>/data/cortex/traps</code>, set the context for the entire directory tree:</p><p><code>sudo semanage fcontext -a -t usr_t "/data/cortex(/.</code><em><code>)?"</code></em></p><p><em><code>sudo mkdir -p /data/cortex</code></em></p><p><em><code>sudo restorecon -Rv /data/cortex</code></em></p><p><em><strong>Option B: Set context after installation</strong></em></p><p><em>If the agent is already installed but failing to start, set <code>bin_t</code> context for executable binaries:</em></p><p><em><code>sudo semanage fcontext -a -t bin_t "/data/cortex/traps/bin(/.</code></em><code>)?"sudo restorecon -Rv /data/cortex/traps/bin</code></p><p>3. Verification - After setting the contexts, verify they are applied correctly.</p><p>Check the context of the installation directory:</p><p><code>ls -laZ /data/cortex/traps/</code></p><p>Check the context of binaries:</p><p><code>ls -laZ /data/cortex/traps/bin/</code></p><p>Expected output should show <code>bin_t</code> or <code>usr_t</code>, NOT default_t</p><p>Example: <code>-rwx------. root root system_u:object_r:bin_t:s0 pmd</code></p><p>4. Verify Cortex XDR agent starts successfully</p><p>Start the agent</p><p><code>sudo systemctl start traps_pmd</code></p><p>Check status</p><p><code>sudo systemctl status traps_pmd</code></p><p>Check for SELinux denials</p><p><code>sudo ausearch -m avc -ts recent</code></p></td></tr><tr><td><strong><code>-- --proxy-list ”</code></strong><em><strong><code>&#x3C;proxyserver></code></strong></em><strong><code>:</code></strong><em><strong><code>&#x3C;port></code></strong></em><strong><code>”</code></strong></td><td><p><strong>Proxy Communication</strong></p><p>Configure the Cortex XDR agent to communicate through an intermediary such as a proxy or the Palo Alto Networks Broker Service.</p><p>To enable the agent to direct communication to an intermediary, you use this installation option to assign the IP address and port number you want the Cortex XDR agent to use. You can also configure the proxy by entering the FQDN and port number. When you enter the FQDN, you can use both lowercase and uppercase letters. Avoid using special characters or spaces.</p><p>Use commas to separate multiple addresses. For example:</p><p><strong><code>-- --proxy-list "My.Network.Name:808, 10.196.20.244:8080"</code></strong></p><p>You can assign up to five different proxies per agent, and the proxy for communication is selected randomly with equal probability.</p><p>To enable the agent to use the Broker Service, you must set up broker VM in your network and use this option to assign the agent the Broker VM IP address with port number 8888.</p><p>After the initial installation, you can change the proxy settings from Cortex XDR.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The Cortex XDR agent does not support proxy communication in environments where proxy authentication is required.</p></div></td></tr><tr><td><p>VM Template</p><p><strong><code>--vm-template</code></strong></p><p>Temporary session</p><p><strong><code>--temporary-session</code></strong></p></td><td><p><strong>Virtual Installation</strong></p><p>Deploy Cortex XDR agents on virtual Linux endpoints as temporary instances, ensuring the Cortex XDR agent license returns back to the license pool after 90 minutes of session inactivity and improving your network temporary workloads. Choose your preferred workflow:</p><p><strong>Pre-install</strong>—Install the Cortex XDR agent only on the Linux endpoint you are using to create the VM template. Every instance you create using this template, will include the pre-installed Cortex XDR agent. For example:</p><p><code>$ ./installer.sh -- --vm-template</code></p><p><strong>Fresh install</strong>—Install the Cortex XDR agent on the Linux VM after creating the VM template, as part of provisioning. For example:</p><p><code>$ ./installer.sh -- --temporary-session</code></p></td></tr><tr><td><strong><code>-- --restrict=</code></strong><em><strong><code>&#x3C;flag></code></strong></em></td><td><p><strong>Disable Live Terminal, script execution, and file retrieval on the endpoint</strong></p><p>Use to permanently disable the option for Cortex XDR to perform all, or a combination, of the following actions on endpoints running a Cortex XDR agent: initiate a remote session on the endpoint, (see Run Scripts on an Endpoint), and from the endpoint to the management console.</p><div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Caution</strong></p><p>Disabling any of these actions is an irreversible action, so if you later want to enable the action on the endpoint, you must uninstall the Cortex XDR agent and install a new package without this flag.</p></div><p>To disable all actions, use the corresponding flag: <strong><code>--restrict=all</code></strong></p><p>To disable a specific action, use the corresponding flag:</p><ul><li><strong><code>--restrict=live_terminal</code></strong>—Use to disable Live Terminal.</li><li><strong><code>--restrict=script_execution</code></strong>—Use to disable script execution.</li><li><strong><code>--restrict=file_retrieval</code></strong>—Use to disable file retrieval.</li></ul><p>To disable more than one option, use any combination of these flags.</p></td></tr><tr><td><strong><code>-- --endpoint-tags`` ``</code></strong><em><strong><code>&#x3C;tag></code></strong></em></td><td><p><strong>Add Endpoint Tags</strong></p><p>Add tags to the endpoint tags list.</p><ul><li><p><strong>SH installer</strong>—Run the following command for example:</p><p><strong><code>traps_linux.sh -- --endpoint-tags </code></strong><em><strong><code>tag1,tag2,tag3</code></strong></em></p><p>Spaces in tags are not allowed, if spaces are required, use the configuration file method below.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The double dash (--) before the --endpoint-tags argument is mandatory, and the argument and the value must be separated by a space.</p></div></li><li><p><strong>RPM/DEB/Shell installers</strong>—</p><p>1. Create a <code>cortex.conf</code> file on the endpoint, under <code>/ect/panw/</code></p><p>2. Add to the <code>cortex.conf</code> your custom directory parameter, for example:</p><p><strong><code>--endpoint-tags </code></strong><em><strong><code>tag1,tag2,tag3</code></strong></em></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If one or more tags contains spaces, the entire tags string must be enclosed in quotes ("), for example: <strong><code>--endpoint-tags "tag1,tag multi word2,tag3"</code></strong>.</p></div></li></ul></td></tr></tbody></table>
 5.  (For Kernel Mode only) Load SecureBoot Certificates.
 
     If you enabled the SecureBoot kernel, perform the following to add the Cortex XDR kernel module certificate, available for:
 
     * RHEL 8, AlmaLinux 8, RockyLinux 8, Oracle 8 and later
     * Ubuntu 18 and later
     * SLES 15 and later

▸ Troubleshooting Resources for Linux modified +1 −6 The resources table became an HTML table, keeping the same pmd/dypd process, log path and kernel module entries. agent/cortex-xdr-agent-for-linux/troubleshooting-resources-for-linux

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,9 @@

---

description: >-

Refer to the following troubleshooting resources for the Cortex XDR agent for

Linux.

---

# Troubleshooting Resources for Linux

Resource│Description


Resource	Description
Services and Processes	Services: `/opt/traps/bin/pmd`‑ Running with root privileges. Processes: `/opt/traps/bin/dypd` or `/opt/traps/bin/dypdng` (depending on the Linux kernel version) - Running with root privileges, `pmd` starts and stops a single `dypd` helper process. `/opt/traps/analyzerd/clad`- Unprivileged process running inside the sandbox, `pmd` starts and stops a single `analyzerd` helper process. `/opt/traps/analyzerd/spmd`‑ Unprivileged process running inside the sandbox, `pmd` starts and stops a single `analyzerd` helper process. `/opt/traps/python/payload/lted`‑ Unprivileged process running inside the sandbox, `pmd` starts and stops multiple `lted` processes on demand. `/opt/traps/python/payload/pyxd`
Memory usage of lted processes	All `lted` instances are forks of the same process, sharing most of the physical memory pages. Using `ps` and sum of RSS of all `lted` instances could be misleading, since the same shared memory pages will be counted several times. The correct way to analyze memory usage of `lted` processes is using PSS (Proportional set size), which can be calculated by the `smem` utility.
Cortex XDR agent logs	Indicates information, warnings, and errors related to Cortex XDR that are stored on the endpoint, accessible to privileged users only. Installation logs: `/var/log/traps-install.log` Agent logs: `/var/log/traps/`
Kernel Module	The installed Cortex XDR agent kernel module. Kernel modules are updated through Content updates. See the admin guide for more information about content updates. Latest content releases are listed here. For supported Kernel Modules see here. /lib/modules/$<`uname -r`>/traps/traps.ko

| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Services and Processes│

Services:

/opt/traps/bin/pmd‑ Running with root privileges.

Processes:

/opt/traps/bin/dypd or /opt/traps/bin/dypdng (depending on the Linux kernel version) - Running with root privileges, pmd starts and stops a single dypd helper process.
/opt/traps/analyzerd/clad- Unprivileged process running inside the sandbox, pmd starts and stops a single analyzerd helper process.
/opt/traps/analyzerd/spmd‑ Unprivileged process running inside the sandbox, pmd starts and stops a single analyzerd helper process.
/opt/traps/python/payload/lted‑ Unprivileged process running inside the sandbox, pmd starts and stops multiple lted processes on demand.
/opt/traps/python/payload/pyxd

Memory usage of lted processes│All lted instances are forks of the same process, sharing most of the physical memory pages. Using ps and sum of RSS of all lted instances could be misleading, since the same shared memory pages will be counted several times. The correct way to analyze memory usage of lted processes is using PSS (Proportional set size), which can be calculated by the smem utility.

Cortex XDR agent logs│

Indicates information, warnings, and errors related to Cortex XDR that are stored on the endpoint, accessible to privileged users only.

Installation logs: /var/log/traps-install.log
Agent logs: /var/log/traps/

Kernel Module│

The installed Cortex XDR agent kernel module. Kernel modules are updated through Content updates. See the admin guide for more information about content updates. Latest content releases are listed here.

For supported Kernel Modules see here.

/lib/modules/$<uname -r>/traps/traps.ko

Show markdown source

@@ -1,14 +1,9 @@
 ---
 description: >-
   Refer to the following troubleshooting resources for the Cortex XDR agent for
   Linux.
 ---
 
 # Troubleshooting Resources for Linux
 
-| Resource                       | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Services and Processes         | <p>Services:</p><ul><li><code>/opt/traps/bin/pmd</code>‑ Running with root privileges.</li></ul><p>Processes:</p><ul><li><code>/opt/traps/bin/dypd</code> or <code>/opt/traps/bin/dypdng</code> (depending on the Linux kernel version) - Running with root privileges, <code>pmd</code> starts and stops a single <code>dypd</code> helper process.</li><li><code>/opt/traps/analyzerd/clad</code>- Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops a single <code>analyzerd</code> helper process.</li><li><code>/opt/traps/analyzerd/spmd</code>‑ Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops a single <code>analyzerd</code> helper process.</li><li><code>/opt/traps/python/payload/lted</code>‑ Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops multiple <code>lted</code> processes on demand.</li><li><code>/opt/traps/python/payload/pyxd</code></li></ul> |
-| Memory usage of lted processes | All `lted` instances are forks of the same process, sharing most of the physical memory pages. Using `ps` and sum of RSS of all `lted` instances could be misleading, since the same shared memory pages will be counted several times. The correct way to analyze memory usage of `lted` processes is using PSS (Proportional set size), which can be calculated by the `smem` utility.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| Cortex XDR agent logs          | <p>Indicates information, warnings, and errors related to Cortex XDR that are stored on the endpoint, accessible to privileged users only.</p><ul><li>Installation logs: <code>/var/log/traps-install.log</code></li><li>Agent logs: <code>/var/log/traps/</code></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| Kernel Module                  | <p>The installed Cortex XDR agent kernel module. Kernel modules are updated through Content updates. See the admin guide for more information about content updates. Latest content releases are listed <a href="https://app.gitbook.com/s/JZVikp6ohjY6qBMfKrfn/">here</a>.</p><p>For supported Kernel Modules see <a href="https://app.gitbook.com/s/y29o8lwSBpbfPbvztsyt/#find-a-supported-kernel">here</a>.</p><ul><li>/lib/modules/$&#x3C;<strong><code>uname -r</code></strong>>/traps/traps.ko</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+<table data-header-hidden><thead><tr><th width="305.7352294921875"></th><th></th></tr></thead><tbody><tr><td>Resource</td><td>Description</td></tr><tr><td>Services and Processes</td><td><p>Services:</p><ul><li><code>/opt/traps/bin/pmd</code>‑ Running with root privileges.</li></ul><p>Processes:</p><ul><li><code>/opt/traps/bin/dypd</code> or <code>/opt/traps/bin/dypdng</code> (depending on the Linux kernel version) - Running with root privileges, <code>pmd</code> starts and stops a single <code>dypd</code> helper process.</li><li><code>/opt/traps/analyzerd/clad</code>- Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops a single <code>analyzerd</code> helper process.</li><li><code>/opt/traps/analyzerd/spmd</code>‑ Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops a single <code>analyzerd</code> helper process.</li><li><code>/opt/traps/python/payload/lted</code>‑ Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops multiple <code>lted</code> processes on demand.</li><li><code>/opt/traps/python/payload/pyxd</code></li></ul></td></tr><tr><td>Memory usage of lted processes</td><td>All <code>lted</code> instances are forks of the same process, sharing most of the physical memory pages. Using <code>ps</code> and sum of RSS of all <code>lted</code> instances could be misleading, since the same shared memory pages will be counted several times. The correct way to analyze memory usage of <code>lted</code> processes is using PSS (Proportional set size), which can be calculated by the <code>smem</code> utility.</td></tr><tr><td>Cortex XDR agent logs</td><td><p>Indicates information, warnings, and errors related to Cortex XDR that are stored on the endpoint, accessible to privileged users only.</p><ul><li>Installation logs: <code>/var/log/traps-install.log</code></li><li>Agent logs: <code>/var/log/traps/</code></li></ul></td></tr><tr><td>Kernel Module</td><td><p>The installed Cortex XDR agent kernel module. Kernel modules are updated through Content updates. See the admin guide for more information about content updates. Latest content releases are listed <a href="https://app.gitbook.com/s/JZVikp6ohjY6qBMfKrfn/">here</a>.</p><p>For supported Kernel Modules see <a href="https://app.gitbook.com/s/y29o8lwSBpbfPbvztsyt/#find-a-supported-kernel">here</a>.</p><ul><li>/lib/modules/$&#x3C;<strong><code>uname -r</code></strong>>/traps/traps.ko</li></ul></td></tr></tbody></table>

▸ Cytool for Linux modified +1 −24 All 23 cytool command-option rows were re-emitted as one HTML table; no option was added or removed. agent/cortex-xdr-agent-for-linux/troubleshooting-resources-for-linux/cytool-for-linux

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -12,32 +12,9 @@ Cytool is a command-line tool that is integrated into the Cortex XDR agent that

The following table displays the Cytool options available on Linux endpoints. Where there is a password required for admin commands, this is the same password as was defined as the Uninstall Password.

hint info

### Note

Since Cortex XDR agent 7.6, the pmd process includes and replaces the trapsd process.

endhint

Command Option│Description


Command Option	Description
`adaptive_policy`	Adaptive policy agent commands. Usage: `cytool adaptive_policy [<interval> <collect_stats> <recalc> <query>]` where: `interval` —Sets a recalculation interval override (in seconds), or reset an override. Options are: `seconds`, `policy` `collect_stats` —Initiates a collection of internal statistics. `recalc` —Triggers a recalculation of the adaptive policy. `query` —Query the current interval and APEX.
`anti_malware`	Perform Anti Malware related operations. [version <query> \| cache <print, status>] Usage: `cytool anti_malware` `<version>` `<cache>` where: version — Input: `query` cache — Input: `print` `status` la, wf, and ltee are for internal use.
`cert_enforcement`	Perform Certificate enforcement related operations. Usage: `cytool cert_enforcement <operation>` Where <operation> is one of the following: query Display current enforcement status disable Forcibly disable enforcement policy Set enforcement by policy import <certificate file path> Import a proprietary certificate in PEM format as root CA import clear Clear all custom root CA certificates.
`checkin`	Initiate check-in to the server. Usage: `cytool checkin` To verify the check in, view the check-in time on the Cortex XDR agent console.
`connectivity_test`	Perform a connectivity test to Cortex XDR servers. Usage: `cytool connectivity_test [request_count]`
`dump`	Enable/disable dump generation or restore policy settings. Usage: `cytool dump enable` `cytool dump disable` `cytool dump restore`
`endpoint_tags`	Usage: `cytool endpoint_tags` `<action>` where <action> can be: add—To add tags to the endpoint tags. remove—Remove the given tags from the list of endpoint tags. list—Displays the available endpoint tags. Note Tags should be passed as one string separated by comas. Linux does not support tag names with spaces as command line arguments to the shell installer. Instead, tags can be set in the `/etc/panw/cortex.conf` configuration file, that supports all Linux installers. For example: `cytool endpoint_tags add "tag1[,tag2,...,tagN]"` `cytool endpoint_tags remove "tag1[,tag2,...,tagN]"` `cytool endpoint_tags list`
`enum`	Enumerate protected processes. Usage: `cytool enum` For example: `root@ubuntu: cytool enum ----------------------------------- Cortex XDR list of protected processes: ----------------------------------- PID CMD UID 1098 /usr/sbin/cron -f 0 1131 /usr/sbin/rsyslogd -n 104` To view processes for all users including those initiated by the operating system, specify the `/a` option. Note If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes; only then you will see them on this list.
`event_collection`	Stop or start event collection status (EDR/DSE). <query, enable, disable, logstat>
`health`	Shows the agent status, protection level and connectivity.
`-h --help`	Displays the available help information
`import suex`	Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.
`isolate stop`	Release machine from network isolation.
`last_checkin`	Display last successful check-in time.
`log`	Set the log level for the desired process. Usage: `cytool log set_level <log_level> <components>` where: `<log_level>` is an integer value corresponding to the log level: 0—Disable logging 1—Fatal 2—Critical 3—Error 4—Warning 5—Notice 6—Information 7—Debug 8—Trace `<components>` is `all` or one or more of the following agent components: `authorized`, `pmd`, `cortex xdr`, `kproc-ctrl`. For example: `cytool log set_level 2 all` Then use the `cytool log collect` command to generate a support file.
`log collect`	Generate support file archive of all logs in a TGZ file.
`persist`	The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events. Use cytool persist operations to import, export, and view information stored in the local database. Usage: `cytool persist <action>` where <action>: `list`—List the local databases on the endpoint. **`export [
`queryall`	The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.
`reconnect`	Try reconnecting to the server if communication has been disabled, or force registration with a new `distribution_id`. Usage: `cytool reconnect`—Reconnects the Cortex XDR agent to the management application on the server. `cytool reconnect [force <distribution_id]>` Note The `distribution_id` must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.
`runtime`	Stop or start product components. Usage: `cytool runtime <action> <component>` where: `<action>`—Change startup runtime action for an agent component. Options are: `start`, `stop`, `query`. The query option displays the startup status for each component. `<component>`—Target components for which to set the runtime action, or `all` components. To change the runtime action for multiple components, list them with spaces separating each component. Options: `cortex xdr`, `authorized`, `pmd`, `kproc-ctrl` For example: cytool runtime query Name PID User Status Command cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl cytool runtime stop all Name PID User Status Command authorized N/A N/A STOPPED N/A pmd N/A N/A STOPPED N/A cortex xdr N/A N/A STOPPED N/A kproc-ctrl N/A N/A Unloaded N/A cytool runtime start all Name PID User Status Command system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768 authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd cortex xdr N/A N/A FAILED TO START N/A kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl
`scan`	Perform Scan operations on the endpoint. Options: `start`, `stop`, `query`
`startup`	Enable, disable, or query the startup state of Cortex XDR agent components. Usage: `cytool startup` `<action>` `<component>` where: `<action>`—Change startup action for an agent component. Options are: `enable`, `disable`, `query`. The query option displays the startup status for each component. `<component>`—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: `cortex xdr`, `authorized`, `pmd`, `kproc-ctrl` For example: `root@ubuntu: sudo ./cytool startup disable cortex xdr pmd Process name Startup status cortex xdr Disabled authorized Enabled pmd Disabled kproc-ctrl Loaded root@ubuntu: sudo ./cytool startup enable all Process name Startup status cortex xdr Enabled authorized Enabled pmd Enabled kproc-ctrl Loaded`

| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

adaptive_policy│

Adaptive policy agent commands.

Usage: cytool adaptive_policy [<interval> <collect_stats> <recalc> <query>]

where:

interval —Sets a recalculation interval override (in seconds), or reset an override. Options are: seconds, policy
collect_stats —Initiates a collection of internal statistics.
recalc —Triggers a recalculation of the adaptive policy.
query —Query the current interval and APEX.

anti_malware│Perform Anti Malware related operations.

[version <query>

│cache <print, status>]Usage: cytool anti_malware <version> <cache>where:<ul><li>version — Input: query</li><li>cache — Input: print status</li><li>la, wf, and ltee are for internal use.</li></ul>

cert_enforcement│

Perform Certificate enforcement related operations.

Usage: cytool cert_enforcement <operation>

Where <operation> is one of the following:

query Display current enforcement status
disable Forcibly disable enforcement
policy Set enforcement by policy
import <certificate file path> Import a proprietary certificate in PEM format as root CA
import clear Clear all custom root CA certificates.

checkin│Initiate check-in to the server.

Usage: cytool checkin

To verify the check in, view the check-in time on the Cortex XDR agent console.

connectivity_test│Perform a connectivity test to Cortex XDR servers.

Usage: cytool connectivity_test [request_count]

dump│

Enable/disable dump generation or restore policy settings.

Usage:

cytool dump enable
cytool dump disable
cytool dump restore

endpoint_tags│

Usage: cytool endpoint_tags <action>

where <action> can be:

add—To add tags to the endpoint tags.
remove—Remove the given tags from the list of endpoint tags.
list—Displays the available endpoint tags.

Note

Tags should be passed as one string separated by comas.

Linux does not support tag names with spaces as command line arguments to the shell installer.

Instead, tags can be set in the /etc/panw/cortex.conf configuration file, that supports all Linux installers.

For example:

cytool endpoint_tags add "tag1[,tag2,...,tagN]"
cytool endpoint_tags remove "tag1[,tag2,...,tagN]"
cytool endpoint_tags list

enum│

Enumerate protected processes.

Usage: cytool enum

For example:

root@ubuntu: cytool enum ----------------------------------- Cortex XDR list of protected processes: ----------------------------------- PID CMD UID 1098 /usr/sbin/cron -f 0 1131 /usr/sbin/rsyslogd -n 104

To view processes for all users including those initiated by the operating system, specify the /a option.

Note

If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes; only then you will see them on this list.

event_collection│Stop or start event collection status (EDR/DSE).

<query, enable, disable, logstat>

health│Shows the agent status, protection level and connectivity.

-h --help│Displays the available help information

import suex│Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.

isolate stop│Release machine from network isolation.

last_checkin│Display last successful check-in time.

log│Set the log level for the desired process.

Usage: cytool log set_level <log_level> <components>

where:

<log_level> is an integer value corresponding to the log level:
- 0—Disable logging
- 1—Fatal
- 2—Critical
- 3—Error
- 4—Warning
- 5—Notice
- 6—Information
- 7—Debug
- 8—Trace
<components> is all or one or more of the following agent components: authorized, pmd, cortex xdr, kproc-ctrl.

For example:

cytool log set_level 2 all

Then use the cytool log collect command to generate a support file.

log collect│Generate support file archive of all logs in a TGZ file.

persist│

The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events. Use cytool persist operations to import, export, and view information stored in the local database.

Usage: cytool persist <action>

where <action>:

list—List the local databases on the endpoint.
**`export [

queryall│The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.

reconnect│

Try reconnecting to the server if communication has been disabled, or force registration with a new distribution_id.

Usage:

cytool reconnect—Reconnects the Cortex XDR agent to the management application on the server.
cytool reconnect [force <distribution_id]>

Note

The distribution_id must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.

runtime│Stop or start product components.

Usage: cytool runtime <action> <component>

where:

<action>—Change startup runtime action for an agent component.
Options are: start, stop, query. The query option displays the startup status for each component.
<component>—Target components for which to set the runtime action, or all components.
To change the runtime action for multiple components, list them with spaces separating each component.
Options: cortex xdr, authorized, pmd, kproc-ctrl

For example:

cytool runtime query Name PID User Status Command cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl cytool runtime stop all Name PID User Status Command authorized N/A N/A STOPPED N/A pmd N/A N/A STOPPED N/A cortex xdr N/A N/A STOPPED N/A kproc-ctrl N/A N/A Unloaded N/A cytool runtime start all Name PID User Status Command system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768 authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd cortex xdr N/A N/A FAILED TO START N/A kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl

scan│Perform Scan operations on the endpoint.

Options: start, stop, query

startup│Enable, disable, or query the startup state of Cortex XDR agent components.

Usage: cytool startup <action> <component>

where:

<action>—Change startup action for an agent component.
Options are: enable, disable, query.
The query option displays the startup status for each component.
<component>—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: cortex xdr, authorized, pmd, kproc-ctrl

For example:

root@ubuntu: sudo ./cytool startup disable cortex xdr pmd Process name Startup status cortex xdr Disabled authorized Enabled pmd Disabled kproc-ctrl Loaded root@ubuntu: sudo ./cytool startup enable all Process name Startup status cortex xdr Enabled authorized Enabled pmd Enabled kproc-ctrl Loaded

Show markdown source

@@ -12,32 +12,9 @@ Cytool is a command-line tool that is integrated into the Cortex XDR agent that
 The following table displays the Cytool options available on Linux endpoints. Where there is a password required for admin commands, this is the same password as was defined as the Uninstall Password.
 
 {% hint style="info" %}
 ### Note
 
 Since Cortex XDR agent 7.6, the `pmd` process includes and replaces the `trapsd` process.
 {% endhint %}
 
-| Command Option      | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `adaptive_policy`   | <p>Adaptive policy agent commands.</p><p>Usage: <code>cytool adaptive_policy [&#x3C;interval> &#x3C;collect_stats> &#x3C;recalc> &#x3C;query>]</code></p><p>where:</p><ul><li><strong><code>interval</code></strong> —Sets a recalculation interval override (in seconds), or reset an override. Options are: <code>seconds</code>, <code>policy</code></li><li><strong><code>collect_stats</code></strong> —Initiates a collection of internal statistics.</li><li><strong><code>recalc</code></strong> —Triggers a recalculation of the adaptive policy.</li><li><strong><code>query</code></strong> —Query the current interval and APEX.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| **`anti_malware`**  | <p>Perform Anti Malware related operations.</p><p>[version &#x3C;query> | cache &#x3C;print, status>]</p><p>Usage: <strong><code>cytool anti_malware </code></strong><em><strong><code>&#x3C;version></code></strong></em> <em><strong><code>&#x3C;cache></code></strong></em></p><p>where:</p><ul><li>version — Input: <strong><code>query</code></strong></li><li>cache — Input: <strong><code>print</code></strong> <strong><code>status</code></strong></li><li>la, wf, and ltee are for internal use.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `cert_enforcement`  | <p>Perform Certificate enforcement related operations.</p><p>Usage: <code>cytool cert_enforcement &#x3C;operation></code></p><p>Where &#x3C;operation> is one of the following:                                </p><ul><li>query                       Display current enforcement status</li><li>disable                     Forcibly disable enforcement</li><li>policy                      Set enforcement by policy</li><li>import &#x3C;certificate file path>     Import a proprietary certificate in PEM format as root CA</li><li>import clear                       Clear all custom root CA certificates.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `checkin`           | <p>Initiate check-in to the server.</p><p>Usage: <strong><code>cytool checkin</code></strong></p><p>To verify the check in, view the check-in time on the Cortex XDR agent console.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `connectivity_test` | <p>Perform a connectivity test to Cortex XDR servers.</p><p>Usage: <code>cytool connectivity_test [request_count]</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| `dump`              | <p>Enable/disable dump generation or restore policy settings.</p><p>Usage:</p><ul><li><code>cytool dump enable</code></li><li><code>cytool dump disable</code></li><li><code>cytool dump restore</code></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| `endpoint_tags`     | <p>Usage: <strong><code>cytool endpoint_tags </code></strong><em><strong><code>&#x3C;action></code></strong></em></p><p>where &#x3C;action> can be:</p><ul><li>add—To add tags to the endpoint tags.</li><li>remove—Remove the given tags from the list of endpoint tags.</li><li>list—Displays the available endpoint tags.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Tags should be passed as one string separated by comas.</p><p>Linux does not support tag names with spaces as command line arguments to the shell installer.</p><p>Instead, tags can be set in the <code>/etc/panw/cortex.conf</code> configuration file, that supports all Linux installers.</p></div><p>For example:</p><ul><li><code>cytool endpoint_tags add "tag1[,tag2,...,tagN]"</code></li><li><code>cytool endpoint_tags remove "tag1[,tag2,...,tagN]"</code></li><li><code>cytool endpoint_tags list</code></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `enum`              | <p>Enumerate protected processes.</p><p>Usage: <strong><code>cytool enum</code></strong></p><p>For example:</p><p><code>root@ubuntu: cytool enum ----------------------------------- Cortex XDR list of protected processes: ----------------------------------- PID CMD UID 1098 /usr/sbin/cron -f 0 1131 /usr/sbin/rsyslogd -n 104</code></p><p>To view processes for all users including those initiated by the operating system, specify the <code>/a</code> option.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes; only then you will see them on this list.</p></div>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| `event_collection`  | <p>Stop or start event collection status (EDR/DSE).</p><p>&#x3C;query, enable, disable, logstat></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `health`            | Shows the agent status, protection level and connectivity.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| `-h --help`         | Displays the available help information                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `import suex`       | Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| `isolate stop`      | Release machine from network isolation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `last_checkin`      | Display last successful check-in time.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| `log`               | <p>Set the log level for the desired process.</p><p>Usage: <strong><code>cytool log set_level &#x3C;log_level> &#x3C;components></code></strong></p><p>where:</p><ul><li><p><code>&#x3C;log_level></code> is an integer value corresponding to the log level:</p><ul><li>0—Disable logging</li><li>1—Fatal</li><li>2—Critical</li><li>3—Error</li><li>4—Warning</li><li>5—Notice</li><li>6—Information</li><li>7—Debug</li><li>8—Trace</li></ul></li><li><code>&#x3C;components></code> is <strong><code>all</code></strong> or one or more of the following agent components: <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>cortex xdr</code></strong>, <strong><code>kproc-ctrl</code></strong>.</li></ul><p>For example:</p><p><strong><code>cytool log set_level 2 all</code></strong></p><p>Then use the <strong><code>cytool log collect</code></strong> command to generate a support file.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `log collect`       | Generate support file archive of all logs in a TGZ file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `persist`           | <p>The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events. Use cytool persist operations to import, export, and view information stored in the local database.</p><p>Usage: <strong><code>cytool persist &#x3C;action></code></strong></p><p>where &#x3C;action>:</p><ul><li><strong><code>list</code></strong>—List the local databases on the endpoint.</li><li>**`export [</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| `queryall`          | The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `reconnect`         | <p></p><p>Try reconnecting to the server if communication has been disabled, or force registration with a new <code>distribution_id</code>.</p><p>Usage:</p><ul><li><code>cytool reconnect</code>—Reconnects the Cortex XDR agent to the management application on the server.</li><li><code>cytool reconnect [force &#x3C;distribution_id]></code></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The <code>distribution_id</code> must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</p></div>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `runtime`           | <p>Stop or start product components.</p><p>Usage: <code>cytool runtime &#x3C;action> &#x3C;component></code></p><p>where:</p><ul><li><p><strong><code>&#x3C;action></code></strong>—Change startup runtime action for an agent component.</p><p>Options are: <strong><code>start</code></strong>, <strong><code>stop</code></strong>, <strong><code>query</code></strong>. The query option displays the startup status for each component.</p></li><li><p><strong><code>&#x3C;component></code></strong>—Target components for which to set the runtime action, or <code>all</code> components.</p><p>To change the runtime action for multiple components, list them with spaces separating each component.</p><p>Options: <strong><code>cortex xdr</code></strong>, <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>kproc-ctrl</code></strong></p></li></ul><p>For example:</p><p><code>cytool runtime query Name PID User Status Command cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl cytool runtime stop all Name PID User Status Command authorized N/A N/A STOPPED N/A pmd N/A N/A STOPPED N/A cortex xdr N/A N/A STOPPED N/A kproc-ctrl N/A N/A Unloaded N/A cytool runtime start all Name PID User Status Command system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768 authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd cortex xdr N/A N/A FAILED TO START N/A kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl</code></p> |
-| `scan`              | <p>Perform Scan operations on the endpoint.</p><p>Options: <code>start</code>, <code>stop</code>, <code>query</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `startup`           | <p>Enable, disable, or query the startup state of Cortex XDR agent components.</p><p>Usage: <strong><code>cytool startup </code></strong><em><strong><code>&#x3C;action></code></strong></em> <em><strong><code>&#x3C;component></code></strong></em></p><p>where:</p><ul><li><p><strong><code>&#x3C;action></code></strong>—Change startup action for an agent component.</p><p>Options are: <strong><code>enable</code></strong>, <strong><code>disable</code></strong>, <strong><code>query</code></strong>.</p><p>The query option displays the startup status for each component.</p></li><li><strong><code>&#x3C;component></code></strong>—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: <strong><code>cortex xdr</code></strong>, <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>kproc-ctrl</code></strong></li></ul><p>For example:</p><p><code>root@ubuntu: sudo ./cytool startup disable cortex xdr pmd Process name Startup status cortex xdr Disabled authorized Enabled pmd Disabled kproc-ctrl Loaded root@ubuntu: sudo ./cytool startup enable all Process name Startup status cortex xdr Enabled authorized Enabled pmd Enabled kproc-ctrl Loaded</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+<table data-header-hidden><thead><tr><th width="232.436767578125"></th><th></th></tr></thead><tbody><tr><td>Command Option</td><td>Description</td></tr><tr><td><code>adaptive_policy</code></td><td><p>Adaptive policy agent commands.</p><p>Usage: <code>cytool adaptive_policy [&#x3C;interval> &#x3C;collect_stats> &#x3C;recalc> &#x3C;query>]</code></p><p>where:</p><ul><li><strong><code>interval</code></strong> —Sets a recalculation interval override (in seconds), or reset an override. Options are: <code>seconds</code>, <code>policy</code></li><li><strong><code>collect_stats</code></strong> —Initiates a collection of internal statistics.</li><li><strong><code>recalc</code></strong> —Triggers a recalculation of the adaptive policy.</li><li><strong><code>query</code></strong> —Query the current interval and APEX.</li></ul></td></tr><tr><td><code>anti_malware</code></td><td><p>Perform Anti Malware related operations.</p><p>[version &#x3C;query> | cache &#x3C;print, status>]</p><p>Usage: <strong><code>cytool anti_malware </code></strong><em><strong><code>&#x3C;version></code></strong></em> <em><strong><code>&#x3C;cache></code></strong></em></p><p>where:</p><ul><li>version — Input: <strong><code>query</code></strong></li><li>cache — Input: <strong><code>print</code></strong> <strong><code>status</code></strong></li><li>la, wf, and ltee are for internal use.</li></ul></td></tr><tr><td><code>cert_enforcement</code></td><td><p>Perform Certificate enforcement related operations.</p><p>Usage: <code>cytool cert_enforcement &#x3C;operation></code></p><p>Where &#x3C;operation> is one of the following:                                </p><ul><li>query                       Display current enforcement status</li><li>disable                     Forcibly disable enforcement</li><li>policy                      Set enforcement by policy</li><li>import &#x3C;certificate file path>     Import a proprietary certificate in PEM format as root CA</li><li>import clear                       Clear all custom root CA certificates.</li></ul></td></tr><tr><td><code>checkin</code></td><td><p>Initiate check-in to the server.</p><p>Usage: <strong><code>cytool checkin</code></strong></p><p>To verify the check in, view the check-in time on the Cortex XDR agent console.</p></td></tr><tr><td><code>connectivity_test</code></td><td><p>Perform a connectivity test to Cortex XDR servers.</p><p>Usage: <code>cytool connectivity_test [request_count]</code></p></td></tr><tr><td><code>dump</code></td><td><p>Enable/disable dump generation or restore policy settings.</p><p>Usage:</p><ul><li><code>cytool dump enable</code></li><li><code>cytool dump disable</code></li><li><code>cytool dump restore</code></li></ul></td></tr><tr><td><code>endpoint_tags</code></td><td><p>Usage: <strong><code>cytool endpoint_tags </code></strong><em><strong><code>&#x3C;action></code></strong></em></p><p>where &#x3C;action> can be:</p><ul><li>add—To add tags to the endpoint tags.</li><li>remove—Remove the given tags from the list of endpoint tags.</li><li>list—Displays the available endpoint tags.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Tags should be passed as one string separated by comas.</p><p>Linux does not support tag names with spaces as command line arguments to the shell installer.</p><p>Instead, tags can be set in the <code>/etc/panw/cortex.conf</code> configuration file, that supports all Linux installers.</p></div><p>For example:</p><ul><li><code>cytool endpoint_tags add "tag1[,tag2,...,tagN]"</code></li><li><code>cytool endpoint_tags remove "tag1[,tag2,...,tagN]"</code></li><li><code>cytool endpoint_tags list</code></li></ul></td></tr><tr><td><code>enum</code></td><td><p>Enumerate protected processes.</p><p>Usage: <strong><code>cytool enum</code></strong></p><p>For example:</p><p><code>root@ubuntu: cytool enum ----------------------------------- Cortex XDR list of protected processes: ----------------------------------- PID CMD UID 1098 /usr/sbin/cron -f 0 1131 /usr/sbin/rsyslogd -n 104</code></p><p>To view processes for all users including those initiated by the operating system, specify the <code>/a</code> option.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes; only then you will see them on this list.</p></div></td></tr><tr><td><code>event_collection</code></td><td><p>Stop or start event collection status (EDR/DSE).</p><p>&#x3C;query, enable, disable, logstat></p></td></tr><tr><td><code>health</code></td><td>Shows the agent status, protection level and connectivity.</td></tr><tr><td><code>-h --help</code></td><td>Displays the available help information</td></tr><tr><td><code>import suex</code></td><td>Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.</td></tr><tr><td><code>isolate stop</code></td><td>Release machine from network isolation.</td></tr><tr><td><code>last_checkin</code></td><td>Display last successful check-in time.</td></tr><tr><td><code>log</code></td><td><p>Set the log level for the desired process.</p><p>Usage: <strong><code>cytool log set_level &#x3C;log_level> &#x3C;components></code></strong></p><p>where:</p><ul><li><p><code>&#x3C;log_level></code> is an integer value corresponding to the log level:</p><ul><li>0—Disable logging</li><li>1—Fatal</li><li>2—Critical</li><li>3—Error</li><li>4—Warning</li><li>5—Notice</li><li>6—Information</li><li>7—Debug</li><li>8—Trace</li></ul></li><li><code>&#x3C;components></code> is <strong><code>all</code></strong> or one or more of the following agent components: <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>cortex xdr</code></strong>, <strong><code>kproc-ctrl</code></strong>.</li></ul><p>For example:</p><p><strong><code>cytool log set_level 2 all</code></strong></p><p>Then use the <strong><code>cytool log collect</code></strong> command to generate a support file.</p></td></tr><tr><td><code>log collect</code></td><td>Generate support file archive of all logs in a TGZ file.</td></tr><tr><td><code>persist</code></td><td><p>The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events. Use cytool persist operations to import, export, and view information stored in the local database.</p><p>Usage: <strong><code>cytool persist &#x3C;action></code></strong></p><p>where &#x3C;action>:</p><ul><li><strong><code>list</code></strong>—List the local databases on the endpoint.</li><li>**`export [</li></ul></td></tr><tr><td><code>queryall</code></td><td>The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.</td></tr><tr><td><code>reconnect</code></td><td><p></p><p>Try reconnecting to the server if communication has been disabled, or force registration with a new <code>distribution_id</code>.</p><p>Usage:</p><ul><li><code>cytool reconnect</code>—Reconnects the Cortex XDR agent to the management application on the server.</li><li><code>cytool reconnect [force &#x3C;distribution_id]></code></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The <code>distribution_id</code> must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</p></div></td></tr><tr><td><code>runtime</code></td><td><p>Stop or start product components.</p><p>Usage: <code>cytool runtime &#x3C;action> &#x3C;component></code></p><p>where:</p><ul><li><p><strong><code>&#x3C;action></code></strong>—Change startup runtime action for an agent component.</p><p>Options are: <strong><code>start</code></strong>, <strong><code>stop</code></strong>, <strong><code>query</code></strong>. The query option displays the startup status for each component.</p></li><li><p><strong><code>&#x3C;component></code></strong>—Target components for which to set the runtime action, or <code>all</code> components.</p><p>To change the runtime action for multiple components, list them with spaces separating each component.</p><p>Options: <strong><code>cortex xdr</code></strong>, <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>kproc-ctrl</code></strong></p></li></ul><p>For example:</p><p><code>cytool runtime query Name PID User Status Command cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl cytool runtime stop all Name PID User Status Command authorized N/A N/A STOPPED N/A pmd N/A N/A STOPPED N/A cortex xdr N/A N/A STOPPED N/A kproc-ctrl N/A N/A Unloaded N/A cytool runtime start all Name PID User Status Command system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768 authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd cortex xdr N/A N/A FAILED TO START N/A kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl</code></p></td></tr><tr><td><code>scan</code></td><td><p>Perform Scan operations on the endpoint.</p><p>Options: <code>start</code>, <code>stop</code>, <code>query</code></p></td></tr><tr><td><code>startup</code></td><td><p>Enable, disable, or query the startup state of Cortex XDR agent components.</p><p>Usage: <strong><code>cytool startup </code></strong><em><strong><code>&#x3C;action></code></strong></em> <em><strong><code>&#x3C;component></code></strong></em></p><p>where:</p><ul><li><p><strong><code>&#x3C;action></code></strong>—Change startup action for an agent component.</p><p>Options are: <strong><code>enable</code></strong>, <strong><code>disable</code></strong>, <strong><code>query</code></strong>.</p><p>The query option displays the startup status for each component.</p></li><li><strong><code>&#x3C;component></code></strong>—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: <strong><code>cortex xdr</code></strong>, <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>kproc-ctrl</code></strong></li></ul><p>For example:</p><p><code>root@ubuntu: sudo ./cytool startup disable cortex xdr pmd Process name Startup status cortex xdr Disabled authorized Enabled pmd Disabled kproc-ctrl Loaded root@ubuntu: sudo ./cytool startup enable all Process name Startup status cortex xdr Enabled authorized Enabled pmd Enabled kproc-ctrl Loaded</code></p></td></tr></tbody></table>

▸ Cytool for Mac modified +1 −20 The cytool command reference was converted to an HTML table with no change to the documented options. agent/cortex-xdr-agent-for-macos/troubleshooting-resources-for-mac/cytool-for-mac

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -13,28 +13,9 @@ On Mac endpoints, access Cytool as a super user using a terminal. Cytool is loca

The following table displays the Cytool options available on Mac endpoints. For the Cytool admin commands that require a password, the password is the same as is defined as the Uninstall password.

hint info

### Note

Since Cortex XDR agent 7.6, the pmd process includes and replaces the trapsd process.

endhint

Command Option│Description


Command Option	Description
`cert_enforcement`	Perform Certificate enforcement related operations. Usage: `cytool cert_enforcement <operation>` Where <operation> is one of the following: query Display current enforcement status disable Forcibly disable enforcement policy Set enforcement by policy import <certificate file path> Import a proprietary certificate in PEM format as root CA import clear Clear all custom root CA certificates.
`checkin`	Initiate check-in to the server. Usage: `sudo ./cytool checkin` To verify the checkin, view the check-in time on the Cortex XDR agent console.
`connectivity_test`	Perform a connectivity test to Cortex XDR servers. Usage: `cytool connectivity_test [request_count]`
`dump`	Enable or disable dump generation or restore policy settings. `Traps-Mac:bin Traps$` `sudo ./cytool dump enable``Traps-Mac:bin Traps$``sudo ./cytool dump disable``Traps-Mac:bin Traps$``sudo ./cytool dump restore`
`endpoint_tags`	Usage: `sudo ./cytool endpoint_tags` `<action>` where `<action>` can be: `add`—To add tags to the endpoint tags. `remove`—Remove the given tags from the list of endpoint tags. `list`—Displays the available endpoint tags. Note Tags should be passed as one string separated by comas. For example: `Traps-Mac:bin Traps$` `sudo ./cytool endpoint_tags add "tag1 [,tag2, ...,tagN]"` `Traps-Mac:bin Traps$` `sudo ./cytool endpoint_tags remove "tag1 [,tag2, ...,tagN]"` `Traps-Mac:bin Traps$` `sudo ./cytool endpoint_tags list`
`enum`	Enumerate protected processes. Usage: `sudo ./cytool enum` For example: `Traps-Mac:bin Traps$` `sudo ./cytool enum` `List of protected processes: Process name Process ID User Photos 2047 User1 Mail 2099 User2` Note If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.
`-h --help`	`Traps-Mac:bin Traps$` `sudo ./cytool`` Usage: cytool cytool - Support tool Options: -h --help Display help information. enum List processes protected by Cortex XDR. startup query List startup status for Cortex XDR agent and daemons. startup <enable
`import suex`	Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.
isolate	Usage: `cytool isolate stop` Release endpoint from network isolation.
log	`Log set_level` - Set the log level for the desired process. Usage: `sudo ./cytool log set_level <log_level> <components>` where: `<log_level>` is an integer value corresponding to the log level: 0—Disable logging 1—Fatal 2—Critical 3—Error 4—Warning 5—Notice 6—Information 7—Debug 8—Trace `<components>` is `all` or one or more of the following agent component: `authorized`, `pmd`, `cortex xdr`, `kproc-ctrl`. For example: `Traps-Mac:bin Traps$` `sudo ./cytool log set_level 2 all` `log collect` Use the `sudo ./cytool log collect` command to generate a support file archive of all logs in a TGZ file. On Mac endpoints running OS X 10.10 and OSX 10.11, Cytool outputs the logs to the `/var/log/traps` directory. On Mac endpoints running macOS 10.12 and later, you can view logs from the Console application.
`opswat`	Check the Cortex XDR agent status and version. Usage: `sudo ./cytool opswat <parameter>` where `<parameter>` is: `version`—Displays the version of the agent. `installed`—Displays the agent installation status: `true` if the com.paloaltonetworks.pkg.cortx xdr package is installed or `false` if the package is not installed. You must also supply the agent supervisor password to view the status. `running`—Displays the running status of agent daemons: true if running or false if not running. `protected`—Displays the applied policy status: true if applied or false if not applied. `Traps-Mac:bin Traps$` `sudo ./cytool opswat version``8.1.0.1042 Traps-Mac:bin Traps$``sudo ./cytool opswat installed``Password: true Traps-Mac:bin Traps$``sudo ./cytool opswat running``true Traps-Mac:bin Traps$``sudo ./cytool opswat protected` `true`
`persist`	The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database. Usage: `sudo ./cytool persist` `<action>` where `<action>`: `list`—List the local databases on the endpoint. *`export` `[<database name>`*`
`queryall`	The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.
`Reconnect`	Try reconnecting to the server if communication has been disabled, or force registration with a new `distribution_id`. Usage: `cytool reconnect`—Reconnects the Cortex XDR agent to the management application on the server. `cytool reconnect [force <distribution_id]>` Note The `distribution_id` must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.
`runtime`	Stop or start product components. Usage: `sudo ./cytool runtime` `<action>` `<component>` where: `<action>`—Change startup runtime action for an agent component. Options are: `start`, `stop`, `query`. The query option displays the startup status for each component. `<component>`—Target component for which to set the runtime action, or all components if no components are specified. To change the runtime action for multiple components, list them with spaces separating each component. Options are: `cortex xdr`, `authorized`, `pmd`, `kproc-ctrl` For example: `Traps-Mac:bin Traps$` `sudo ./cytool runtime query``Name PID User Status Command cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl Traps-Mac:bin Traps$``sudo ./cytool runtime stop all``Name PID User Status Command authorized N/A N/A STOPPED N/A pmd N/A N/A STOPPED N/A cortex xdr N/A N/A STOPPED N/A kproc-ctrl N/A N/A Unloaded N/A Traps-Mac:bin Traps$``sudo ./cytool runtime start all` `Name PID User Status Command system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768 authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd cortex xdr N/A N/A FAILED TO START N/A kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl`
`security_modules`	Query, enable, disable or return to policy the Cortex XDR agent anti-tampering protection. Usage: `cytool security_modules operation module` Where: Operation is one of the following: `query` — Queries Security Module activity status `enable`— Enables Security Module `disable`— Disables Security Module `policy`— Syncs the Security Module according to cloud-defined policy Module options self_prot \| proc_ctrl \| event_collection \| dlprot \| kpep \| dlp \| all Example: To disable the Cortex XDR agent anti-tampering protection: `cytool security_modules disable self_prot`
`startup`	Enable, disable, or query the startup state of Cortex XDR agent components. Usage: `sudo ./cytool startup` `<action>` `<component>` where: `<action>`—Change startup action for an agent component. Options are: `enable`, `disable`, `query`. The query option displays the startup status for each component. `<component>`—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: `cortex xdr`, `authorized`, `pmd`, `kproc-ctrl` For example: `Traps-Mac:bin Traps$` `sudo ./cytool startup disable cortex xdr pmd``Process name Startup status cortex xdr Disabled authorized Enabled pmd Disabled kproc-ctrl Loaded Traps-Mac:bin Traps$``sudo ./cytool startup enable all``Process name Startup status cortex xdr Enabled authorized Enabled pmd Enabled kproc-ctrl Loaded`
`wakeup`	Wake up the endpoint from an OS incompatibility state. `Traps-Mac:bin Traps$` `sudo ./cytool wakeup SIGTERM caught`

| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

cert_enforcement│

Perform Certificate enforcement related operations.

Usage: cytool cert_enforcement <operation>

Where <operation> is one of the following:

query Display current enforcement status
disable Forcibly disable enforcement
policy Set enforcement by policy
import <certificate file path> Import a proprietary certificate in PEM format as root CA
import clear Clear all custom root CA certificates.

checkin│Initiate check-in to the server.

Usage: sudo ./cytool checkin

To verify the checkin, view the check-in time on the Cortex XDR agent console.

connectivity_test│Perform a connectivity test to Cortex XDR servers.

Usage: cytool connectivity_test [request_count]

dump│Enable or disable dump generation or restore policy settings.

Traps-Mac:bin Traps$ sudo ./cytool dump enableTraps-Mac:bin Traps$sudo ./cytool dump disableTraps-Mac:bin Traps$sudo ./cytool dump restore

endpoint_tags│

Usage: sudo ./cytool endpoint_tags <action>

where <action> can be:

add—To add tags to the endpoint tags.
remove—Remove the given tags from the list of endpoint tags.
list—Displays the available endpoint tags.

Note

Tags should be passed as one string separated by comas.

For example:

Traps-Mac:bin Traps$
sudo ./cytool endpoint_tags add "tag1 [,tag2, ...,tagN]"
Traps-Mac:bin Traps$
sudo ./cytool endpoint_tags remove "tag1 [,tag2, ...,tagN]"
Traps-Mac:bin Traps$
sudo ./cytool endpoint_tags list

enum│

Enumerate protected processes.

Usage: sudo ./cytool enum

For example:

Traps-Mac:bin Traps$ sudo ./cytool enum List of protected processes: Process name Process ID User Photos 2047 User1 Mail 2099 User2

Note

If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.

-h --help│Traps-Mac:bin Traps$ sudo ./cytool` Usage: cytool cytool - Support tool Options: -h --help Display help information. enum List processes protected by Cortex XDR. startup query List startup status for Cortex XDR agent and daemons. startup <enable

import suex│Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.

isolate│Usage: cytool isolate stop

Release endpoint from network isolation.

log│Log set_level - Set the log level for the desired process.

Usage: sudo ./cytool log set_level <log_level> <components>

where:

<log_level> is an integer value corresponding to the log level:
- 0—Disable logging
- 1—Fatal
- 2—Critical
- 3—Error
- 4—Warning
- 5—Notice
- 6—Information
- 7—Debug
- 8—Trace
<components> is all or one or more of the following agent component: authorized, pmd, cortex xdr, kproc-ctrl.

For example:

Traps-Mac:bin Traps$ sudo ./cytool log set_level 2 all

log collect

Use the sudo ./cytool log collect command to generate a support file archive of all logs in a TGZ file. On Mac endpoints running OS X 10.10 and OSX 10.11, Cytool outputs the logs to the /var/log/traps directory. On Mac endpoints running macOS 10.12 and later, you can view logs from the Console application.

opswat│Check the Cortex XDR agent status and version.

Usage: sudo ./cytool opswat <parameter>

where <parameter> is:

version—Displays the version of the agent.
installed—Displays the agent installation status:
true if the com.paloaltonetworks.pkg.cortx xdr package is installed
or false if the package is not installed.
You must also supply the agent supervisor password to view the status.
running—Displays the running status of agent daemons: true if running or false if not running.
protected—Displays the applied policy status: true if applied or false if not applied.

Traps-Mac:bin Traps$ sudo ./cytool opswat version8.1.0.1042 Traps-Mac:bin Traps$sudo ./cytool opswat installedPassword: true Traps-Mac:bin Traps$sudo ./cytool opswat runningtrue Traps-Mac:bin Traps$sudo ./cytool opswat protected true

persist│

The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database.

Usage: sudo ./cytool persist <action>

where <action>:

list—List the local databases on the endpoint.
**export [<database name>`

queryall│The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.

Reconnect│

Try reconnecting to the server if communication has been disabled, or force registration with a new distribution_id.

Usage:

cytool reconnect—Reconnects the Cortex XDR agent to the management application on the server.
cytool reconnect [force <distribution_id]>

Note

The distribution_id must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.

runtime│Stop or start product components.

Usage: sudo ./cytool runtime <action> <component>

where:

<action>—Change startup runtime action for an agent component.
Options are: start, stop, query. The query option displays the startup status for each component.
<component>—Target component for which to set the runtime action, or all components if no components are specified.
To change the runtime action for multiple components, list them with spaces separating each component.
Options are: cortex xdr, authorized, pmd, kproc-ctrl

For example:

Traps-Mac:bin Traps$ sudo ./cytool runtime queryName PID User Status Command cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl Traps-Mac:bin Traps$sudo ./cytool runtime stop allName PID User Status Command authorized N/A N/A STOPPED N/A pmd N/A N/A STOPPED N/A cortex xdr N/A N/A STOPPED N/A kproc-ctrl N/A N/A Unloaded N/A Traps-Mac:bin Traps$sudo ./cytool runtime start all Name PID User Status Command system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768 authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd cortex xdr N/A N/A FAILED TO START N/A kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl

security_modules│

Query, enable, disable or return to policy the Cortex XDR agent anti-tampering protection.

Usage: cytool security_modules operation module

Where:

Operation is one of the following:
- query — Queries Security Module activity status
- enable— Enables Security Module
- disable— Disables Security Module
- policy— Syncs the Security Module according to cloud-defined policy
Module options self_prot

│proc_ctrl│event_collection│dlprot│kpep│dlp│all</li></ul>Example: To disable the Cortex XDR agent anti-tampering protection:cytool security_modules disable self_prot

startup│Enable, disable, or query the startup state of Cortex XDR agent components.

Usage: sudo ./cytool startup <action> <component>

where:

<action>—Change startup action for an agent component.
Options are: enable, disable, query.
The query option displays the startup status for each component.
<component>—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: cortex xdr, authorized, pmd, kproc-ctrl

For example:

Traps-Mac:bin Traps$ sudo ./cytool startup disable cortex xdr pmdProcess name Startup status cortex xdr Disabled authorized Enabled pmd Disabled kproc-ctrl Loaded Traps-Mac:bin Traps$sudo ./cytool startup enable allProcess name Startup status cortex xdr Enabled authorized Enabled pmd Enabled kproc-ctrl Loaded

wakeup│Wake up the endpoint from an OS incompatibility state.

Traps-Mac:bin Traps$ sudo ./cytool wakeup SIGTERM caught

Show markdown source

@@ -13,28 +13,9 @@ On Mac endpoints, access Cytool as a super user using a terminal. Cytool is loca
 The following table displays the Cytool options available on Mac endpoints. For the Cytool admin commands that require a password, the password is the same as is defined as the Uninstall password.
 
 {% hint style="info" %}
 ### Note
 
 Since Cortex XDR agent 7.6, the `pmd` process includes and replaces the `trapsd` process.
 {% endhint %}
 
-| Command Option         | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `cert_enforcement`     | <p>Perform Certificate enforcement related operations.</p><p>Usage: <code>cytool cert_enforcement &#x3C;operation></code></p><p>Where &#x3C;operation> is one of the following:                                </p><ul><li>query                       Display current enforcement status</li><li>disable                     Forcibly disable enforcement</li><li>policy                      Set enforcement by policy</li><li>import &#x3C;certificate file path>     Import a proprietary certificate in PEM format as root CA</li><li>import clear                       Clear all custom root CA certificates.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| **`checkin`**          | <p>Initiate check-in to the server.</p><p>Usage: <strong><code>sudo ./cytool checkin</code></strong></p><p>To verify the checkin, view the check-in time on the Cortex XDR agent console.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| `connectivity_test`    | <p>Perform a connectivity test to Cortex XDR servers.</p><p>Usage: <code>cytool connectivity_test [request_count]</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| **`dump`**             | <p>Enable or disable dump generation or restore policy settings.</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool dump enable</code></strong><code>Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool dump disable</code></strong><code>Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool dump restore</code></strong></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| **`endpoint_tags`**    | <p>Usage: <strong><code>sudo ./cytool endpoint_tags </code></strong><em><strong><code>&#x3C;action></code></strong></em></p><p>where <em><strong><code>&#x3C;action></code></strong></em> can be:</p><ul><li><strong><code>add</code></strong>—To add tags to the endpoint tags.</li><li><strong><code>remove</code></strong>—Remove the given tags from the list of endpoint tags.</li><li><strong><code>list</code></strong>—Displays the available endpoint tags.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Tags should be passed as one string separated by comas.</p></div><p>For example:</p><ul><li><p><code>Traps-Mac:bin Traps$</code></p><p><strong><code>sudo ./cytool endpoint_tags add "tag1 [,tag2, ...,tagN]"</code></strong></p></li><li><p><code>Traps-Mac:bin Traps$</code></p><p><strong><code>sudo ./cytool endpoint_tags remove "tag1 [,tag2, ...,tagN]"</code></strong></p></li><li><p><code>Traps-Mac:bin Traps$</code></p><p><strong><code>sudo ./cytool endpoint_tags list</code></strong></p></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `enum`                 | <p>Enumerate protected processes.</p><p>Usage: <strong><code>sudo ./cytool enum</code></strong></p><p>For example:</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool enum</code></strong><code> List of protected processes: Process name Process ID User Photos 2047 User1 Mail 2099 User2</code></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.</p></div>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| **`-h --help`**        | `Traps-Mac:bin Traps$`` `**`sudo ./cytool`**\` Usage: cytool cytool - Support tool Options: -h --help Display help information. enum List processes protected by Cortex XDR. startup query List startup status for Cortex XDR agent and daemons. startup \<enable                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `import suex`          | Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| isolate                | <p>Usage: <code>cytool isolate stop</code></p><p>Release endpoint from network isolation.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| log                    | <p><code>Log set_level</code> - Set the log level for the desired process.</p><p>Usage: <code>sudo ./cytool log set_level &#x3C;log_level> &#x3C;components></code></p><p>where:</p><ul><li><p><code>&#x3C;log_level></code> is an integer value corresponding to the log level:</p><ul><li>0—Disable logging</li><li>1—Fatal</li><li>2—Critical</li><li>3—Error</li><li>4—Warning</li><li>5—Notice</li><li>6—Information</li><li>7—Debug</li><li>8—Trace</li></ul></li><li><code>&#x3C;components></code> is <strong><code>all</code></strong> or one or more of the following agent component: <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>cortex xdr</code></strong>, <strong><code>kproc-ctrl</code></strong>.</li></ul><p>For example:</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool log set_level 2 all</code></strong></p><p><code>log collect</code></p><p>Use the <strong><code>sudo ./cytool log collect</code></strong> command to generate a support file archive of all logs in a TGZ file. On Mac endpoints running OS X 10.10 and OSX 10.11, Cytool outputs the logs to the <code>/var/log/traps</code> directory. On Mac endpoints running macOS 10.12 and later, you can view logs from the Console application.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| **`opswat`**           | <p>Check the Cortex XDR agent status and version.</p><p>Usage: <strong><code>sudo ./cytool opswat &#x3C;parameter></code></strong></p><p>where <strong><code>&#x3C;parameter></code></strong> is:</p><ul><li><strong><code>version</code></strong>—Displays the version of the agent.</li><li><p><strong><code>installed</code></strong>—Displays the agent installation status:</p><p><code>true</code> if the com.paloaltonetworks.pkg.cortx xdr package is installed</p><p>or <code>false</code> if the package is not installed.</p><p>You must also supply the agent supervisor password to view the status.</p></li><li><strong><code>running</code></strong>—Displays the running status of agent daemons: true if running or false if not running.</li><li><strong><code>protected</code></strong>—Displays the applied policy status: true if applied or false if not applied.</li></ul><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool opswat version</code></strong><code>8.1.0.1042 Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool opswat installed</code></strong><code>Password: true Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool opswat running</code></strong><code>true Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool opswat protected</code></strong><code> true</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| **`persist`**          | <p>The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database.</p><p>Usage: <strong><code>sudo ./cytool persist </code></strong><em><strong><code>&#x3C;action></code></strong></em></p><p>where <em><strong><code>&#x3C;action></code></strong></em>:</p><ul><li><strong><code>list</code></strong>—List the local databases on the endpoint.</li><li>**<code>export </code><em><code>[&#x3C;database name></code></em>`</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `queryall`             | The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `Reconnect`            | <p>Try reconnecting to the server if communication has been disabled, or force registration with a new <code>distribution_id</code>.</p><p>Usage:</p><ul><li><code>cytool reconnect</code>—Reconnects the Cortex XDR agent to the management application on the server.</li><li><code>cytool reconnect [force &#x3C;distribution_id]></code></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The <code>distribution_id</code> must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</p></div>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| **`runtime`**          | <p>Stop or start product components.</p><p>Usage: <strong><code>sudo ./cytool runtime </code></strong><em><strong><code>&#x3C;action></code></strong></em> <em><strong><code>&#x3C;component></code></strong></em></p><p>where:</p><ul><li><p><em><strong><code>&#x3C;action></code></strong></em>—Change startup runtime action for an agent component.</p><p>Options are: <strong><code>start</code></strong>, <strong><code>stop</code></strong>, <strong><code>query</code></strong>. The query option displays the startup status for each component.</p></li><li><p><em><strong><code>&#x3C;component></code></strong></em>—Target component for which to set the runtime action, or all components if no components are specified.</p><p>To change the runtime action for multiple components, list them with spaces separating each component.</p><p>Options are: <strong><code>cortex xdr</code></strong>, <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>kproc-ctrl</code></strong></p></li></ul><p>For example:</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool runtime query</code></strong><code>Name PID User Status Command cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool runtime stop all</code></strong><code>Name PID User Status Command authorized N/A N/A STOPPED N/A pmd N/A N/A STOPPED N/A cortex xdr N/A N/A STOPPED N/A kproc-ctrl N/A N/A Unloaded N/A Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool runtime start all</code></strong><code> Name PID User Status Command system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768 authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd cortex xdr N/A N/A FAILED TO START N/A kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl</code></p> |
-| **`security_modules`** | <p>Query, enable, disable or return to policy the Cortex XDR agent anti-tampering protection.</p><p>Usage: <strong><code>cytool security_modules operation module</code></strong></p><p>Where:</p><ul><li><p>Operation is one of the following:</p><ul><li><strong><code>query</code></strong> — Queries Security Module activity status</li><li><strong><code>enable</code></strong>— Enables Security Module</li><li><strong><code>disable</code></strong>— Disables Security Module</li><li><strong><code>policy</code></strong>— Syncs the Security Module according to cloud-defined policy</li></ul></li><li>Module options self_prot | proc_ctrl | event_collection | dlprot | kpep | dlp | all</li></ul><p>Example: To disable the Cortex XDR agent anti-tampering protection:</p><p><strong><code>cytool security_modules disable self_prot</code></strong></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| **`startup`**          | <p>Enable, disable, or query the startup state of Cortex XDR agent components.</p><p>Usage: <strong><code>sudo ./cytool startup </code></strong><em><strong><code>&#x3C;action></code></strong></em> <em><strong><code>&#x3C;component></code></strong></em></p><p>where:</p><ul><li><p><em><strong><code>&#x3C;action></code></strong></em>—Change startup action for an agent component.</p><p>Options are: <strong><code>enable</code></strong>, <strong><code>disable</code></strong>, <strong><code>query</code></strong>.</p><p>The query option displays the startup status for each component.</p></li><li><em><strong><code>&#x3C;component></code></strong></em>—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: <strong><code>cortex xdr</code></strong>, <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>kproc-ctrl</code></strong></li></ul><p>For example:</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool startup disable cortex xdr pmd</code></strong><code>Process name Startup status cortex xdr Disabled authorized Enabled pmd Disabled kproc-ctrl Loaded Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool startup enable all</code></strong><code>Process name Startup status cortex xdr Enabled authorized Enabled pmd Enabled kproc-ctrl Loaded</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| **`wakeup`**           | <p>Wake up the endpoint from an OS incompatibility state.</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool wakeup SIGTERM caught</code></strong></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+<table data-header-hidden><thead><tr><th width="212.9400634765625"></th><th></th></tr></thead><tbody><tr><td>Command Option</td><td>Description</td></tr><tr><td><code>cert_enforcement</code></td><td><p>Perform Certificate enforcement related operations.</p><p>Usage: <code>cytool cert_enforcement &#x3C;operation></code></p><p>Where &#x3C;operation> is one of the following:                                </p><ul><li>query                       Display current enforcement status</li><li>disable                     Forcibly disable enforcement</li><li>policy                      Set enforcement by policy</li><li>import &#x3C;certificate file path>     Import a proprietary certificate in PEM format as root CA</li><li>import clear                       Clear all custom root CA certificates.</li></ul></td></tr><tr><td><code>checkin</code></td><td><p>Initiate check-in to the server.</p><p>Usage: <strong><code>sudo ./cytool checkin</code></strong></p><p>To verify the checkin, view the check-in time on the Cortex XDR agent console.</p></td></tr><tr><td><code>connectivity_test</code></td><td><p>Perform a connectivity test to Cortex XDR servers.</p><p>Usage: <code>cytool connectivity_test [request_count]</code></p></td></tr><tr><td><code>dump</code></td><td><p>Enable or disable dump generation or restore policy settings.</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool dump enable</code></strong><code>Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool dump disable</code></strong><code>Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool dump restore</code></strong></p></td></tr><tr><td><code>endpoint_tags</code></td><td><p>Usage: <strong><code>sudo ./cytool endpoint_tags </code></strong><em><strong><code>&#x3C;action></code></strong></em></p><p>where <em><strong><code>&#x3C;action></code></strong></em> can be:</p><ul><li><strong><code>add</code></strong>—To add tags to the endpoint tags.</li><li><strong><code>remove</code></strong>—Remove the given tags from the list of endpoint tags.</li><li><strong><code>list</code></strong>—Displays the available endpoint tags.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Tags should be passed as one string separated by comas.</p></div><p>For example:</p><ul><li><p><code>Traps-Mac:bin Traps$</code></p><p><strong><code>sudo ./cytool endpoint_tags add "tag1 [,tag2, ...,tagN]"</code></strong></p></li><li><p><code>Traps-Mac:bin Traps$</code></p><p><strong><code>sudo ./cytool endpoint_tags remove "tag1 [,tag2, ...,tagN]"</code></strong></p></li><li><p><code>Traps-Mac:bin Traps$</code></p><p><strong><code>sudo ./cytool endpoint_tags list</code></strong></p></li></ul></td></tr><tr><td><code>enum</code></td><td><p>Enumerate protected processes.</p><p>Usage: <strong><code>sudo ./cytool enum</code></strong></p><p>For example:</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool enum</code></strong><code> List of protected processes: Process name Process ID User Photos 2047 User1 Mail 2099 User2</code></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.</p></div></td></tr><tr><td><code>-h --help</code></td><td><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool</code></strong>` Usage: cytool cytool - Support tool Options: -h --help Display help information. enum List processes protected by Cortex XDR. startup query List startup status for Cortex XDR agent and daemons. startup &#x3C;enable</td></tr><tr><td><code>import suex</code></td><td>Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.</td></tr><tr><td>isolate</td><td><p>Usage: <code>cytool isolate stop</code></p><p>Release endpoint from network isolation.</p></td></tr><tr><td>log</td><td><p><code>Log set_level</code> - Set the log level for the desired process.</p><p>Usage: <code>sudo ./cytool log set_level &#x3C;log_level> &#x3C;components></code></p><p>where:</p><ul><li><p><code>&#x3C;log_level></code> is an integer value corresponding to the log level:</p><ul><li>0—Disable logging</li><li>1—Fatal</li><li>2—Critical</li><li>3—Error</li><li>4—Warning</li><li>5—Notice</li><li>6—Information</li><li>7—Debug</li><li>8—Trace</li></ul></li><li><code>&#x3C;components></code> is <strong><code>all</code></strong> or one or more of the following agent component: <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>cortex xdr</code></strong>, <strong><code>kproc-ctrl</code></strong>.</li></ul><p>For example:</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool log set_level 2 all</code></strong></p><p><code>log collect</code></p><p>Use the <strong><code>sudo ./cytool log collect</code></strong> command to generate a support file archive of all logs in a TGZ file. On Mac endpoints running OS X 10.10 and OSX 10.11, Cytool outputs the logs to the <code>/var/log/traps</code> directory. On Mac endpoints running macOS 10.12 and later, you can view logs from the Console application.</p></td></tr><tr><td><code>opswat</code></td><td><p>Check the Cortex XDR agent status and version.</p><p>Usage: <strong><code>sudo ./cytool opswat &#x3C;parameter></code></strong></p><p>where <strong><code>&#x3C;parameter></code></strong> is:</p><ul><li><strong><code>version</code></strong>—Displays the version of the agent.</li><li><p><strong><code>installed</code></strong>—Displays the agent installation status:</p><p><code>true</code> if the com.paloaltonetworks.pkg.cortx xdr package is installed</p><p>or <code>false</code> if the package is not installed.</p><p>You must also supply the agent supervisor password to view the status.</p></li><li><strong><code>running</code></strong>—Displays the running status of agent daemons: true if running or false if not running.</li><li><strong><code>protected</code></strong>—Displays the applied policy status: true if applied or false if not applied.</li></ul><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool opswat version</code></strong><code>8.1.0.1042 Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool opswat installed</code></strong><code>Password: true Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool opswat running</code></strong><code>true Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool opswat protected</code></strong><code> true</code></p></td></tr><tr><td><code>persist</code></td><td><p>The Cortex XDR agent stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database.</p><p>Usage: <strong><code>sudo ./cytool persist </code></strong><em><strong><code>&#x3C;action></code></strong></em></p><p>where <em><strong><code>&#x3C;action></code></strong></em>:</p><ul><li><strong><code>list</code></strong>—List the local databases on the endpoint.</li><li>**<code>export </code><em><code>[&#x3C;database name></code></em>`</li></ul></td></tr><tr><td><code>queryall</code></td><td>The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.</td></tr><tr><td><code>Reconnect</code></td><td><p>Try reconnecting to the server if communication has been disabled, or force registration with a new <code>distribution_id</code>.</p><p>Usage:</p><ul><li><code>cytool reconnect</code>—Reconnects the Cortex XDR agent to the management application on the server.</li><li><code>cytool reconnect [force &#x3C;distribution_id]></code></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The <code>distribution_id</code> must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</p></div></td></tr><tr><td><code>runtime</code></td><td><p>Stop or start product components.</p><p>Usage: <strong><code>sudo ./cytool runtime </code></strong><em><strong><code>&#x3C;action></code></strong></em> <em><strong><code>&#x3C;component></code></strong></em></p><p>where:</p><ul><li><p><em><strong><code>&#x3C;action></code></strong></em>—Change startup runtime action for an agent component.</p><p>Options are: <strong><code>start</code></strong>, <strong><code>stop</code></strong>, <strong><code>query</code></strong>. The query option displays the startup status for each component.</p></li><li><p><em><strong><code>&#x3C;component></code></strong></em>—Target component for which to set the runtime action, or all components if no components are specified.</p><p>To change the runtime action for multiple components, list them with spaces separating each component.</p><p>Options are: <strong><code>cortex xdr</code></strong>, <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>kproc-ctrl</code></strong></p></li></ul><p>For example:</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool runtime query</code></strong><code>Name PID User Status Command cortex xdr 1055 User1 Running /Library/Application Support/PaloAltoNetworks/Traps/bin/cortex xdr.app/Contents/MacOS/cortex xdr authorized 927 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool runtime stop all</code></strong><code>Name PID User Status Command authorized N/A N/A STOPPED N/A pmd N/A N/A STOPPED N/A cortex xdr N/A N/A STOPPED N/A kproc-ctrl N/A N/A Unloaded N/A Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool runtime start all</code></strong><code> Name PID User Status Command system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start cortex xdr.plist"', returned status code=768 authorized 1883 _traps_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd cortex xdr N/A N/A FAILED TO START N/A kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl</code></p></td></tr><tr><td><code>security_modules</code></td><td><p>Query, enable, disable or return to policy the Cortex XDR agent anti-tampering protection.</p><p>Usage: <strong><code>cytool security_modules operation module</code></strong></p><p>Where:</p><ul><li><p>Operation is one of the following:</p><ul><li><strong><code>query</code></strong> — Queries Security Module activity status</li><li><strong><code>enable</code></strong>— Enables Security Module</li><li><strong><code>disable</code></strong>— Disables Security Module</li><li><strong><code>policy</code></strong>— Syncs the Security Module according to cloud-defined policy</li></ul></li><li>Module options self_prot | proc_ctrl | event_collection | dlprot | kpep | dlp | all</li></ul><p>Example: To disable the Cortex XDR agent anti-tampering protection:</p><p><strong><code>cytool security_modules disable self_prot</code></strong></p></td></tr><tr><td><code>startup</code></td><td><p>Enable, disable, or query the startup state of Cortex XDR agent components.</p><p>Usage: <strong><code>sudo ./cytool startup </code></strong><em><strong><code>&#x3C;action></code></strong></em> <em><strong><code>&#x3C;component></code></strong></em></p><p>where:</p><ul><li><p><em><strong><code>&#x3C;action></code></strong></em>—Change startup action for an agent component.</p><p>Options are: <strong><code>enable</code></strong>, <strong><code>disable</code></strong>, <strong><code>query</code></strong>.</p><p>The query option displays the startup status for each component.</p></li><li><em><strong><code>&#x3C;component></code></strong></em>—Target component for which to set the startup action. To change the startup action for multiple components, list them with spaces separating each component. Options are: <strong><code>cortex xdr</code></strong>, <strong><code>authorized</code></strong>, <strong><code>pmd</code></strong>, <strong><code>kproc-ctrl</code></strong></li></ul><p>For example:</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool startup disable cortex xdr pmd</code></strong><code>Process name Startup status cortex xdr Disabled authorized Enabled pmd Disabled kproc-ctrl Loaded Traps-Mac:bin Traps$</code><strong><code>sudo ./cytool startup enable all</code></strong><code>Process name Startup status cortex xdr Enabled authorized Enabled pmd Enabled kproc-ctrl Loaded</code></p></td></tr><tr><td><code>wakeup</code></td><td><p>Wake up the endpoint from an OS incompatibility state.</p><p><code>Traps-Mac:bin Traps$ </code><strong><code>sudo ./cytool wakeup SIGTERM caught</code></strong></p></td></tr></tbody></table>

▸ Uninstall the Cortex XDR Agent for Mac modified +1 −1 The "Where can I install the Cortex XDR agent" reference became a GitBook link. agent/cortex-xdr-agent-for-macos/uninstall-the-cortex-xdr-agent-for-mac

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,15 +1,15 @@

---

description: Learn how to uninstall the Cortex XDR agent from a Mac endpoint.

---

# Uninstall the Cortex XDR Agent for Mac

From the Cortex XDR management console, you can uninstall the Cortex XDR agent on an endpoint (refer to Uninstall the Cortex XDR Agent in the Administrator's Guide for your Cortex XDR license type). You can also uninstall the agent from the endpoint directly by using the uninstaller that comes with the Cortex XDR agent installation package that you downloaded from the Cortex XDR management console to install the agent (Endpoints → Endpoint Management → Agent Installations).

From the Cortex XDR management console, you can uninstall the Cortex XDR agent on an endpoint (refer to Uninstall the Cortex XDR Agent in the Administrator's Guide for your Cortex XDR license type). You can also uninstall the agent from the endpoint directly by using the uninstaller that comes with the Cortex XDR agent installation package that you downloaded from the Cortex XDR management console to install the agent (Endpoints → Endpoint Management → Agent Installations).

After you uninstall the agent, the endpoint is no longer protected by Cortex XDR security policies and the license returns to the pool of available licenses.

hint warning

### Danger

To uninstall the agent, you need the uninstall password or a temporary token. See Manage Agent Tokens to obtain a temporary token.

Show markdown source

@@ -1,15 +1,15 @@
 ---
 description: Learn how to uninstall the Cortex XDR agent from a Mac endpoint.
 ---
 
 # Uninstall the Cortex XDR Agent for Mac
 
-From the Cortex XDR management console, you can uninstall the Cortex XDR agent on an endpoint (refer to _Uninstall the Cortex XDR Agent_ in the Administrator's Guide for your Cortex XDR license type). You can also uninstall the agent from the endpoint directly by using the uninstaller that comes with the Cortex XDR agent installation package that you downloaded from the Cortex XDR management console to install the agent (Endpoints → Endpoint Management → **Agent Installations**).
+From the Cortex XDR management console, you can uninstall the Cortex XDR agent on an endpoint (refer to _Uninstall the Cortex XDR Agent_ in the Administrator's Guide for your Cortex XDR license type). You can also uninstall the agent from the endpoint directly by using the uninstaller that comes with the Cortex XDR agent installation package that you downloaded from the Cortex XDR management console to install the agent (**Endpoints** → **Endpoint** **Management** → **Agent Installations**).
 
 After you uninstall the agent, the endpoint is no longer protected by Cortex XDR security policies and the license returns to the pool of available licenses.
 
 {% hint style="warning" %}
 ### Danger
 
 To uninstall the agent, you need the uninstall password or a temporary token. See [Manage Agent Tokens](https://github.com/iKettles/palo-alto-networks-gitbook/tree/iain/import/document/preview/403317/README.md#UUID-862fecd8-73ec-1856-c849-f5c37860aec3) to obtain a temporary token.

▸ Cortex XDR agent for Windows requirements modified +10 −10 Markup only: the Defend console reference is now bold and the table's separator row was widened. agent/cortex-xdr-agent-for-windows/cortex-xdr-agent-for-windows-requirements

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -3,18 +3,18 @@ description: >-

Windows endpoints must meet the following requirements to install the Cortex

XDR agent.

---

# Cortex XDR agent for Windows requirements

The following requirements apply to standard and VDI Windows endpoints:

Requirement│Specification

| -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Processor│

Intel Pentium Dual Core or later with SSE2 instruction set support
AMD Opteron/Athlon 64 or later with SSE2 instruction set support
ARM (A64) with Windows 11 23H2 (release 10.0.22631) and later

Processor│

Intel Pentium Dual Core or later with SSE2 instruction set support
AMD Opteron/Athlon 64 or later with SSE2 instruction set support
ARM (A64) with Windows 11 23H2 (release 10.0.22631) and later

RAM│2GB minimum

Hard disk space│5GB minimum; 20 GB recommended

Operating system versions│Palo Alto Networks supports the Cortex XDR agent on many operating systems, virtual environments, and virtual applications. To determine the minimum Cortex XDR agent release for a specific operating system, environment, or application, refer to the Windows section of Where can I install the Cortex XDR Agent in the Palo Alto Networks Compatibility Matrix.

Networking│

Allow communication on the TCP port from the Cortex XDR agent to server (the default is port 443).
Allow the Cortex XDR management console and agent to communicate with external and internal resources required for enforcing endpoint protection.

Networking│

Allow communication on the TCP port from the Cortex XDR agent to server (the default is port 443).
Allow the Cortex XDR management console and agent to communicate with external and internal resources required for enforcing endpoint protection.

.NET│

Windows 8—.NET 4.5
Windows 8.1—.NET 4.5.1
Windows 10 and later releases—.NET 4.6
Windows Server 2008 R2—.NET 3.5 SP1 or .NET 3.5.1
Windows Server 2012—.NET 4.5
Windows Server 2012 R2 and later supported Windows releases—.NET 4.5.1

.NET│

Windows 8—.NET 4.5
Windows 8.1—.NET 4.5.1
Windows 10 and later releases—.NET 4.6
Windows Server 2008 R2—.NET 3.5 SP1 or .NET 3.5.1
Windows Server 2012—.NET 4.5
Windows Server 2012 R2 and later supported Windows releases—.NET 4.5.1

Applications and utilities│

Windows Accessories (Notepad) to view logs

Applications and utilities│

Windows Accessories (Notepad) to view logs

Localization│To set the language (English, German, Japanese, Spanish, French, Chinese Simplified, Chinese Traditional) of the Cortex XDR agent console, you must install the corresponding language pack.

Show markdown source

@@ -3,18 +3,18 @@ description: >-
   Windows endpoints must meet the following requirements to install the Cortex
   XDR agent.
 ---
 
 # Cortex XDR agent for Windows requirements
 
 The following requirements apply to standard and VDI Windows endpoints:
 
-| Requirement                | Specification                                                                                                                                                                                                                                                                                                                                                        |
-| -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Processor                  | <ul><li>Intel Pentium Dual Core or later with SSE2 instruction set support</li><li>AMD Opteron/Athlon 64 or later with SSE2 instruction set support</li><li>ARM (A64) with Windows 11 23H2 (release 10.0.22631) and later</li></ul>                                                                                                                                  |
-| RAM                        | 2GB minimum                                                                                                                                                                                                                                                                                                                                                          |
-| Hard disk space            | 5GB minimum; 20 GB recommended                                                                                                                                                                                                                                                                                                                                       |
-| Operating system versions  | Palo Alto Networks supports the Cortex XDR agent on many operating systems, virtual environments, and virtual applications. To determine the minimum Cortex XDR agent release for a specific operating system, environment, or application, refer to the Windows section of Where can I install the Cortex XDR Agent in the Palo Alto Networks Compatibility Matrix. |
-| Networking                 | <ul><li>Allow communication on the TCP port from the Cortex XDR agent to server (the default is port 443).</li><li>Allow the Cortex XDR management console and agent to communicate with external and internal resources required for enforcing endpoint protection.</li></ul>                                                                                       |
-| .NET                       | <ul><li>Windows 8—.NET 4.5</li><li>Windows 8.1—.NET 4.5.1</li><li>Windows 10 and later releases—.NET 4.6</li><li>Windows Server 2008 R2—.NET 3.5 SP1 or .NET 3.5.1</li><li>Windows Server 2012—.NET 4.5</li><li>Windows Server 2012 R2 and later supported Windows releases—.NET 4.5.1</li></ul>                                                                     |
-| Applications and utilities | <ul><li>Windows Accessories (Notepad) to view logs</li></ul>                                                                                                                                                                                                                                                                                                         |
-| Localization               | To set the language (English, German, Japanese, Spanish, French, Chinese Simplified, Chinese Traditional) of the Cortex XDR agent console, you must install the corresponding language pack.                                                                                                                                                                         |
+| Requirement                | Specification                                                                                                                                                                                                                                                                                                                                                                                                           |
+| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Processor                  | <ul><li>Intel Pentium Dual Core or later with SSE2 instruction set support</li><li>AMD Opteron/Athlon 64 or later with SSE2 instruction set support</li><li>ARM (A64) with Windows 11 23H2 (release 10.0.22631) and later</li></ul>                                                                                                                                                                                     |
+| RAM                        | 2GB minimum                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Hard disk space            | 5GB minimum; 20 GB recommended                                                                                                                                                                                                                                                                                                                                                                                          |
+| Operating system versions  | Palo Alto Networks supports the Cortex XDR agent on many operating systems, virtual environments, and virtual applications. To determine the minimum Cortex XDR agent release for a specific operating system, environment, or application, refer to the Windows section of [Where can I install the Cortex XDR Agent ](https://app.gitbook.com/s/fZ8QSMnkjnXpuOeuRcam/)in the Palo Alto Networks Compatibility Matrix. |
+| Networking                 | <ul><li>Allow communication on the TCP port from the Cortex XDR agent to server (the default is port 443).</li><li>Allow the Cortex XDR management console and agent to communicate with external and internal resources required for enforcing endpoint protection.</li></ul>                                                                                                                                          |
+| .NET                       | <ul><li>Windows 8—.NET 4.5</li><li>Windows 8.1—.NET 4.5.1</li><li>Windows 10 and later releases—.NET 4.6</li><li>Windows Server 2008 R2—.NET 3.5 SP1 or .NET 3.5.1</li><li>Windows Server 2012—.NET 4.5</li><li>Windows Server 2012 R2 and later supported Windows releases—.NET 4.5.1</li></ul>                                                                                                                        |
+| Applications and utilities | <ul><li>Windows Accessories (Notepad) to view logs</li></ul>                                                                                                                                                                                                                                                                                                                                                            |
+| Localization               | To set the language (English, German, Japanese, Spanish, French, Chinese Simplified, Chinese Traditional) of the Cortex XDR agent console, you must install the corresponding language pack.                                                                                                                                                                                                                            |

▸ Install the Cortex XDR agent for Windows modified +1 −1 agent/cortex-xdr-agent-for-windows/install-the-cortex-xdr-agent-for-windows

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -66,17 +66,17 @@ The following parameters apply to the initial installation on the Cortex XDR age

• CLEAN_AGGRESIVLY=1—Use to clean the endpoint from a previous Cortex XDR agent installation that was performed in msi Advertise mode. For details, see Cortex XDR Agents Deployed in Advertise Mode.

• CONTENT={path}\content-XXX-XXXXX.zip—Use to install the Cortex XDR agent with the downloaded content file to ensure the agent can enforce policies and rules on the endpoint immediately after agent startup. For example, CONTENT=\\sccm\share\Traps\Version740\content-181-58641.zip. You can specify the content path either from the local volume or from a shared directory to which the current logged-in user has access. To understand the benefits, workflow, and requirements to support this type of deployment, refer to Install the Cortex XDR Agent with Installer and Content Update Package.

• ENDPOINT_TAGS="Name1,Name2,Name3"—Use to add tags to the endpoint tags.

To install Cortex XDR using Msiexec:

1. Before installing the Cortex XDR agent on a Windows endpoint, verify that the system meets the requirements described in Cortex XDR Agent for Windows Requirements.

2. Use one of the following methods to open a command prompt as an administrator.

• Select Start → All Programs → Accessories. Right-click Command prompt and Run as administrator.

• Select Start → All Programs → Accessories. Right-click Command prompt and Run as administrator.

• Select Start. In the Start Search box, type cmd. Then, to open the command prompt as an administrator, press CTRL+SHIFT+ENTER.

3. Run the msiexec command followed by one or more supported options and properties.

For example:

**`msiexec /i c:\install\cortexxdr.msi /l*v C:\temp\cortexxdrinstall.log /qn`**

</details>

Show markdown source

@@ -66,17 +66,17 @@ The following parameters apply to the initial installation on the Cortex XDR age
 * **`CLEAN_AGGRESIVLY=1`**—Use to clean the endpoint from a previous Cortex XDR agent installation that was performed in **`msi`** Advertise mode. For details, see [Cortex XDR Agents Deployed in Advertise Mode](troubleshooting-resources-for-windows/cortex-xdr-agents-deployed-in-advertise-mode).
 * **`CONTENT={path}\content-XXX-XXXXX.zip`**—Use to install the Cortex XDR agent with the downloaded content file to ensure the agent can enforce policies and rules on the endpoint immediately after agent startup. For example, **`CONTENT=\\sccm\share\Traps\Version740\content-181-58641.zip`**. You can specify the content path either from the local volume or from a shared directory to which the current logged-in user has access. To understand the benefits, workflow, and requirements to support this type of deployment, refer to [Install the Cortex XDR Agent with Installer and Content Update Package](install-the-cortex-xdr-agent-with-installer-and-content-update-package).
 * **`ENDPOINT_TAGS="Name1,Name2,Name3"`**—Use to add tags to the endpoint tags.
 
 To install Cortex XDR using Msiexec:
 
 1. Before installing the Cortex XDR agent on a Windows endpoint, verify that the system meets the requirements described in [Cortex XDR Agent for Windows Requirements](cortex-xdr-agent-for-windows-requirements).
 2. Use one of the following methods to open a command prompt as an administrator.
-   * Select Start → **All Programs** → **Accessories**. Right-click **Command prompt** and **Run as administrator**.
+   * Select **Start** → **All Programs** → **Accessories**. Right-click **Command prompt** and **Run as administrator**.
    * Select **Start**. In the **Start Search** box, type **cmd**. Then, to open the command prompt as an administrator, press **CTRL**+**SHIFT**+**ENTER**.
 3.  Run the **`msiexec`** command followed by one or more supported options and properties.
 
     For example:
 
     **`msiexec /i c:\install\cortexxdr.msi /l*v C:\temp\cortexxdrinstall.log /qn`**
 
 </details>

▸ Troubleshooting resources for Windows modified +1 −9 agent/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,17 +1,9 @@

---

description: >-

Refer to the following troubleshooting resources for the Cortex XDR agent for

Windows.

---

# Troubleshooting resources for Windows

Resource│Description


Resource	Description
Services, Drivers, and Processes	Services: `C:\Program Files\Palo Alto Networks\Traps\cyserver.exe` `C:\Program Files\Palo Alto Networks\Cortex XDR Health Helper\xdrhealth.exe` Drivers: `C:\Program Files\Palo Alto Networks\Traps\cyverak.sys` `C:\Program Files\Palo Alto Networks\Traps\cyvrmtgn.sys` `C:\Program Files\Palo Alto Networks\Traps\cyvrfsfd.sys` `C:\Program Files\Palo Alto Networks\Traps\tedrdrv.sys` `C:\Program Files\Palo Alto Networks\Traps\tdevflt.sys` `C:\Program Files\Palo Alto Networks\Traps\tedrpers-<version>.sys` `C:\Windows\System32\drivers\telam.sys` Processes: `C:\Program Files\Palo Alto Networks\Traps\CyveraConsole.exe` `C:\Program Files\Palo Alto Networks\Traps\tlaworker.exe` (background process that is always running) `C:\Program Files\Palo Alto Networks\Traps\cytray.exe` (background process that is always running) `C:\Program Files\Palo Alto Networks\Traps\cytool.exe` `C:\Program Files\Palo Alto Networks\Traps\cydump.exe` `C:\Program Files\Palo Alto Networks\Traps\cyreport.exe` `C:\Program Files\Palo Alto Networks\Traps\cyrprtui.exe` `C:\Program Files\Palo Alto Networks\Traps\cysandbox.exe` `C:\Program Files\Palo Alto Networks\Traps\cyuserserver.exe` `C:\Program Files\Palo Alto Networks\Traps\cywscsvc.exe` `C:\Program Files (x86)\Palo Alto Networks\Traps\cyreport.exe` `C:\Program Files (x86)\Palo Alto Networks\Traps\cyrprtui.exe`
Cortex XDR installation log	Specifies any errors encountered during installation of agent components. Use this log file when you need to troubleshoot installation issues. On Windows endpoints, the installer stores the log files in the `temp` or `C:\Users\<user_name>\AppData\Local\Temp` folder.
Cortex XDR agent service log	Indicates information, warnings, and errors related to the Cortex XDR. The Service log is located in the following folder on the endpoint: Windows Vista or a later Windows OS—`ProgramData\Cyvera\Logs` Windows XP—`C:\Document and Settings\All Users\Application Data\Cyvera\Logs`
Cortex XDR agent console log	Indicates information, warnings, and errors related to the agent console. The Console log is located in the following folder on the endpoint: Windows Vista or a later Windows OS—`C:\Users\<username>\AppData\Roaming\Cyvera` Windows XP—`C:\Document and Settings\<username>\Application Data\Cyvera\Logs`
Supervisor Command Line Tool (cytool.exe)	Allows you to manage agent features and perform advanced troubleshooting on the local endpoint from a command line interface. For more information, see Cytool for Windows.
Unknown files for analysis	The agent stores unknown files to send to Cortex XDR in the `C:\ProgramData\Cyvera\Temp` folder. After Cortex XDR submits a file to WildFire, the agent deletes the file from the Temp folder. In some cases, third-party Antivirus (AV) applications raise an alert for this folder. If this occurs, we recommend that you whitelist this folder in the third-party AV application.
Cortex XDR Health Helper	Improves the upgrade process of the Cortex XDR agent, which monitors the machine at startup and initiates an upgrade rollback in case of a failed upgrade. As upgrades have multiple re-tries, the next try works on the agent of its original version with no interference. The service only runs at startup and remains in pause mode during other times. To ensure this service is not removed, a periodic task would re-instate the process in case it was removed.

| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

Services, Drivers, and Processes│

Services:

C:\Program Files\Palo Alto Networks\Traps\cyserver.exe
C:\Program Files\Palo Alto Networks\Cortex XDR Health Helper\xdrhealth.exe

Drivers:

C:\Program Files\Palo Alto Networks\Traps\cyverak.sys
C:\Program Files\Palo Alto Networks\Traps\cyvrmtgn.sys
C:\Program Files\Palo Alto Networks\Traps\cyvrfsfd.sys
C:\Program Files\Palo Alto Networks\Traps\tedrdrv.sys
C:\Program Files\Palo Alto Networks\Traps\tdevflt.sys
C:\Program Files\Palo Alto Networks\Traps\tedrpers-<version>.sys
C:\Windows\System32\drivers\telam.sys

Processes:

C:\Program Files\Palo Alto Networks\Traps\CyveraConsole.exe
C:\Program Files\Palo Alto Networks\Traps\tlaworker.exe (background process that is always running)
C:\Program Files\Palo Alto Networks\Traps\cytray.exe (background process that is always running)
C:\Program Files\Palo Alto Networks\Traps\cytool.exe
C:\Program Files\Palo Alto Networks\Traps\cydump.exe
C:\Program Files\Palo Alto Networks\Traps\cyreport.exe
C:\Program Files\Palo Alto Networks\Traps\cyrprtui.exe
C:\Program Files\Palo Alto Networks\Traps\cysandbox.exe
C:\Program Files\Palo Alto Networks\Traps\cyuserserver.exe
C:\Program Files\Palo Alto Networks\Traps\cywscsvc.exe
C:\Program Files (x86)\Palo Alto Networks\Traps\cyreport.exe
C:\Program Files (x86)\Palo Alto Networks\Traps\cyrprtui.exe

Cortex XDR installation log│Specifies any errors encountered during installation of agent components. Use this log file when you need to troubleshoot installation issues. On Windows endpoints, the installer stores the log files in the temp or C:\Users\<user_name>\AppData\Local\Temp folder.

Cortex XDR agent service log│

Indicates information, warnings, and errors related to the Cortex XDR. The Service log is located in the following folder on the endpoint:

Windows Vista or a later Windows OS—ProgramData\Cyvera\Logs
Windows XP—C:\Document and Settings\All Users\Application Data\Cyvera\Logs

Cortex XDR agent console log│

Indicates information, warnings, and errors related to the agent console. The Console log is located in the following folder on the endpoint:

Windows Vista or a later Windows OS—C:\Users\<username>\AppData\Roaming\Cyvera
Windows XP—C:\Document and Settings\<username>\Application Data\Cyvera\Logs

Supervisor Command Line Tool (cytool.exe)│Allows you to manage agent features and perform advanced troubleshooting on the local endpoint from a command line interface. For more information, see Cytool for Windows.

Unknown files for analysis│The agent stores unknown files to send to Cortex XDR in the C:\ProgramData\Cyvera\Temp folder. After Cortex XDR submits a file to WildFire, the agent deletes the file from the Temp folder.

In some cases, third-party Antivirus (AV) applications raise an alert for this folder. If this occurs, we recommend that you whitelist this folder in the third-party AV application.

Cortex XDR Health Helper│Improves the upgrade process of the Cortex XDR agent, which monitors the machine at startup and initiates an upgrade rollback in case of a failed upgrade. As upgrades have multiple re-tries, the next try works on the agent of its original version with no interference. The service only runs at startup and remains in pause mode during other times. To ensure this service is not removed, a periodic task would re-instate the process in case it was removed.

Show markdown source

@@ -1,17 +1,9 @@
 ---
 description: >-
   Refer to the following troubleshooting resources for the Cortex XDR agent for
   Windows.
 ---
 
 # Troubleshooting resources for Windows
 
-| Resource                                  | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Services, Drivers, and Processes          | <p>Services:</p><ul><li><code>C:\Program Files\Palo Alto Networks\Traps\cyserver.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Cortex XDR Health Helper\xdrhealth.exe</code></li></ul><p>Drivers:</p><ul><li><code>C:\Program Files\Palo Alto Networks\Traps\cyverak.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyvrmtgn.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyvrfsfd.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tedrdrv.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tdevflt.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tedrpers-&#x3C;version>.sys</code></li><li><code>C:\Windows\System32\drivers\telam.sys</code></li></ul><p>Processes:</p><ul><li><code>C:\Program Files\Palo Alto Networks\Traps\CyveraConsole.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tlaworker.exe</code> (background process that is always running)</li><li><code>C:\Program Files\Palo Alto Networks\Traps\cytray.exe</code> (background process that is always running)</li><li><code>C:\Program Files\Palo Alto Networks\Traps\cytool.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cydump.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyreport.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyrprtui.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cysandbox.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyuserserver.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cywscsvc.exe</code></li><li><code>C:\Program Files (x86)\Palo Alto Networks\Traps\cyreport.exe</code></li><li><code>C:\Program Files (x86)\Palo Alto Networks\Traps\cyrprtui.exe</code></li></ul> |
-| Cortex XDR installation log               | Specifies any errors encountered during installation of agent components. Use this log file when you need to troubleshoot installation issues. On Windows endpoints, the installer stores the log files in the `temp` or `C:\Users\<user_name>\AppData\Local\Temp` folder.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| Cortex XDR agent service log              | <p>Indicates information, warnings, and errors related to the Cortex XDR. The Service log is located in the following folder on the endpoint:</p><ul><li><strong>Windows Vista or a later Windows OS</strong>—<code>ProgramData\Cyvera\Logs</code></li><li><strong>Windows XP</strong>—<code>C:\Document and Settings\All Users\Application Data\Cyvera\Logs</code></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| Cortex XDR agent console log              | <p>Indicates information, warnings, and errors related to the agent console. The Console log is located in the following folder on the endpoint:</p><ul><li><strong>Windows Vista or a later Windows OS</strong>—<code>C:\Users\&#x3C;username>\AppData\Roaming\Cyvera</code></li><li><strong>Windows XP</strong>—<code>C:\Document and Settings\&#x3C;username>\Application Data\Cyvera\Logs</code></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| Supervisor Command Line Tool (cytool.exe) | Allows you to manage agent features and perform advanced troubleshooting on the local endpoint from a command line interface. For more information, see Cytool for Windows.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| Unknown files for analysis                | <p>The agent stores unknown files to send to Cortex XDR in the <code>C:\ProgramData\Cyvera\Temp</code> folder. After Cortex XDR submits a file to WildFire, the agent deletes the file from the Temp folder.</p><p>In some cases, third-party Antivirus (AV) applications raise an alert for this folder. If this occurs, we recommend that you whitelist this folder in the third-party AV application.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| Cortex XDR Health Helper                  | Improves the upgrade process of the Cortex XDR agent, which monitors the machine at startup and initiates an upgrade rollback in case of a failed upgrade. As upgrades have multiple re-tries, the next try works on the agent of its original version with no interference. The service only runs at startup and remains in pause mode during other times. To ensure this service is not removed, a periodic task would re-instate the process in case it was removed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+<table data-header-hidden data-search="false"><thead><tr><th width="160.174560546875"></th><th width="549.5302734375"></th></tr></thead><tbody><tr><td>Resource</td><td>Description</td></tr><tr><td>Services, Drivers, and Processes</td><td><p>Services:</p><ul><li><code>C:\Program Files\Palo Alto Networks\Traps\cyserver.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Cortex XDR Health Helper\xdrhealth.exe</code></li></ul><p>Drivers:</p><ul><li><code>C:\Program Files\Palo Alto Networks\Traps\cyverak.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyvrmtgn.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyvrfsfd.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tedrdrv.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tdevflt.sys</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tedrpers-&#x3C;version>.sys</code></li><li><code>C:\Windows\System32\drivers\telam.sys</code></li></ul><p>Processes:</p><ul><li><code>C:\Program Files\Palo Alto Networks\Traps\CyveraConsole.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\tlaworker.exe</code> (background process that is always running)</li><li><code>C:\Program Files\Palo Alto Networks\Traps\cytray.exe</code> (background process that is always running)</li><li><code>C:\Program Files\Palo Alto Networks\Traps\cytool.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cydump.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyreport.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyrprtui.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cysandbox.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cyuserserver.exe</code></li><li><code>C:\Program Files\Palo Alto Networks\Traps\cywscsvc.exe</code></li><li><code>C:\Program Files (x86)\Palo Alto Networks\Traps\cyreport.exe</code></li><li><code>C:\Program Files (x86)\Palo Alto Networks\Traps\cyrprtui.exe</code></li></ul></td></tr><tr><td>Cortex XDR installation log</td><td>Specifies any errors encountered during installation of agent components. Use this log file when you need to troubleshoot installation issues. On Windows endpoints, the installer stores the log files in the <code>temp</code> or <code>C:\Users\&#x3C;user_name>\AppData\Local\Temp</code> folder.</td></tr><tr><td>Cortex XDR agent service log</td><td><p>Indicates information, warnings, and errors related to the Cortex XDR. The Service log is located in the following folder on the endpoint:</p><ul><li><strong>Windows Vista or a later Windows OS</strong>—<code>ProgramData\Cyvera\Logs</code></li><li><strong>Windows XP</strong>—<code>C:\Document and Settings\All Users\Application Data\Cyvera\Logs</code></li></ul></td></tr><tr><td>Cortex XDR agent console log</td><td><p>Indicates information, warnings, and errors related to the agent console. The Console log is located in the following folder on the endpoint:</p><ul><li><strong>Windows Vista or a later Windows OS</strong>—<code>C:\Users\&#x3C;username>\AppData\Roaming\Cyvera</code></li><li><strong>Windows XP</strong>—<code>C:\Document and Settings\&#x3C;username>\Application Data\Cyvera\Logs</code></li></ul></td></tr><tr><td>Supervisor Command Line Tool (cytool.exe)</td><td>Allows you to manage agent features and perform advanced troubleshooting on the local endpoint from a command line interface. For more information, see Cytool for Windows.</td></tr><tr><td>Unknown files for analysis</td><td><p>The agent stores unknown files to send to Cortex XDR in the <code>C:\ProgramData\Cyvera\Temp</code> folder. After Cortex XDR submits a file to WildFire, the agent deletes the file from the Temp folder.</p><p>In some cases, third-party Antivirus (AV) applications raise an alert for this folder. If this occurs, we recommend that you whitelist this folder in the third-party AV application.</p></td></tr><tr><td>Cortex XDR Health Helper</td><td>Improves the upgrade process of the Cortex XDR agent, which monitors the machine at startup and initiates an upgrade rollback in case of a failed upgrade. As upgrades have multiple re-tries, the next try works on the agent of its original version with no interference. The service only runs at startup and remains in pause mode during other times. To ensure this service is not removed, a periodic task would re-instate the process in case it was removed.</td></tr></tbody></table>

▸ Cytool for Windows modified +1 −26 The cytool command reference was converted to an HTML table with no change to the documented options. agent/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows/cytool-for-windows

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -13,34 +13,9 @@ On Windows endpoints, you can access Cytool using a Microsoft command prompt tha

The following table displays the Cytool options available on Windows endpoints. Where there is a password required for admin commands, this is the same password as was defined as the Uninstall Password.

hint info

### Note

Since the Cortex XDR agent 7.6 release for Windows, the cyserver.exe process includes and replaces the previous CyveraService.exe, tlaservice.exe, and twdservice.exe high-privileged processes.

endhint

Command Option│Description


Command Option	Description
adaptive_policy	Adaptive policy agent commands Usage `cytool adaptive_policy [interval <seconds
cert_enforcement	Perform Certificate enforcement related operations. Usage: `cytool cert_enforcement <operation>` Where <operation> is one of the following: query Display current enforcement status disable Forcibly disable enforcement policy Set enforcement by policy import <certificate file path> Import a proprietary certificate in PEM format as root CA import clear Clear all custom root CA certificates.
checkin	Initiate check-in to the server. Usage: `cytool checkin` To verify the checkin, view the check-in time on the agent console.
edr	Display EDR stats collected on the endpoint. Usage: `cytool edr stats`
endpoint_tags	Use Endpoint Tags to identify groups of endpoints. Usage: `cytool endpoint_tags <action>` Where action can be: add—Add tags to the endpoint tag list. remove—Remove the given tags from the list of endpoint tags. list—Display the available list of endpoint tags. Note Tags should be passed as one string, separated by commas, and with no spaces. Example: `cytool endpoint_tags add "tag1[,tage2,...,tagN]"` `cytool endpoint_tags remove "tag1[,tage2,...,tagN]"` `cytool endpoint_tags list "tag1[,tage2,...,tagN]"`
enum	Enumerate protected processes. Usage: `cytool enum` Note If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.
event_collection	Perform event collection (EDR/DSE) operations. Usage: `cytool event_collection <operation>` Where <operation> can be: query—Displays the current event collection status. enable—Start or stop event collection as set by policy. disable—Forcibly stops event collection. logstat—Writes internal statistics to the log file.
image	Display information about a PE file (executable or DLL). Usage: `cytool image <filename>` For example: `C:\Program Files\Palo Alto Networks\Traps> cytool image json.dll Image Information Location: json.dll Size: 176.98 KB (181224 bytes) File SHA256: a46b8e1ad9a808fb09e7b79bd03b66a611d0c7aa71291c216be555af14d16421 Architecture: x86-64 Subsystem: Windows GUI PE Size: 156.00 KB (159744 bytes) PE SHA256: 8cbca46419bf7260c99aaa3c73a6944e97f5c5b053a8b88e9a17367439b08d7d`
imageprep	Prepare a golden image by submitting files for cloud analysis and generate a threats report. Usage: `cytool imageprep [scan] [timeout <scan timeout>][upload <upload timeout>] [path <full path>]` where: <scan timeout>—The number of hours the scan is permitted to run before reporting an error. <upload timeout>—The number of minutes the agent can take to upload unknown files to Cortex XDR before reporting an error. <full path>—Path to store the scan report. If no path is specified, Cytool saves the scan report to the local Cytool directory. To save files to this folder, you must first disable service protection using the `cytool protect disable` command. Example: `C:\Program Files\Palo Alto Networks\Traps> cytool imageprep scan timeout 4 upload 60 path c:\report Start Time : 17:56:46 Elapsed Time : 00:04:17 State : Running Scanned Files : 5427 Suspicious Files : 0 Failed Files : 9 Volume Root Path : \\?\C:\ Window Usage : 0 236 20000 Path : ...t\cache2\entries\9B982CE198BF046E6CCF25478920DDFD9E5842E5 Scan completed successfully Complete report can be found at: C:\report\imageprep_2019-03-06_08-59-30.xml`
import	Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.
info	Display general Cortex XDR agent information. Usage: `cytool info [query]` To display the agent version, run the `cytool info` command without any additional arguments. To display additional details about the agent, such as the version of the default policy and the specific build number, add the query argument.
isolate	Release endpoint from network isolation. Usage: `cytool isolate stop`
last_checkin	Display the time of the last successful check-in. Usage: `cytool last_checkin`
log	Set log level for the desired process/Generate support file archive. Usage: `cytool log set_level <log_level> <Components
payload_execution	Stop or query payload execution status. Relates to Live Terminal and script execution. Usage: cytool payload_execution query—Display current payload execution status. cytool payload_execution stop—Stop payload execution.
persist	The Cortex XDR agent stores policy and security event information, such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database. Usage: `cytoolpersist <action>` Where <action> can be: list—Lists the local databases on the endpoint. export [<database name> \| <databasepath>]—Exports the database table to a file in the `C:\Users\<user>\Documents\PaloAltoNetworks\Traps\cytool` directory. import [<database name> \| <databasepath>] <file name>—Adds the records in a JSON file to the database. print <database name> \| <databasepath> [csv]—Prints the records in the database to a CSV file. To view a list of all local databases, use the `cytool persist list` command.
policy	Query or compare the applied policy for a process. Usage: `cytool policy [query
protect	Enable or disable a protection feature. Usage: cytool protect `<Action>` `<Feature>` where: <Action>—Changes protection for an agent feature. Options are: `enable` `disable` `policy` `query`. The query option displays the protection status for each feature. `<Feature>`—Specifies the feature for which you want to change the protection status. Options are: `Process`, for agent core processes `Registry`, for agent registry keys `File`, for agent files `Service`, for agent services `Pipe`, for protection of agent pipes. For example: To disable registry protection, `CYTOOL protect disable registry` To enable all protection, `CYTOOL protect enable` To set protection according to policy, `CYTOOL protect policy` Note Any protection state change made by Cytool persists until the next reboot and is set according to the policy one hour after reboot.
proxy	Set or query cloud-defined proxies for the agent. Usage: `cytool proxy query`—Display the current status of cloud-defined proxy settings. `cytool proxy set <list>`—Set cloud-defined proxy settings to the proxies defined in <list>. For example: `cytool proxy set "192.168.50.1:8080,192.168.60.2:808"` `cytool proxy set ""`—Disable cloud-defined proxy.
quarantine	View and restore quarantined files. Usage: `cytool quarantine list`—List all quarantined files. `cytool restore <ID> [<path>]`—Restore files to their original location or to a path, if specified, by specifying the file ID.
queryall	The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.
reconnect	Try reconnecting to the server if communication has been disabled, or force registration with a new `distribution_id`. Usage: `cytool reconnect`—Reconnects the Cortex XDR agent to the management application on the server. `cytool reconnect [force <distribution_id]>` Note The `distribution_id` must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.
runtime	Stop or start product components. Usage: `cytool runtime <Action> <Component>` where: <Action>—Changes startup runtime action for an agent component. Options are: `start`, `stop`, and `query`. The query option displays the startup status for each component. <Component>—Specifies the component for which you want to change the runtime action, or you can specify all components by not including any in this command. To change the runtime action for a subset of components, list them with spaces separating each component. Options are: `cyverak`, `cyvrmtgn`, `cyvrfsfd`, and `cyserver`. For example: `C:\Program Files\Palo Alto Networks\Traps>cytool runtime stop cyserver cyverak Enter supervisor password: Service State cyverak Stopped cyvrmtgn Running cyvrfsfd Running cyserver Stopped`
scan	Scan operations. Usage: `cytool scan <Action>` Where <action>: `start`—Scans the endpoint for malware. `stop`—Stops a scan. `query`—Displays the progress if a system scan is active. `last_scan_time`—Displays the last time a scan was done. Example: `C:\Program Files\Palo Alto Networks\Traps> cytool scan start Enter supervisor password: The operation completed successfully. C:\Program Files\Palo Alto Networks\Traps> cytool scan query Enter supervisor password: Start Time : 9:09:0648 Elapsed Time : 00:00:51 State : Running Scanned Files : 3944 Suspicious Files : 0 Failed Files : 1\?\C:\ Volume Root Path : \\?\C:\ 8 20000 Window Usage : 0 14 20000 Path : ...`

| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

adaptive_policy│Adaptive policy agent commands

Usage `cytool adaptive_policy [interval <seconds

cert_enforcement│

Perform Certificate enforcement related operations.

Usage: cytool cert_enforcement <operation>

Where <operation> is one of the following:

query Display current enforcement status
disable Forcibly disable enforcement
policy Set enforcement by policy
import <certificate file path> Import a proprietary certificate in PEM format as root CA
import clear Clear all custom root CA certificates.

checkin│Initiate check-in to the server.

Usage: cytool checkin

To verify the checkin, view the check-in time on the agent console.

edr│Display EDR stats collected on the endpoint.

Usage: cytool edr stats

endpoint_tags│

Use Endpoint Tags to identify groups of endpoints.

Usage: cytool endpoint_tags <action>

Where action can be:

add—Add tags to the endpoint tag list.
remove—Remove the given tags from the list of endpoint tags.
list—Display the available list of endpoint tags.

Note

Tags should be passed as one string, separated by commas, and with no spaces.

Example:

cytool endpoint_tags add "tag1[,tage2,...,tagN]"
cytool endpoint_tags remove "tag1[,tage2,...,tagN]"
cytool endpoint_tags list "tag1[,tage2,...,tagN]"

enum│

Enumerate protected processes.

Usage: cytool enum

Note

If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.

event_collection│

Perform event collection (EDR/DSE) operations.

Usage: cytool event_collection <operation>

Where <operation> can be:

query—Displays the current event collection status.
enable—Start or stop event collection as set by policy.
disable—Forcibly stops event collection.
logstat—Writes internal statistics to the log file.

image│Display information about a PE file (executable or DLL).

Usage: cytool image <filename>

For example:

C:\Program Files\Palo Alto Networks\Traps> cytool image json.dll Image Information Location: json.dll Size: 176.98 KB (181224 bytes) File SHA256: a46b8e1ad9a808fb09e7b79bd03b66a611d0c7aa71291c216be555af14d16421 Architecture: x86-64 Subsystem: Windows GUI PE Size: 156.00 KB (159744 bytes) PE SHA256: 8cbca46419bf7260c99aaa3c73a6944e97f5c5b053a8b88e9a17367439b08d7d

imageprep│Prepare a golden image by submitting files for cloud analysis and generate a threats report.

Usage: cytool imageprep [scan] [timeout <scan timeout>][upload <upload timeout>] [path <full path>]

where:

<scan timeout>—The number of hours the scan is permitted to run before reporting an error.
<upload timeout>—The number of minutes the agent can take to upload unknown files to Cortex XDR before reporting an error.
<full path>—Path to store the scan report. If no path is specified, Cytool saves the scan report to the local Cytool directory. To save files to this folder, you must first disable service protection using the cytool protect disable command.

Example:

C:\Program Files\Palo Alto Networks\Traps> cytool imageprep scan timeout 4 upload 60 path c:\report Start Time : 17:56:46 Elapsed Time : 00:04:17 State : Running Scanned Files : 5427 Suspicious Files : 0 Failed Files : 9 Volume Root Path : \\?\C:\ Window Usage : 0 236 20000 Path : ...t\cache2\entries\9B982CE198BF046E6CCF25478920DDFD9E5842E5 Scan completed successfully Complete report can be found at: C:\report\imageprep_2019-03-06_08-59-30.xml

import│Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.

info│

Display general Cortex XDR agent information.

Usage: cytool info [query]

To display the agent version, run the cytool info command without any additional arguments.
To display additional details about the agent, such as the version of the default policy and the specific build number, add the query argument.

isolate│Release endpoint from network isolation.

Usage: cytool isolate stop

last_checkin│Display the time of the last successful check-in.

Usage: cytool last_checkin

log│Set log level for the desired process/Generate support file archive.

Usage: `cytool log set_level <log_level> <Components

payload_execution│

Stop or query payload execution status. Relates to Live Terminal and script execution.

Usage:

cytool payload_execution query—Display current payload execution status.
cytool payload_execution stop—Stop payload execution.

persist│

The Cortex XDR agent stores policy and security event information, such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database.

Usage: cytoolpersist <action>

Where <action> can be:

list—Lists the local databases on the endpoint.
export [<database name>

│<databasepath>]—Exports the database table to a file in the C:\Users\<user>\Documents\PaloAltoNetworks\Traps\cytool directory.</li><li>import [<database name>│<databasepath>] <file name>—Adds the records in a JSON file to the database.</li><li>print <database name>│<databasepath> [csv]—Prints the records in the database to a CSV file.</li></ul>To view a list of all local databases, use the cytool persist list command.

policy│Query or compare the applied policy for a process.

Usage: `cytool policy [query

protect│

Enable or disable a protection feature.

Usage: cytool protect <Action> <Feature>

where:

<Action>—Changes protection for an agent feature. Options are:
enable
disable
policy
query. The query option displays the protection status for each feature.
<Feature>—Specifies the feature for which you want to change the protection status. Options are:
Process, for agent core processes
Registry, for agent registry keys
File, for agent files
Service, for agent services
Pipe, for protection of agent pipes.

For example:

To disable registry protection,

CYTOOL protect disable registry

To enable all protection,

CYTOOL protect enable

To set protection according to policy,

CYTOOL protect policy

Note

Any protection state change made by Cytool persists until the next reboot and is set according to the policy one hour after reboot.

proxy│

Set or query cloud-defined proxies for the agent.

Usage:

cytool proxy query—Display the current status of cloud-defined proxy settings.
cytool proxy set <list>—Set cloud-defined proxy settings to the proxies defined in <list>.
For example: cytool proxy set "192.168.50.1:8080,192.168.60.2:808"
cytool proxy set ""—Disable cloud-defined proxy.

quarantine│

View and restore quarantined files.

Usage:

cytool quarantine list—List all quarantined files.
cytool restore <ID> [<path>]—Restore files to their original location or to a path, if specified, by specifying the file ID.

queryall│The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.

reconnect│

Try reconnecting to the server if communication has been disabled, or force registration with a new distribution_id.

Usage:

cytool reconnect—Reconnects the Cortex XDR agent to the management application on the server.
cytool reconnect [force <distribution_id]>

Note

The distribution_id must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.

runtime│Stop or start product components.

Usage: cytool runtime <Action> <Component>

where:

<Action>—Changes startup runtime action for an agent component.
Options are: start, stop, and query. The query option displays the startup status for each component.
<Component>—Specifies the component for which you want to change the runtime action, or you can specify all components by not including any in this command.
To change the runtime action for a subset of components, list them with spaces separating each component.
Options are: cyverak, cyvrmtgn, cyvrfsfd, and cyserver.

For example:

C:\Program Files\Palo Alto Networks\Traps>cytool runtime stop cyserver cyverak Enter supervisor password: Service State cyverak Stopped cyvrmtgn Running cyvrfsfd Running cyserver Stopped

scan│Scan operations.

Usage: cytool scan <Action>

Where <action>:

start—Scans the endpoint for malware.
stop—Stops a scan.
query—Displays the progress if a system scan is active.
last_scan_time—Displays the last time a scan was done.

Example:

C:\Program Files\Palo Alto Networks\Traps> cytool scan start Enter supervisor password: The operation completed successfully. C:\Program Files\Palo Alto Networks\Traps> cytool scan query Enter supervisor password: Start Time : 9:09:0648 Elapsed Time : 00:00:51 State : Running Scanned Files : 3944 Suspicious Files : 0 Failed Files : 1\?\C:\ Volume Root Path : \\?\C:\ 8 20000 Window Usage : 0 14 20000 Path : ...

Show markdown source

@@ -13,34 +13,9 @@ On Windows endpoints, you can access Cytool using a Microsoft command prompt tha
 The following table displays the Cytool options available on Windows endpoints. Where there is a password required for admin commands, this is the same password as was defined as the Uninstall Password.
 
 {% hint style="info" %}
 ### Note
 
 Since the Cortex XDR agent 7.6 release for Windows, the cyserver.exe process includes and replaces the previous CyveraService.exe, tlaservice.exe, and twdservice.exe high-privileged processes.
 {% endhint %}
 
-| Command Option     | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| adaptive\_policy   | <p>Adaptive policy agent commands</p><p>Usage `cytool adaptive_policy [interval &#x3C;seconds</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| cert\_enforcement  | <p>Perform Certificate enforcement related operations.</p><p>Usage: <code>cytool cert_enforcement &#x3C;operation></code></p><p>Where &#x3C;operation> is one of the following:                                </p><ul><li>query                       Display current enforcement status</li><li>disable                     Forcibly disable enforcement</li><li>policy                      Set enforcement by policy</li><li>import &#x3C;certificate file path>     Import a proprietary certificate in PEM format as root CA</li><li>import clear                       Clear all custom root CA certificates.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| checkin            | <p>Initiate check-in to the server.</p><p>Usage: <code>cytool checkin</code></p><p>To verify the checkin, view the check-in time on the agent console.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| edr                | <p>Display EDR stats collected on the endpoint.</p><p>Usage: <code>cytool edr stats</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| endpoint\_tags     | <p>Use Endpoint Tags to identify groups of endpoints.</p><p>Usage: <code>cytool endpoint_tags &#x3C;action></code></p><p>Where action can be:</p><ul><li>add—Add tags to the endpoint tag list.</li><li>remove—Remove the given tags from the list of endpoint tags.</li><li>list—Display the available list of endpoint tags.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Tags should be passed as one string, separated by commas, and with no spaces.</p></div><p>Example:</p><ul><li><code>cytool endpoint_tags add "tag1[,tage2,...,tagN]"</code></li><li><code>cytool endpoint_tags remove "tag1[,tage2,...,tagN]"</code></li><li><code>cytool endpoint_tags list "tag1[,tage2,...,tagN]"</code></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| enum               | <p>Enumerate protected processes.</p><p>Usage: <code>cytool enum</code></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.</p></div>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| event\_collection  | <p>Perform event collection (EDR/DSE) operations.</p><p>Usage: <code>cytool event_collection &#x3C;operation></code></p><p>Where &#x3C;operation> can be:</p><ul><li>query—Displays the current event collection status.</li><li>enable—Start or stop event collection as set by policy.</li><li>disable—Forcibly stops event collection.</li><li>logstat—Writes internal statistics to the log file.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| image              | <p>Display information about a PE file (executable or DLL).</p><p>Usage: <code>cytool image &#x3C;filename></code></p><p>For example:</p><p><code>C:\Program Files\Palo Alto Networks\Traps> cytool image json.dll Image Information Location: json.dll Size: 176.98 KB (181224 bytes) File SHA256: a46b8e1ad9a808fb09e7b79bd03b66a611d0c7aa71291c216be555af14d16421 Architecture: x86-64 Subsystem: Windows GUI PE Size: 156.00 KB (159744 bytes) PE SHA256: 8cbca46419bf7260c99aaa3c73a6944e97f5c5b053a8b88e9a17367439b08d7d</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| imageprep          | <p>Prepare a golden image by submitting files for cloud analysis and generate a threats report.</p><p>Usage: <code>cytool imageprep [scan] [timeout &#x3C;scan timeout>][upload &#x3C;upload timeout>] [path &#x3C;full path>]</code></p><p>where:</p><ul><li>&#x3C;scan timeout>—The number of hours the scan is permitted to run before reporting an error.</li><li>&#x3C;upload timeout>—The number of minutes the agent can take to upload unknown files to Cortex XDR before reporting an error.</li><li>&#x3C;full path>—Path to store the scan report. If no path is specified, Cytool saves the scan report to the local Cytool directory. To save files to this folder, you must first disable service protection using the <code>cytool protect disable</code> command.</li></ul><p>Example:</p><p><code>C:\Program Files\Palo Alto Networks\Traps> cytool imageprep scan timeout 4 upload 60 path c:\report Start Time : 17:56:46 Elapsed Time : 00:04:17 State : Running Scanned Files : 5427 Suspicious Files : 0 Failed Files : 9 Volume Root Path : \\?\C:\ Window Usage : 0 236 20000 Path : ...t\cache2\entries\9B982CE198BF046E6CCF25478920DDFD9E5842E5 Scan completed successfully Complete report can be found at: C:\report\imageprep_2019-03-06_08-59-30.xml</code></p>                                                                                |
-| import             | Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| info               | <p>Display general Cortex XDR agent information.</p><p>Usage: <code>cytool info [query]</code></p><ul><li>To display the agent version, run the <code>cytool info</code> command without any additional arguments.</li><li>To display additional details about the agent, such as the version of the default policy and the specific build number, add the query argument.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| isolate            | <p>Release endpoint from network isolation.</p><p>Usage: <code>cytool isolate stop</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| last\_checkin      | <p>Display the time of the last successful check-in.</p><p>Usage: <code>cytool last_checkin</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| log                | <p>Set log level for the desired process/Generate support file archive.</p><p>Usage: `cytool log set_level &#x3C;log_level> &#x3C;Components</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| payload\_execution | <p>Stop or query payload execution status. Relates to Live Terminal and script execution.</p><p>Usage:</p><ul><li>cytool payload_execution query—Display current payload execution status.</li><li>cytool payload_execution stop—Stop payload execution.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| persist            | <p>The Cortex XDR agent stores policy and security event information, such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database.</p><p>Usage: <code>cytoolpersist &#x3C;action></code></p><p>Where &#x3C;action> can be:</p><ul><li>list—Lists the local databases on the endpoint.</li><li>export [&#x3C;database name> | &#x3C;databasepath>]—Exports the database table to a file in the <code>C:\Users\&#x3C;user>\Documents\PaloAltoNetworks\Traps\cytool</code> directory.</li><li>import [&#x3C;database name> | &#x3C;databasepath>] &#x3C;file name>—Adds the records in a JSON file to the database.</li><li>print &#x3C;database name> | &#x3C;databasepath> [csv]—Prints the records in the database to a CSV file.</li></ul><p>To view a list of all local databases, use the <code>cytool persist list</code> command.</p>                                                                                                                                                                                                                                                                                                                   |
-| policy             | <p>Query or compare the applied policy for a process.</p><p>Usage: `cytool policy [query</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| protect            | <p>Enable or disable a protection feature.</p><p>Usage: cytool protect <code>&#x3C;Action></code> <code>&#x3C;Feature></code></p><p>where:</p><ul><li><p>&#x3C;Action>—Changes protection for an agent feature. Options are:</p><p><code>enable</code></p><p><code>disable</code></p><p><code>policy</code></p><p><code>query</code>. The query option displays the protection status for each feature.</p></li><li><p><strong><code>&#x3C;Feature></code></strong>—Specifies the feature for which you want to change the protection status. Options are:</p><p><code>Process</code>, for agent core processes</p><p><code>Registry</code>, for agent registry keys</p><p><code>File</code>, for agent files</p><p><code>Service</code>, for agent services</p><p><code>Pipe</code>, for protection of agent pipes.</p></li></ul><p>For example:</p><p>To disable registry protection,</p><p><code>CYTOOL protect disable registry</code></p><p>To enable all protection,</p><p><code>CYTOOL protect enable</code></p><p>To set protection according to policy,</p><p><code>CYTOOL protect policy</code></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Any protection state change made by Cytool persists until the next reboot and is set according to the policy one hour after reboot.</p></div> |
-| proxy              | <p>Set or query cloud-defined proxies for the agent.</p><p>Usage:</p><ul><li><code>cytool proxy query</code>—Display the current status of cloud-defined proxy settings.</li><li><p><code>cytool proxy set &#x3C;list></code>—Set cloud-defined proxy settings to the proxies defined in &#x3C;list>.</p><p>For example: <code>cytool proxy set "192.168.50.1:8080,192.168.60.2:808"</code></p></li><li><code>cytool proxy set ""</code>—Disable cloud-defined proxy.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| quarantine         | <p>View and restore quarantined files.</p><p>Usage:</p><ul><li><code>cytool quarantine list</code>—List all quarantined files.</li><li><code>cytool restore &#x3C;ID> [&#x3C;path>]</code>—Restore files to their original location or to a path, if specified, by specifying the file ID.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| queryall           | The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| reconnect          | <p>Try reconnecting to the server if communication has been disabled, or force registration with a new <code>distribution_id</code>.</p><p>Usage:</p><ul><li><code>cytool reconnect</code>—Reconnects the Cortex XDR agent to the management application on the server.</li><li><code>cytool reconnect [force &#x3C;distribution_id]></code></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The <code>distribution_id</code> must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</p></div>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| runtime            | <p>Stop or start product components.</p><p>Usage: <code>cytool runtime &#x3C;Action> &#x3C;Component></code></p><p>where:</p><ul><li><p>&#x3C;Action>—Changes startup runtime action for an agent component.</p><p>Options are: <code>start</code>, <code>stop</code>, and <code>query</code>. The query option displays the startup status for each component.</p></li><li><p>&#x3C;Component>—Specifies the component for which you want to change the runtime action, or you can specify all components by not including any in this command.</p><p>To change the runtime action for a subset of components, list them with spaces separating each component.</p><p>Options are: <code>cyverak</code>, <code>cyvrmtgn</code>, <code>cyvrfsfd</code>, and <code>cyserver</code>.</p></li></ul><p>For example:</p><p><code>C:\Program Files\Palo Alto Networks\Traps>cytool runtime stop cyserver cyverak Enter supervisor password: Service State cyverak Stopped cyvrmtgn Running cyvrfsfd Running cyserver Stopped</code></p>                                                                                                                                                                                                                                                                                                                                            |
-| scan               | <p>Scan operations.</p><p>Usage: <code>cytool scan &#x3C;Action></code></p><p>Where &#x3C;action>:</p><ul><li><code>start</code>—Scans the endpoint for malware.</li><li><code>stop</code>—Stops a scan.</li><li><code>query</code>—Displays the progress if a system scan is active.</li><li><code>last_scan_time</code>—Displays the last time a scan was done.</li></ul><p>Example:</p><p><code>C:\Program Files\Palo Alto Networks\Traps> cytool scan start Enter supervisor password: The operation completed successfully. C:\Program Files\Palo Alto Networks\Traps> cytool scan query Enter supervisor password: Start Time : 9:09:0648 Elapsed Time : 00:00:51 State : Running Scanned Files : 3944 Suspicious Files : 0 Failed Files : 1\?\C:\ Volume Root Path : \\?\C:\ 8 20000 Window Usage : 0 14 20000 Path : ...</code></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+<table data-header-hidden><thead><tr><th width="199.2725830078125"></th><th></th></tr></thead><tbody><tr><td>Command Option</td><td>Description</td></tr><tr><td>adaptive_policy</td><td><p>Adaptive policy agent commands</p><p>Usage `cytool adaptive_policy [interval &#x3C;seconds</p></td></tr><tr><td>cert_enforcement</td><td><p>Perform Certificate enforcement related operations.</p><p>Usage: <code>cytool cert_enforcement &#x3C;operation></code></p><p>Where &#x3C;operation> is one of the following:                                </p><ul><li>query                       Display current enforcement status</li><li>disable                     Forcibly disable enforcement</li><li>policy                      Set enforcement by policy</li><li>import &#x3C;certificate file path>     Import a proprietary certificate in PEM format as root CA</li><li>import clear                       Clear all custom root CA certificates.</li></ul></td></tr><tr><td>checkin</td><td><p>Initiate check-in to the server.</p><p>Usage: <code>cytool checkin</code></p><p>To verify the checkin, view the check-in time on the agent console.</p></td></tr><tr><td>edr</td><td><p>Display EDR stats collected on the endpoint.</p><p>Usage: <code>cytool edr stats</code></p></td></tr><tr><td>endpoint_tags</td><td><p>Use Endpoint Tags to identify groups of endpoints.</p><p>Usage: <code>cytool endpoint_tags &#x3C;action></code></p><p>Where action can be:</p><ul><li>add—Add tags to the endpoint tag list.</li><li>remove—Remove the given tags from the list of endpoint tags.</li><li>list—Display the available list of endpoint tags.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Tags should be passed as one string, separated by commas, and with no spaces.</p></div><p>Example:</p><ul><li><code>cytool endpoint_tags add "tag1[,tage2,...,tagN]"</code></li><li><code>cytool endpoint_tags remove "tag1[,tage2,...,tagN]"</code></li><li><code>cytool endpoint_tags list "tag1[,tage2,...,tagN]"</code></li></ul></td></tr><tr><td>enum</td><td><p>Enumerate protected processes.</p><p>Usage: <code>cytool enum</code></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you change the action mode for protected processes in the Exploit Security Profile in Cortex XDR, you must restart the protected processes for the security policy to be enforced on the processes and its forked processes, and only then you will see them on this list.</p></div></td></tr><tr><td>event_collection</td><td><p>Perform event collection (EDR/DSE) operations.</p><p>Usage: <code>cytool event_collection &#x3C;operation></code></p><p>Where &#x3C;operation> can be:</p><ul><li>query—Displays the current event collection status.</li><li>enable—Start or stop event collection as set by policy.</li><li>disable—Forcibly stops event collection.</li><li>logstat—Writes internal statistics to the log file.</li></ul></td></tr><tr><td>image</td><td><p>Display information about a PE file (executable or DLL).</p><p>Usage: <code>cytool image &#x3C;filename></code></p><p>For example:</p><p><code>C:\Program Files\Palo Alto Networks\Traps> cytool image json.dll Image Information Location: json.dll Size: 176.98 KB (181224 bytes) File SHA256: a46b8e1ad9a808fb09e7b79bd03b66a611d0c7aa71291c216be555af14d16421 Architecture: x86-64 Subsystem: Windows GUI PE Size: 156.00 KB (159744 bytes) PE SHA256: 8cbca46419bf7260c99aaa3c73a6944e97f5c5b053a8b88e9a17367439b08d7d</code></p></td></tr><tr><td>imageprep</td><td><p>Prepare a golden image by submitting files for cloud analysis and generate a threats report.</p><p>Usage: <code>cytool imageprep [scan] [timeout &#x3C;scan timeout>][upload &#x3C;upload timeout>] [path &#x3C;full path>]</code></p><p>where:</p><ul><li>&#x3C;scan timeout>—The number of hours the scan is permitted to run before reporting an error.</li><li>&#x3C;upload timeout>—The number of minutes the agent can take to upload unknown files to Cortex XDR before reporting an error.</li><li>&#x3C;full path>—Path to store the scan report. If no path is specified, Cytool saves the scan report to the local Cytool directory. To save files to this folder, you must first disable service protection using the <code>cytool protect disable</code> command.</li></ul><p>Example:</p><p><code>C:\Program Files\Palo Alto Networks\Traps> cytool imageprep scan timeout 4 upload 60 path c:\report Start Time : 17:56:46 Elapsed Time : 00:04:17 State : Running Scanned Files : 5427 Suspicious Files : 0 Failed Files : 9 Volume Root Path : \\?\C:\ Window Usage : 0 236 20000 Path : ...t\cache2\entries\9B982CE198BF046E6CCF25478920DDFD9E5842E5 Scan completed successfully Complete report can be found at: C:\report\imageprep_2019-03-06_08-59-30.xml</code></p></td></tr><tr><td>import</td><td>Import pre-downloaded content or local support exceptions. Used for solving specific problems with a support representative.</td></tr><tr><td>info</td><td><p>Display general Cortex XDR agent information.</p><p>Usage: <code>cytool info [query]</code></p><ul><li>To display the agent version, run the <code>cytool info</code> command without any additional arguments.</li><li>To display additional details about the agent, such as the version of the default policy and the specific build number, add the query argument.</li></ul></td></tr><tr><td>isolate</td><td><p>Release endpoint from network isolation.</p><p>Usage: <code>cytool isolate stop</code></p></td></tr><tr><td>last_checkin</td><td><p>Display the time of the last successful check-in.</p><p>Usage: <code>cytool last_checkin</code></p></td></tr><tr><td>log</td><td><p>Set log level for the desired process/Generate support file archive.</p><p>Usage: `cytool log set_level &#x3C;log_level> &#x3C;Components</p></td></tr><tr><td>payload_execution</td><td><p>Stop or query payload execution status. Relates to Live Terminal and script execution.</p><p>Usage:</p><ul><li>cytool payload_execution query—Display current payload execution status.</li><li>cytool payload_execution stop—Stop payload execution.</li></ul></td></tr><tr><td>persist</td><td><p>The Cortex XDR agent stores policy and security event information, such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database.</p><p>Usage: <code>cytoolpersist &#x3C;action></code></p><p>Where &#x3C;action> can be:</p><ul><li>list—Lists the local databases on the endpoint.</li><li>export [&#x3C;database name> | &#x3C;databasepath>]—Exports the database table to a file in the <code>C:\Users\&#x3C;user>\Documents\PaloAltoNetworks\Traps\cytool</code> directory.</li><li>import [&#x3C;database name> | &#x3C;databasepath>] &#x3C;file name>—Adds the records in a JSON file to the database.</li><li>print &#x3C;database name> | &#x3C;databasepath> [csv]—Prints the records in the database to a CSV file.</li></ul><p>To view a list of all local databases, use the <code>cytool persist list</code> command.</p></td></tr><tr><td>policy</td><td><p>Query or compare the applied policy for a process.</p><p>Usage: `cytool policy [query</p></td></tr><tr><td>protect</td><td><p>Enable or disable a protection feature.</p><p>Usage: cytool protect <code>&#x3C;Action></code> <code>&#x3C;Feature></code></p><p>where:</p><ul><li><p>&#x3C;Action>—Changes protection for an agent feature. Options are:</p><p><code>enable</code></p><p><code>disable</code></p><p><code>policy</code></p><p><code>query</code>. The query option displays the protection status for each feature.</p></li><li><p><strong><code>&#x3C;Feature></code></strong>—Specifies the feature for which you want to change the protection status. Options are:</p><p><code>Process</code>, for agent core processes</p><p><code>Registry</code>, for agent registry keys</p><p><code>File</code>, for agent files</p><p><code>Service</code>, for agent services</p><p><code>Pipe</code>, for protection of agent pipes.</p></li></ul><p>For example:</p><p>To disable registry protection,</p><p><code>CYTOOL protect disable registry</code></p><p>To enable all protection,</p><p><code>CYTOOL protect enable</code></p><p>To set protection according to policy,</p><p><code>CYTOOL protect policy</code></p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Any protection state change made by Cytool persists until the next reboot and is set according to the policy one hour after reboot.</p></div></td></tr><tr><td>proxy</td><td><p>Set or query cloud-defined proxies for the agent.</p><p>Usage:</p><ul><li><code>cytool proxy query</code>—Display the current status of cloud-defined proxy settings.</li><li><p><code>cytool proxy set &#x3C;list></code>—Set cloud-defined proxy settings to the proxies defined in &#x3C;list>.</p><p>For example: <code>cytool proxy set "192.168.50.1:8080,192.168.60.2:808"</code></p></li><li><code>cytool proxy set ""</code>—Disable cloud-defined proxy.</li></ul></td></tr><tr><td>quarantine</td><td><p>View and restore quarantined files.</p><p>Usage:</p><ul><li><code>cytool quarantine list</code>—List all quarantined files.</li><li><code>cytool restore &#x3C;ID> [&#x3C;path>]</code>—Restore files to their original location or to a path, if specified, by specifying the file ID.</li></ul></td></tr><tr><td>queryall</td><td>The cytool queryall command displays a list of imported certificates, for troubleshooting purposes.</td></tr><tr><td>reconnect</td><td><p>Try reconnecting to the server if communication has been disabled, or force registration with a new <code>distribution_id</code>.</p><p>Usage:</p><ul><li><code>cytool reconnect</code>—Reconnects the Cortex XDR agent to the management application on the server.</li><li><code>cytool reconnect [force &#x3C;distribution_id]></code></li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The <code>distribution_id</code> must belong to an installation package for the same operating system, and for the same or an earlier agent version than the one currently installed.</p></div></td></tr><tr><td>runtime</td><td><p>Stop or start product components.</p><p>Usage: <code>cytool runtime &#x3C;Action> &#x3C;Component></code></p><p>where:</p><ul><li><p>&#x3C;Action>—Changes startup runtime action for an agent component.</p><p>Options are: <code>start</code>, <code>stop</code>, and <code>query</code>. The query option displays the startup status for each component.</p></li><li><p>&#x3C;Component>—Specifies the component for which you want to change the runtime action, or you can specify all components by not including any in this command.</p><p>To change the runtime action for a subset of components, list them with spaces separating each component.</p><p>Options are: <code>cyverak</code>, <code>cyvrmtgn</code>, <code>cyvrfsfd</code>, and <code>cyserver</code>.</p></li></ul><p>For example:</p><p><code>C:\Program Files\Palo Alto Networks\Traps>cytool runtime stop cyserver cyverak Enter supervisor password: Service State cyverak Stopped cyvrmtgn Running cyvrfsfd Running cyserver Stopped</code></p></td></tr><tr><td>scan</td><td><p>Scan operations.</p><p>Usage: <code>cytool scan &#x3C;Action></code></p><p>Where &#x3C;action>:</p><ul><li><code>start</code>—Scans the endpoint for malware.</li><li><code>stop</code>—Stops a scan.</li><li><code>query</code>—Displays the progress if a system scan is active.</li><li><code>last_scan_time</code>—Displays the last time a scan was done.</li></ul><p>Example:</p><p><code>C:\Program Files\Palo Alto Networks\Traps> cytool scan start Enter supervisor password: The operation completed successfully. C:\Program Files\Palo Alto Networks\Traps> cytool scan query Enter supervisor password: Start Time : 9:09:0648 Elapsed Time : 00:00:51 State : Running Scanned Files : 3944 Suspicious Files : 0 Failed Files : 1\?\C:\ Volume Root Path : \\?\C:\ 8 20000 Window Usage : 0 14 20000 Path : ...</code></p></td></tr></tbody></table>

▸ Uninstall the Cortex XDR agent for Windows modified +2 −2 Markup only: Start, Control Panel, Programs and All Programs in the uninstall steps are now bold. agent/cortex-xdr-agent-for-windows/uninstall-the-cortex-xdr-agent-for-windows

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -12,33 +12,33 @@ After you uninstall the agent, the endpoint is no longer protected by the Securi

How to manually uninstall Cortex XDR agent for Windows

Use the following workflow to manually uninstall the Cortex XDR agent. If you intend to use Cytool in Step 1, make sure that you know the uninstall password before performing this procedure.

1. Use one of the following methods to disable the Cortex XDR agent security protection on the endpoint:

• Run the Cytool protect disable command.

• Apply an Agent Settings profile that disables XDR Agent Tampering Protection on the endpoint.

2. Select Start → Control Panel → (Programs) → Programs and Features.

2. Select Start → Control Panel → (Programs) → Programs and Features.

3. Select Cortex XDR from the list and then Uninstall.

4. When prompted to continue uninstalling, click Yes and acknowledge any notifications.

</details>

How to uninstall Cortex XDR agent for Windows using Msiexec

Use the following workflow to uninstall the Cortex XDR agent using Msiexec. If you intend to use Cytool in Step 1, ensure that you know the uninstall password before performing this procedure.

1. If you are uninstalling XDR Agent using the MSI file via SCCM or another software management system, use one of the following methods to disable the Cortex XDR agent security protection on the endpoint:

• Run the Cytool protect disable command.

• Apply an Agent Settings profile that disables XDR Agent Tampering Protection on the endpoint.

2. Use one of the following options to open a command prompt as an administrator:

• Select Start → All Programs → Accessories. Then right-click Command prompt and Run as administrator.

• Select Start → All Programs → Accessories. Then right-click Command prompt and Run as administrator.

• Select Start. In the Start Search box, type cmd. Then, to open the command prompt as an administrator, press CTRL+ SHIFT+ ENTER.

3. Run the msiexec command followed by one or more of the following options or properties:

• Uninstall and logging options:

• /x<installpath>\<installerfilename>.msi—Uninstall a package.

• /l*v <logpath>\<logfilename>.txt—Log verbose output to a file.

Show markdown source

@@ -12,33 +12,33 @@ After you uninstall the agent, the endpoint is no longer protected by the Securi
 
 <summary>How to manually uninstall Cortex XDR agent for Windows</summary>
 
 Use the following workflow to manually uninstall the Cortex XDR agent. If you intend to use Cytool in Step 1, make sure that you know the uninstall password before performing this procedure.
 
 1. Use one of the following methods to disable the Cortex XDR agent security protection on the endpoint:
    * Run the **`Cytool protect disable`** command.
    * Apply an Agent Settings profile that disables XDR **Agent Tampering Protection** on the endpoint.
-2. Select Start → Control Panel → (Programs) → **Programs and Features**.
+2. Select **Start** → **Control Panel** → (**Programs**) → **Programs and Features**.
 3. Select **Cortex XDR** from the list and then **Uninstall**.
 4. When prompted to continue uninstalling, click **Yes** and acknowledge any notifications.
 
 </details>
 
 <details>
 
 <summary>How to uninstall Cortex XDR agent for Windows using Msiexec</summary>
 
 Use the following workflow to uninstall the Cortex XDR agent using Msiexec. If you intend to use Cytool in Step 1, ensure that you know the uninstall password before performing this procedure.
 
 1. If you are uninstalling XDR Agent using the MSI file via SCCM or another software management system, use one of the following methods to disable the Cortex XDR agent security protection on the endpoint:
    * Run the **`Cytool protect disable`** command.
    * Apply an Agent Settings profile that disables XDR **Agent Tampering Protection** on the endpoint.
 2. Use one of the following options to open a command prompt as an administrator:
-   * Select Start → All Programs → **Accessories**. Then right-click **Command prompt** and **Run as administrator**.
+   * Select **Start** → **All** **Programs** → **Accessories**. Then right-click **Command prompt** and **Run as administrator**.
    * Select **Start**. In the **Start Search** box, type **cmd**. Then, to open the command prompt as an administrator, press **CTRL**+ **SHIFT**+ **ENTER**.
 3.  Run the **`msiexec`** command followed by one or more of the following options or properties:
 
     *   Uninstall and logging options:
 
         * **`/x<installpath>\<installerfilename>.msi`**—Uninstall a package.
         * **`/l*v <logpath>\<logfilename>.txt`**—Log verbose output to a file.

▸ Introduction modified +2 −2 Both the Compatibility Matrix and Agent Releases references were repointed from docs-cortex.paloaltonetworks.com to app.gitbook.com spaces. agent/introduction

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -5,11 +5,11 @@ description: Learn about the Cortex XDR Agent installation procedures.

# Introduction

Cortex XDR agent is installed on all endpoints in your organization. It works in conjunction with your Cortex platform to monitor and protect these endpoints from a wide range of security threats. The agent collects and sends endpoint telemetry data to the Cortex server, where it is analyzed for suspicious activities, indicators of compromise, and potential security incidents. The Cortex XDR agent plays a crucial role in providing real-time visibility into endpoint activity, detecting and blocking malware, analyzing endpoint behavior for signs of compromise, and facilitating response actions. It helps security teams identify and respond to threats effectively, minimizing the risk of data breaches and unauthorized access. The Cortex XDR agent communicates with the server at a 5-minute heartbeat interval to send status information and retrieve the latest security policy.

This guide explains the installation and configuration procedures for Cortex XDR agent setup and operation on, Windows, MacOS, and Linux operating systems. Additional guides are available for agent installation and operation on Android and iOS devices.

For compatibility with operating systems per agent release versions see the Cortex XDR Compatibility Matrix.

With every Cortex product release, new agent features are released with specific agent versions. For feature support, known and addressed issues, and changes to default behavior by Cortex XDR agent version, see the Cortex XDR Agent Releases.

Show markdown source

@@ -5,11 +5,11 @@ description: Learn about the Cortex XDR Agent installation procedures.
 # Introduction
 
 
 
 Cortex XDR agent is installed on all endpoints in your organization. It works in conjunction with your Cortex platform to monitor and protect these endpoints from a wide range of security threats. The agent collects and sends endpoint telemetry data to the Cortex server, where it is analyzed for suspicious activities, indicators of compromise, and potential security incidents. The Cortex XDR agent plays a crucial role in providing real-time visibility into endpoint activity, detecting and blocking malware, analyzing endpoint behavior for signs of compromise, and facilitating response actions. It helps security teams identify and respond to threats effectively, minimizing the risk of data breaches and unauthorized access. The Cortex XDR agent communicates with the server at a 5-minute heartbeat interval to send status information and retrieve the latest security policy.
 
 This guide explains the installation and configuration procedures for Cortex XDR agent setup and operation on, Windows, MacOS, and Linux operating systems. Additional guides are available for agent installation and operation on Android and iOS devices.
 
-For compatibility with operating systems per agent release versions see the [Cortex XDR Compatibility Matrix](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Compatibility-Matrix/Where-can-I-install-the-Cortex-XDR-agent).
+For compatibility with operating systems per agent release versions see the [Cortex XDR Compatibility Matrix](https://app.gitbook.com/s/fZ8QSMnkjnXpuOeuRcam/).
 
-With every Cortex product release, new agent features are released with specific agent versions. For feature support, known and addressed issues, and changes to default behavior by Cortex XDR agent version, see the [Cortex XDR Agent Releases](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Agent-Releases/Cortex-XDR-Agent-Releases).
+With every Cortex product release, new agent features are released with specific agent versions. For feature support, known and addressed issues, and changes to default behavior by Cortex XDR agent version, see the [Cortex XDR Agent Releases](https://app.gitbook.com/s/RwAoI4lZv8Q7OzaOg2cK/cortex-xdr-agent-releases/readme).

▸ Cortex Cloud Application Security modified +25 −8 Retitled from Cloud Application Security and rewritten into use cases plus base-licence and add-on requirements per module component. xsiam/cloud-security/cortex-cloud-application-security

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,15 +1,32 @@

# Cloud Application Security

# Cortex Cloud Application Security

Cloud Application Security helps you secure applications and software supply chains across the full software development lifecycle.

It connects repositories, pipelines, registries, and third-party tools to discover assets, detect risks, and consolidate findings in one place.

The Cortex Cloud Application Security module provides comprehensive security for your applications throughout their entire lifecycle. It offers unified visibility and control over your application's security from development through to deployment.

By combining native scanning, ingested findings, policy enforcement, and application context, it helps teams prioritize the issues that matter most and remediate them earlier.

## Use cases

### What it covers

• Application Security Posture Management (ASPM): Provides a consolidated view of application risks and vulnerabilities across your environment, enabling you to understand and manage your overall security posture. For more information refer to Application Security Posture Management (ASPM)

• Supply Chain Security: Focuses on securing your continuous integration and continuous delivery pipelines, ensuring the integrity and security of your automated build and deployment processes. For more information refer to Software supply chain security

• Code Security: Identifies and helps mitigate security issues directly within your source code, including exposed secrets, vulnerabilities in Infrastructure-as-Code (IaC) and open-source components, license miscompliance and package operational risk. from the earliest stages of development. For more information refer to Code Security

• Code and dependencies: Detect vulnerabilities, exposed secrets, and insecure infrastructure definitions before deployment

## License requirements

• Pipelines and supply chain: Monitor CI/CD systems, package registries, and supporting tools that impact software integrity

• Application context: Correlate findings across the SDLC so teams can focus on the highest-risk issues first

To enable and utilize the components of the Application Security module, an active base license is required.

While some features are included by default, others require a dedicated add-on purchase.

## Base licenses

You must have at least one of the following active base licenses to access the Application Security module:

• Cloud Posture Security or Cloud Runtime Security

• XSIAM Premium

### Module components

• Application Security Posture Management (ASPM): Included with base license

• Supply Chain Security: Included with base license

• Code security: Requires a separate Application Security Add-on purchase in addition to your existing Cloud (Posture or Runtime) or XSIAM Premium base license

For more information, see Cortex Cloud Application Security

Show markdown source

@@ -1,15 +1,32 @@
-# Cloud Application Security
+# Cortex Cloud Application Security
 
-Cloud Application Security helps you secure applications and software supply chains across the full software development lifecycle.
+&#x20;
 
-It connects repositories, pipelines, registries, and third-party tools to discover assets, detect risks, and consolidate findings in one place.
+The Cortex Cloud Application Security module provides comprehensive security for your applications throughout their entire lifecycle. It offers unified visibility and control over your application's security from development through to deployment.
 
-By combining native scanning, ingested findings, policy enforcement, and application context, it helps teams prioritize the issues that matter most and remediate them earlier.
+## Use cases
 
-### What it covers
+* **Application Security Posture Management (ASPM)**: Provides a consolidated view of application risks and vulnerabilities across your environment, enabling you to understand and manage your overall security posture. For more information refer to [Application Security Posture Management (ASPM)](https://app.gitbook.com/s/8Z0RLJ1BFF5TQL8VtUeK/application-security-posture-management-aspm/application-security-posture-management-aspm)
+* **Supply Chain Security**: Focuses on securing your continuous integration and continuous delivery pipelines, ensuring the integrity and security of your automated build and deployment processes. For more information refer to [Software supply chain security](https://app.gitbook.com/s/8Z0RLJ1BFF5TQL8VtUeK/software-supply-chain-security/software-supply-chain-security)
+* **Code Security**: Identifies and helps mitigate security issues directly within your source code, including exposed secrets, vulnerabilities in Infrastructure-as-Code (IaC) and open-source components, license miscompliance and package operational risk. from the earliest stages of development. For more information refer to [Code Security](https://app.gitbook.com/s/8Z0RLJ1BFF5TQL8VtUeK/code-security/code-security-scanners)
 
-* **Code and dependencies:** Detect vulnerabilities, exposed secrets, and insecure infrastructure definitions before deployment
-* **Pipelines and supply chain:** Monitor CI/CD systems, package registries, and supporting tools that impact software integrity
-* **Application context:** Correlate findings across the SDLC so teams can focus on the highest-risk issues first
+## License requirements
+
+To enable and utilize the components of the Application Security module, an active base license is required.
+
+While some features are included by default, others require a dedicated add-on purchase.
+
+## Base licenses
+
+You must have at least one of the following active base licenses to access the Application Security module:
+
+* Cloud Posture Security or Cloud Runtime Security
+* XSIAM Premium
+
+### Module components
+
+* Application Security Posture Management (ASPM): Included with base license
+* Supply Chain Security: Included with base license
+* Code security: Requires a separate **Application Security Add-on** purchase in addition to your existing Cloud (Posture or Runtime) or XSIAM Premium base license
 
 For more information, see [Cortex Cloud Application Security](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/8Z0RLJ1BFF5TQL8VtUeK/)

▸ SaaS Security Overview modified +1 −1 The first SaaS pillar is spelled out as SaaS Security Posture Management instead of the SSPM (Posture) abbreviation. xsiam/cloud-security/cortex-cloud-saas-security/saas-security-overview

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -2,17 +2,17 @@

description: >-

This dashboard aggregates and presents security data from all four core SaaS

Security pillars including: SSPM (Posture), SaaS Identity Security, SaaS Data

Security, and SaaS Agent Security.

---

# SaaS Security Overview

The SaaS Overview dashboard provides unified visibility into your multi-SaaS security posture to streamline daily operations. The dashboard seamlessly aggregates and presents security data from all four core SaaS Security pillars including: SSPM (Posture), SaaS Identity Security, SaaS Data Security, and SaaS Agent Security. Leverage this view to:

The SaaS Overview dashboard provides unified visibility into your multi-SaaS security posture to streamline daily operations. The dashboard seamlessly aggregates and presents security data from all four core SaaS Security pillars including: SaaS Security Posture Management, SaaS Identity Security, SaaS Data Security, and SaaS Agent Security. Leverage this view to:

• Triage Threats: Detect and investigate active security events in real time.

• Manage Posture: Surface and prioritize misconfigurations across connected applications and assets.

• Provide Executive Reporting: Track aggregate risk scores and compliance trends for stakeholder updates.

Review the descriptions below for a detailed breakdown of interactive widgets:

Show markdown source

@@ -2,17 +2,17 @@
 description: >-
   This dashboard aggregates and presents security data from all four core SaaS
   Security pillars including: SSPM (Posture), SaaS Identity Security, SaaS Data
   Security, and SaaS Agent Security.
 ---
 
 # SaaS Security Overview
 
-The SaaS Overview dashboard provides unified visibility into your multi-SaaS security posture to streamline daily operations. The dashboard seamlessly aggregates and presents security data from all four core SaaS Security pillars including: SSPM (Posture), SaaS Identity Security, SaaS Data Security, and SaaS Agent Security. Leverage this view to:
+The SaaS Overview dashboard provides unified visibility into your multi-SaaS security posture to streamline daily operations. The dashboard seamlessly aggregates and presents security data from all four core SaaS Security pillars including: SaaS Security Posture Management, SaaS Identity Security, SaaS Data Security, and SaaS Agent Security. Leverage this view to:
 
 * Triage Threats: Detect and investigate active security events in real time.
 * Manage Posture: Surface and prioritize misconfigurations across connected applications and assets.
 * Provide Executive Reporting: Track aggregate risk scores and compliance trends for stakeholder updates.
 
 <img src="https://2786854933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAEIjuYE3RXcIfmuQnBbm%2Fuploads%2FtsDAHRj1KQ8JtZHhcrcZ%2Funknown.png?alt=media&#x26;token=8098a3df-78d9-48c2-81e0-96229cf30af2" alt="" height="349" width="624">
 
 Review the descriptions below for a detailed breakdown of interactive widgets:

▸ Task 1: Meet the prerequisites for Azure BYOA outposts modified +1 −1 The BYOA security note is reworded as a least-privilege model rather than a claim of zero tenant-level Microsoft Graph permissions.

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-1-meet-the-prerequisites-for-azure-byoa-outposts

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -59,16 +59,16 @@ The following permissions are persistent and must remain in place for the life o

Role / permission│Scope│Why needed

| --------------------------------------------------------------------- | ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |

| --------------------------------------------------------------------- | ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |

Owner of the BYO App Registration│Object-scoped (one AppReg only)│Add and/or remove federated identity credentials (FICs). Granted automatically by the setup script via --tf-runner-object-id <GUID>.

Contributor (or Owner, which also includes User Access Administrator)│Azure subscription│Provision outpost infrastructure: UAMIs, storage, networking, scanner VMs

User Access Administrator (or Owner, which also includes Contributor)│Azure subscription│Create role assignments between UAMIs and scanned resources

hint info

Security note: BYOA grants the Terraform runner zero tenant-level Microsoft Graph permissions. The runner's ability to write federated identity credentials comes entirely from being an owner of one specific app registration. Object-scoped Application.ReadWrite.OwnedBy is implicit via ownership, so no admin consent at tenant scope is required. This is a significant reduction compared to standard outposts, which require Application.ReadWrite.All at tenant scope.

Note: BYOA mode leverages a least-privilege security model by eliminating the need for tenant-level Microsoft Graph permissions. The Terraform runner service principal modifies the app registration and writes federated identity credentials strictly through direct object ownership. This ownership-based approach ensures secure resource isolation, keeping the app registration strictly scoped to its own environment so it does not read or enumerate other tenant applications. By relying on ownership rather than directory permissions, BYOA bypasses the need for tenant-level admin consent (such as Application.ReadWrite.OwnedBy), offering a highly secure alternative to the Application.ReadWrite.All permission used by standard outposts.

endhint

## What's next?

If you encounter issues, review the outpost troubleshooting topic.

Proceed to Task 2: Create the app registration for the Azure BYOA outpost.

Show markdown source

@@ -59,16 +59,16 @@ The following permissions are persistent and must remain in place for the life o
 
 | Role / permission                                                     | Scope                           | Why needed                                                                                                                             |
 | --------------------------------------------------------------------- | ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
 | Owner of the BYO App Registration                                     | Object-scoped (one AppReg only) | Add and/or remove federated identity credentials (FICs). Granted automatically by the setup script via `--tf-runner-object-id <GUID>`. |
 | Contributor (or Owner, which also includes User Access Administrator) | Azure subscription              | Provision outpost infrastructure: UAMIs, storage, networking, scanner VMs                                                              |
 | User Access Administrator (or Owner, which also includes Contributor) | Azure subscription              | Create role assignments between UAMIs and scanned resources                                                                            |
 
 {% hint style="info" %}
-**Security note**: BYOA grants the Terraform runner zero tenant-level Microsoft Graph permissions. The runner's ability to write federated identity credentials comes entirely from being an owner of one specific app registration. Object-scoped `Application.ReadWrite.OwnedBy` is implicit via ownership, so no admin consent at tenant scope is required. This is a significant reduction compared to standard outposts, which require `Application.ReadWrite.All` at tenant scope.
+**Note**: BYOA mode leverages a least-privilege security model by eliminating the need for tenant-level Microsoft Graph permissions. The Terraform runner service principal modifies the app registration and writes federated identity credentials strictly through direct object ownership. This ownership-based approach ensures secure resource isolation, keeping the app registration strictly scoped to its own environment so it does not read or enumerate other tenant applications. By relying on ownership rather than directory permissions, BYOA bypasses the need for tenant-level admin consent (such as `Application.ReadWrite.OwnedBy`), offering a highly secure alternative to the `Application.ReadWrite.All` permission used by standard outposts.
 {% endhint %}
 
 ## What's next?
 
 If you encounter issues, review the [outpost troubleshooting topic](../../outpost-troubleshooting#bring-your-own-app-byoa-troubleshooting---azure).
 
 Proceed to [Task 2: Create the app registration for the Azure BYOA outpost](task-2-create-the-app-registration-for-the-azure-byoa-outpost).

▸ Cortex Attack Surface Management modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/cortex-attack-surface-management

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cortex Attack Surface Management

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM license.

Pull assets and other Attack Surface Management (ASM) information from Cortex Xpanse Expander and the ASM module for Cortex XSIAM. These External Attack Surface Management solutions deliver comprehensive attack surface visibility by combining ML-enhanced asset attribution with continuous attack surface assessment, prioritizing discovered risks using contextual and exploitability data.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cortex Attack Surface Management
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM license.
 
 Pull assets and other Attack Surface Management (ASM) information from Cortex Xpanse Expander and the ASM module for Cortex XSIAM. These External Attack Surface Management solutions deliver comprehensive attack surface visibility by combining ML-enhanced asset attribution with continuous attack surface assessment, prioritizing discovered risks using contextual and exploitability data.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cortex Automation Developer Tools modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/cortex-automation-developer-tools

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cortex Automation Developer Tools

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Developer and onboarding utilities for the Cortex platform, including sample data generators for creating mock issues, an Identity and Access Management (IAM) template, and the DBot Truth Bombs demo content.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cortex Automation Developer Tools
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Developer and onboarding utilities for the Cortex platform, including sample data generators for creating mock issues, an Identity and Access Management (IAM) template, and the DBot Truth Bombs demo content.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cortex Data Lake modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/cortex-data-lake

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cortex Data Lake

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex AgentiX license.

Palo Alto Networks Strata Logging Service XSIAM Connector provides cloud-based, centralized log storage and aggregation for your on premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cortex Data Lake
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex AgentiX license.
 
 Palo Alto Networks Strata Logging Service XSIAM Connector provides cloud-based, centralized log storage and aggregation for your on premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cortex Internals modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/cortex-internals

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cortex Internals

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.

The Cortex Internals connector provides native locking integrations (Core Lock and Demisto Lock) that prevent concurrent execution of scripts or commands, using a wait-lock-release flow (mutex). Use the lock name argument to support multiple locks in different flows. These are native integrations that do not require configuration.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cortex Internals
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.
 
 The Cortex Internals connector provides native locking integrations (Core Lock and Demisto Lock) that prevent concurrent execution of scripts or commands, using a wait-lock-release flow (mutex). Use the lock name argument to support multiple locks in different flows. These are native integrations that do not require configuration.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cortex XDR modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/cortex-xdr

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cortex XDR

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex AgentiX license.

Cortex XDR is the world's first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks. Sync indicators to and from Cortex XDR, run investigation and response actions, and run XQL queries against your data sources.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cortex XDR
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex AgentiX license.
 
 [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) is the world's first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks. Sync indicators to and from Cortex XDR, run investigation and response actions, and run XQL queries against your data sources.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Enterprise DLP modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/enterprise-dlp

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Enterprise DLP

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.

Palo Alto Networks Enterprise DLP discovers and protects company data across every data channel and repository. Integrated Enterprise DLP enables data protection and compliance everywhere without complexity.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Enterprise DLP
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.
 
 Palo Alto Networks Enterprise DLP discovers and protects company data across every data channel and repository. Integrated Enterprise DLP enables data protection and compliance everywhere without complexity.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ IoT Security modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/iot-security/iot-security

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# IoT Security

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Integrate with the Palo Alto Networks IoT Security Portal (previously Zingbox) to get device details, list devices, list alerts and vulnerabilities, and resolve alerts and vulnerabilities for IoT security response.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # IoT Security
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Integrate with the Palo Alto Networks IoT Security Portal (previously Zingbox) to get device details, list devices, list alerts and vulnerabilities, and resolve alerts and vulnerabilities for IoT security response.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Panorama modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/next-generation-firewall/panorama

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Panorama

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.

PAN-OS is the software that runs all Palo Alto Networks next-generation firewalls. This connector lets you manage Palo Alto Networks Firewall and Panorama, including creating and managing security rules, address objects, URL categories, and URL filtering objects, committing and pushing configurations, and querying PAN-OS logs. You can create separate instances for Firewall and Panorama.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Panorama
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.
 
 PAN-OS is the software that runs all Palo Alto Networks next-generation firewalls. This connector lets you manage Palo Alto Networks Firewall and Panorama, including creating and managing security rules, address objects, URL categories, and URL filtering objects, committing and pushing configurations, and querying PAN-OS logs. You can create separate instances for Firewall and Panorama.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Palo Alto Networks Cortex modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/palo-alto-networks-cortex

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Palo Alto Networks Cortex

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.

Unit 42 Threat Intelligence by Palo Alto Networks delivers high-fidelity threat intelligence curated by the Unit 42 research team and derived from telemetry across the Palo Alto Networks product ecosystem. Use the Unit 42 Feed integration to continuously fetch indicators and threat objects, and the Unit 42 Intelligence integration to enrich indicators (IP, domain, URL, file hash) with verdicts, threat object associations, and relationships.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Palo Alto Networks Cortex
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.
 
 Unit 42 Threat Intelligence by Palo Alto Networks delivers high-fidelity threat intelligence curated by the Unit 42 research team and derived from telemetry across the Palo Alto Networks product ecosystem. Use the Unit 42 Feed integration to continuously fetch indicators and threat objects, and the Unit 42 Intelligence integration to enrich indicators (IP, domain, URL, file hash) with verdicts, threat object associations, and relationships.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ PAN PSIRT Advisories modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/pan-psirt-advisories

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# PAN PSIRT Advisories

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Queries the public repository of PAN-OS CVEs. The Palo Alto Networks Security Advisories API is a representation of the GUI at https://security.paloaltonetworks.com/.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # PAN PSIRT Advisories
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Queries the public repository of PAN-OS CVEs. The Palo Alto Networks Security Advisories API is a representation of the GUI at https://security.paloaltonetworks.com/.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Palo Alto Networks Prisma modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/prisma-access/palo-alto-networks-prisma

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Palo Alto Networks Prisma

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

Integrate with Palo Alto Networks Prisma Access to monitor the status of the service and take actions, and with Prisma SASE (Strata Cloud Manager) to view or make changes to Prisma Access configurations. Also dynamically retrieve the egress IPs that Prisma Access uses to reach the internet and SaaS apps for use as a threat intelligence feed.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• Palo Alto Networks - Prisma SASE: This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.

• Prisma Access: Integrate with Prisma Access to monitor the status of the Service, alert and take actions. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud, or Cortex AgentiX license.

Show markdown source

@@ -1,14 +1,14 @@
 # Palo Alto Networks Prisma
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 Integrate with Palo Alto Networks Prisma Access to monitor the status of the service and take actions, and with Prisma SASE (Strata Cloud Manager) to view or make changes to Prisma Access configurations. Also dynamically retrieve the egress IPs that Prisma Access uses to reach the internet and SaaS apps for use as a threat intelligence feed.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [Palo Alto Networks - Prisma SASE](https://xsoar.pan.dev/docs/reference/integrations/palo-alto-networks---prisma-sase): This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.
 * [Prisma Access](https://xsoar.pan.dev/docs/reference/integrations/prisma-access): Integrate with Prisma Access to monitor the status of the Service, alert and take actions. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud, or Cortex AgentiX license.

▸ Prisma Cloud Compute modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/prisma-cloud-compute

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Prisma Cloud Compute

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Prisma Cloud Compute Edition delivers cloud workload protection (CWPP) for modern enterprises, providing holistic protection across hosts, containers, and serverless deployments in any cloud, throughout the application lifecycle. This integration lets you import Palo Alto Networks - Prisma Cloud Compute alerts into Cortex XSIAM.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Prisma Cloud Compute
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Prisma Cloud Compute Edition delivers cloud workload protection (CWPP) for modern enterprises, providing holistic protection across hosts, containers, and serverless deployments in any cloud, throughout the application lifecycle. This integration lets you import Palo Alto Networks - Prisma Cloud Compute alerts into Cortex XSIAM.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Prisma Cloud CSPM modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/prisma-cloud-cspm

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Prisma Cloud CSPM

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Prisma Cloud secures infrastructure, workloads, and applications across the entire cloud-native technology stack. Use this connector to manage alerts from Microsoft Azure, Google Cloud Platform, and AWS, and to perform CRUD operations on Prisma Cloud user profiles.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Prisma Cloud CSPM
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Prisma Cloud secures infrastructure, workloads, and applications across the entire cloud-native technology stack. Use this connector to manage alerts from Microsoft Azure, Google Cloud Platform, and AWS, and to perform CRUD operations on Prisma Cloud user profiles.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ SaaS Security (Aperture) modified +2 −2 Representative of the day's 296-page fix: the Marketplace reference in the onboarding-date notice is now a link. xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/saas-security-aperture

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,16 +1,16 @@

# SaaS Security (Aperture)

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

SaaS Security is an integrated CASB (Cloud Access Security Broker) solution that scans and analyzes your assets, applies Security policy to identify exposures, external collaborators, risky user behavior, and sensitive documents, and helps stop threats to sensitive information, users, and resources. Use this connector to collect events and fetch issues from the SaaS Security platform and to run remediation actions against assets.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• SaaS Security Event Collector: Palo Alto Networks SaaS Security Event Collector integration for XSIAM. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Runtime Security, or Cortex XDR license.

• SaasSecurity: SaaS Security API is a cloud-based service that you can connect directly to your sanctioned SaaS applications using the cloud app's API to provide data classification, sharing and permission visibility, and threat detection. This Content Pack provides insights into risks posed by data exposure and policy violations and enables you to use Cortex XSOAR to effectively manage the incidents discovered by SaaS Security API. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.

• SaasSecurity: SaaS Security API is a cloud-based service that you can connect directly to your sanctioned SaaS applications using the cloud app's API to provide data classification, sharing and permission visibility, and threat detection. This Content Pack provides insights into risks posed by data exposure and policy violations and enables you to use Cortex XSIAM to effectively manage the incidents discovered by SaaS Security API. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.

To configure this connector, follow the steps outlined in the configuration wizard.

Show markdown source

@@ -1,16 +1,16 @@
 # SaaS Security (Aperture)
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../marketplace).
 {% endhint %}
 
 SaaS Security is an integrated CASB (Cloud Access Security Broker) solution that scans and analyzes your assets, applies Security policy to identify exposures, external collaborators, risky user behavior, and sensitive documents, and helps stop threats to sensitive information, users, and resources. Use this connector to collect events and fetch issues from the SaaS Security platform and to run remediation actions against assets.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [SaaS Security Event Collector](https://xsoar.pan.dev/docs/reference/integrations/saas-security-event-collector): Palo Alto Networks SaaS Security Event Collector integration for XSIAM. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Runtime Security, or Cortex XDR license.
-* [SaasSecurity](https://xsoar.pan.dev/docs/reference/integrations/saas-security): SaaS Security API is a cloud-based service that you can connect directly to your sanctioned SaaS applications using the cloud app's API to provide data classification, sharing and permission visibility, and threat detection. This Content Pack provides insights into risks posed by data exposure and policy violations and enables you to use Cortex XSOAR to effectively manage the incidents discovered by SaaS Security API. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.
+* [SaasSecurity](https://xsoar.pan.dev/docs/reference/integrations/saas-security): SaaS Security API is a cloud-based service that you can connect directly to your sanctioned SaaS applications using the cloud app's API to provide data classification, sharing and permission visibility, and threat detection. This Content Pack provides insights into risks posed by data exposure and policy violations and enables you to use Cortex XSIAM to effectively manage the incidents discovered by SaaS Security API. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.
 
 To configure this connector, follow the steps outlined in the configuration wizard.

▸ Threat Vault modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/threat-vault

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Threat Vault

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Use the Palo Alto Networks Threat Vault to research the latest threats (vulnerabilities/exploits, viruses, and spyware) that Palo Alto Networks next-generation firewalls can detect and prevent. The Threat Vault API provides customers with an active Advanced Threat Prevention or Threat Prevention subscription with access to threat signature metadata and other information only available in Threat Vault, and can fetch predefined EDL (External Dynamic List) lists.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Threat Vault
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Use the Palo Alto Networks Threat Vault to research the latest threats (vulnerabilities/exploits, viruses, and spyware) that Palo Alto Networks next-generation firewalls can detect and prevent. The Threat Vault API provides customers with an active Advanced Threat Prevention or Threat Prevention subscription with access to threat signature metadata and other information only available in Threat Vault, and can fetch predefined EDL (External Dynamic List) lists.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ WildFire Cloud modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/wildfire-cloud

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# WildFire Cloud

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.

Use the Palo Alto Networks WildFire integration to automatically identify unknown threats and stop attackers in their tracks by performing malware dynamic analysis. Submit files, hosted files, and webpages for detonation, and retrieve reports and verdicts for enrichment.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # WildFire Cloud
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.
 
 Use the Palo Alto Networks WildFire integration to automatically identify unknown threats and stop attackers in their tracks by performing malware dynamic analysis. Submit files, hosted files, and webpages for detonation, and retrieve reports and verdicts for enrichment.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ 1Password modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/1password/1password

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# 1Password

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM license.

1Password is a password manager used for storing and managing your account credentials, financial information, documents, and other sensitive data. This connector fetches events about actions performed by 1Password users within a specific account, access and modifications to items in shared vaults, and user sign-in attempts.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # 1Password
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM license.
 
 1Password is a password manager used for storing and managing your account credentials, financial information, documents, and other sensitive data. This connector fetches events about actions performed by 1Password users within a specific account, access and modifications to items in shared vaults, and user sign-in attempts.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Abnormal Security modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/abnormal-security/abnormal-security

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Abnormal Security

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM license.

Abnormal Security provides comprehensive defense against the entire landscape of messaging threats, ranging from high-sophistication Vendor Email Compromise (VEC) and targeted spear-phishing to lower-priority graymail and unsolicited spam. Threat data is ingested via the Abnormal Security REST API, enabling continuous visibility into detected threats, remediation status, and attack metadata.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Abnormal Security
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM license.
 
 Abnormal Security provides comprehensive defense against the entire landscape of messaging threats, ranging from high-sophistication Vendor Email Compromise (VEC) and targeted spear-phishing to lower-priority graymail and unsolicited spam. Threat data is ingested via the Abnormal Security REST API, enabling continuous visibility into detected threats, remediation status, and attack metadata.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Absolute modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/absolute/absolute

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Absolute

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Absolute is an adaptive endpoint security solution that delivers device security, data security, and asset management of endpoints. Manage and secure your data, devices, and applications with an unbreakable connection to every endpoint, so your sensitive data remains protected even when accessed from outside your network.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Absolute
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Absolute is an adaptive endpoint security solution that delivers device security, data security, and asset management of endpoints. Manage and secure your data, devices, and applications with an unbreakable connection to every endpoint, so your sensitive data remains protected even when accessed from outside your network.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ abuse.ch modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/abuse.ch/abuse.ch

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# abuse.ch

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

abuse.ch is a set of community threat intelligence projects. Fetch and enrich indicators of compromise from URLhaus (malicious URLs used for malware distribution), Feodo Tracker (botnet C\&C IP blocklists), MalwareBazaar (malware samples and file-hash intel), ThreatFox (IOCs associated with malware), and the SSL Blacklist (malicious SSL certificates and associated IP addresses).

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # abuse.ch
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 abuse.ch is a set of community threat intelligence projects. Fetch and enrich indicators of compromise from URLhaus (malicious URLs used for malware distribution), Feodo Tracker (botnet C\&C IP blocklists), MalwareBazaar (malware samples and file-hash intel), ThreatFox (IOCs associated with malware), and the SSL Blacklist (malicious SSL certificates and associated IP addresses).
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ AbuseIPDB modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/abuseipdb/abuseipdb

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# AbuseIPDB

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.

Use the AbuseIPDB integration to report and identify IP addresses that have been associated with malicious activity online. Check, report, and get block lists of the top malicious IPs.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # AbuseIPDB
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.
 
 Use the AbuseIPDB integration to report and identify IP addresses that have been associated with malicious activity online. Check, report, and get block lists of the top malicious IPs.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Accenture modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/accenture/accenture

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Accenture

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Use the Symantec Managed Security Services (Symantec MSS) integration to create issues from Symantec MSS alerts.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Accenture
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Use the Symantec Managed Security Services (Symantec MSS) integration to create issues from Symantec MSS alerts.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ AdminByRequest modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/adminbyrequest/adminbyrequest

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# AdminByRequest

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

AdminByRequest is a Privileged Access Management (PAM) solution that enables secure, temporary elevation to local admin rights.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # AdminByRequest
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 AdminByRequest is a Privileged Access Management (PAM) solution that enables secure, temporary elevation to local admin rights.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Aha modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/aha/aha-1

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Aha

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Aha! provides products for organizations to set strategy, ideate, plan, showcase, build, and launch new products and enhancements.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Aha
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Aha! provides products for organizations to set strategy, ideate, plan, showcase, build, and launch new products and enhancements.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ AIOps modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/aiops/aiops

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# AIOps

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.

The Palo Alto Networks Best Practice Assessment (BPA) measures your usage of Next-Generation Firewall (NGFW) and Panorama security management capabilities across your deployment, enabling you to make adjustments that maximize your return on investment and strengthen security. This connector enables you to programmatically generate BPA data for both the free and premium instances of AIOps for NGFW.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # AIOps
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.
 
 The Palo Alto Networks Best Practice Assessment (BPA) measures your usage of Next-Generation Firewall (NGFW) and Panorama security management capabilities across your deployment, enabling you to make adjustments that maximize your return on investment and strengthen security. This connector enables you to programmatically generate BPA data for both the free and premium instances of AIOps for NGFW.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Akamai modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/akamai/akamai

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Akamai

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Integrate with Akamai Technologies products. Akamai's security solutions provide protection for your websites, applications, APIs, and users. Manage network lists for Akamai security products such as Kona Site Defender, Web App Protector, and Bot Manager; collect security events from the Akamai Web Application Firewall (WAF); and use Akamai GuardiCore for micro-segmentation and Zero Trust protection across hybrid cloud and data center infrastructure.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Akamai
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Integrate with Akamai Technologies products. Akamai's security solutions provide protection for your websites, applications, APIs, and users. Manage network lists for Akamai security products such as Kona Site Defender, Web App Protector, and Bot Manager; collect security events from the Akamai Web Application Firewall (WAF); and use Akamai GuardiCore for micro-segmentation and Zero Trust protection across hybrid cloud and data center infrastructure.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ AlgoSec modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/algosec/algosec

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# AlgoSec

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

AlgoSec AppViz, Firewall Analyzer (AFA), and FireFlow (AFF).

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # AlgoSec
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 AlgoSec AppViz, Firewall Analyzer (AFA), and FireFlow (AFF).
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Alibaba Cloud modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/alibaba-cloud/alibaba-cloud

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Alibaba Cloud

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM license.

Alibaba log event collector integration for XSIAM. This integration was integrated and tested with API version 0.6 of Alicloud Log Service.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Alibaba Cloud
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM license.
 
 Alibaba log event collector integration for XSIAM. This integration was integrated and tested with API version 0.6 of Alicloud Log Service.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ AlienVault modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/alienvault/alienvault

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# AlienVault

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Integrate with AlienVault to fetch threat intelligence indicators, query Indicators of Compromise in AlienVault OTX, and search and monitor alarms and events from AlienVault USM Anywhere. Includes the AlienVault OTX TAXII feed and the open-source AlienVault Reputation Data feed.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # AlienVault
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Integrate with AlienVault to fetch threat intelligence indicators, query Indicators of Compromise in AlienVault OTX, and search and monitor alarms and events from AlienVault USM Anywhere. Includes the AlienVault OTX TAXII feed and the open-source AlienVault Reputation Data feed.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ AWS Automation and Collection modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon/aws-automation-and-collection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# AWS Automation and Collection

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

Integrate with Amazon Web Services (AWS) to automate and orchestrate security operations across AWS services. This connector runs automation and remediation commands, fetches issues, collects logs and events, ingests threat intelligence indicators, and retrieves secrets across services such as EC2, IAM, GuardDuty, Security Hub, S3, Lambda, CloudTrail, CloudWatch Logs, Organizations, WAF, EKS, DynamoDB, and Secrets Manager.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• Amazon DynamoDB: This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

• AWS - AccessAnalyzer: Amazon Web Services IAM Access Analyzer. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Show markdown source

@@ -1,14 +1,14 @@
 # AWS Automation and Collection
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 Integrate with Amazon Web Services (AWS) to automate and orchestrate security operations across AWS services. This connector runs automation and remediation commands, fetches issues, collects logs and events, ingests threat intelligence indicators, and retrieves secrets across services such as EC2, IAM, GuardDuty, Security Hub, S3, Lambda, CloudTrail, CloudWatch Logs, Organizations, WAF, EKS, DynamoDB, and Secrets Manager.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [Amazon DynamoDB](https://xsoar.pan.dev/docs/reference/integrations/amazon-dynamo-db): This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 * [AWS - AccessAnalyzer](https://xsoar.pan.dev/docs/reference/integrations/aws---access-analyzer): Amazon Web Services IAM Access Analyzer. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

▸ Anomali modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/anomali/anomali

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Anomali

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

Integrate with Anomali products. Anomali ThreatStream is a leading threat intelligence platform designed to help organizations collect, analyze, and act on vast amounts of threat data. Use Anomali Match to search indicators and enrich domains, use the ThreatStream Feed to automatically fetch Indicators of Compromise (IOCs) such as IPs, domains, URLs, and file hashes, and use ThreatStream v3 to query and submit threats.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• Anomali Enterprise: Use Anomali Match to search indicators and enrich domains. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

• Anomali ThreatStream Feed: Use the Anomali ThreatStream Feed Integration to fetch indicators from the Anomali ThreatStream. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security with the Application Security Posture Management (ASPM) module, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license with the Attack Surface Management (ASM), Exposure Management, or Threat Intel Management (TIM) add-on.

Show markdown source

@@ -1,14 +1,14 @@
 # Anomali
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 Integrate with Anomali products. Anomali ThreatStream is a leading threat intelligence platform designed to help organizations collect, analyze, and act on vast amounts of threat data. Use Anomali Match to search indicators and enrich domains, use the ThreatStream Feed to automatically fetch Indicators of Compromise (IOCs) such as IPs, domains, URLs, and file hashes, and use ThreatStream v3 to query and submit threats.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [Anomali Enterprise](https://xsoar.pan.dev/docs/reference/integrations/anomali-enterprise): Use Anomali Match to search indicators and enrich domains. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 * [Anomali ThreatStream Feed](https://xsoar.pan.dev/docs/reference/integrations/anomali-threat-stream-feed): Use the Anomali ThreatStream Feed Integration to fetch indicators from the Anomali ThreatStream. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security with the Application Security Posture Management (ASPM) module, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license with the Attack Surface Management (ASM), Exposure Management, or Threat Intel Management (TIM) add-on.

▸ Claude Automation and Collection modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/anthropic/claude-automation-and-collection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Claude Automation and Collection

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Integrate with Anthropic Claude to assist security professionals with investigations, threat hunting, and anomaly detection using Claude's natural language conversational capabilities. Send messages to Claude models and receive AI-generated responses, analyze email headers and bodies for security threats, and generate SOC email templates.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Claude Automation and Collection
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Integrate with Anthropic Claude to assist security professionals with investigations, threat hunting, and anomaly detection using Claude's natural language conversational capabilities. Send messages to Claude models and receive AI-generated responses, analyze email headers and bodies for security threats, and generate SOC email templates.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Apache modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/apache/apache

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Apache

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Integrate with ActiveMQ to send and read messages on queues and topics, and to fetch messages from a queue or topic and create issues in Cortex XSIAM per message.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Apache
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Integrate with ActiveMQ to send and read messages on queues and topics, and to fetch messages from a queue or topic and create issues in Cortex XSIAM per message.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ APIVoid modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/apivoid/apivoid

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# APIVoid

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Provides threat intelligence and security analysis using the APIVoid V2 API. APIVoid wraps up a number of services such as ipvoid and urlvoid.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # APIVoid
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Provides threat intelligence and security analysis using the APIVoid V2 API. APIVoid wraps up a number of services such as ipvoid and urlvoid.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ AppSentinels modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/appsentinels/appsentinels

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# AppSentinels

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM license.

AppSentinels.ai is an application security platform for collecting, analyzing, and managing security events and audit logs to provide comprehensive application protection. It tracks user activities, security events, and administrative operations, enabling organizations to maintain an audit trail for compliance and security monitoring.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # AppSentinels
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM license.
 
 AppSentinels.ai is an application security platform for collecting, analyzing, and managing security events and audit logs to provide comprehensive application protection. It tracks user activities, security events, and administrative operations, enabling organizations to maintain an audit trail for compliance and security monitoring.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ ArcSight modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/arcsight/arcsight

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# ArcSight

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

ArcSight is a security information and event management (SIEM) solution. ArcSight ESM collects and analyzes security log data from across the enterprise to surface signs of compromise, attacks, and other malicious activity, and generates cases for security teams. ArcSight Logger delivers universal log management that unifies searching, reporting, alerting, and analysis across any type of enterprise machine data.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # ArcSight
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 ArcSight is a security information and event management (SIEM) solution. ArcSight ESM collects and analyzes security log data from across the enterprise to surface signs of compromise, attacks, and other malicious activity, and generates cases for security teams. ArcSight Logger delivers universal log management that unifies searching, reporting, alerting, and analysis across any type of enterprise machine data.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Arista Networks modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/arista-networks/arista-networks

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Arista Networks

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Integrate with Arista Networks products. Use the Awake Security integration to manage and respond to network threats.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Arista Networks
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Integrate with Arista Networks products. Use the Awake Security integration to manage and respond to network threats.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Arkime modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/arkime/arkime

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Arkime

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Arkime (formerly Moloch) is a large scale, open source, indexed packet capture and search tool. This integration was integrated and tested with version 3.4.1 (API v3) of Arkime. For older versions, see the Moloch pack (deprecated).

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Arkime
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Arkime (formerly Moloch) is a large scale, open source, indexed packet capture and search tool. This integration was integrated and tested with version 3.4.1 (API v3) of Arkime. For older versions, see the Moloch pack (deprecated).
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Armis modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/armis/armis

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Armis

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM license.

Agentless and passive security platform that sees, identifies, and classifies every device, tracks behavior, identifies threats, and takes action automatically to protect critical information and systems. Collects alerts, devices, and activities from Armis resources.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Armis
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM license.
 
 Agentless and passive security platform that sees, identifies, and classifies every device, tracks behavior, identifies threats, and takes action automatically to protect critical information and systems. Collects alerts, devices, and activities from Armis resources.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Atlassian Automation and Collection modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/atlassian/atlassian-automation-and-collection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Atlassian Automation and Collection

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

Integrate with Atlassian products to automate work and collect data across Jira, Jira Service Management, Confluence, Bitbucket, OpsGenie, and Atlassian IAM. Manage issues, content, spaces, users, alerts, and assets; run automated actions; and collect audit logs and events from Atlassian Cloud and on-prem deployments.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• Atlassian Cloud MCP: Use this integration to connect securely with an Atlassian Cloud Model Context Protocol (MCP) server and access its tools in real time. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.

• Atlassian Confluence Cloud: Atlassian Confluence Cloud allows users to interact with confluence entities like content, space, users, and groups. Users can also manage the space permissions. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Show markdown source

@@ -1,14 +1,14 @@
 # Atlassian Automation and Collection
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 Integrate with Atlassian products to automate work and collect data across Jira, Jira Service Management, Confluence, Bitbucket, OpsGenie, and Atlassian IAM. Manage issues, content, spaces, users, alerts, and assets; run automated actions; and collect audit logs and events from Atlassian Cloud and on-prem deployments.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [Atlassian Cloud MCP](https://xsoar.pan.dev/docs/reference/integrations/atlassian-cloud-mcp): Use this integration to connect securely with an Atlassian Cloud Model Context Protocol (MCP) server and access its tools in real time. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.
 * [Atlassian Confluence Cloud](https://xsoar.pan.dev/docs/reference/integrations/atlassian-confluence-cloud): Atlassian Confluence Cloud allows users to interact with confluence entities like content, space, users, and groups. Users can also manage the space permissions. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

▸ AttackIQ modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/attackiq/attackiq

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# AttackIQ

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Use the AttackIQ integration to simulate a platform that provides validations for security controls, responses, and remediation exercises. Retrieve testing scenarios, execute penetration assessments, and retrieve detailed assessment results.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # AttackIQ
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Use the AttackIQ integration to simulate a platform that provides validations for security controls, responses, and remediation exercises. Retrieve testing scenarios, execute penetration assessments, and retrieve detailed assessment results.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Aurora Endpoint Security modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/aurora-endpoint-security/aurora-endpoint-security

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Aurora Endpoint Security

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

CylancePROTECT is an integrated threat prevention solution that combines the power of artificial intelligence (AI) to block malware infections. Use this connector to manage endpoints, streamline remediation, and respond to threats.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Aurora Endpoint Security
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 CylancePROTECT is an integrated threat prevention solution that combines the power of artificial intelligence (AI) to block malware infections. Use this connector to manage endpoints, streamline remediation, and respond to threats.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ BeyondTrust modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/beyondtrust/beyondtrust

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# BeyondTrust

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

Integrate with BeyondTrust products. BeyondTrust Password Safe provides unified password and session management for accountability and control over privileged accounts. BeyondTrust Privilege Management Cloud (PM Cloud) retrieves audit events and activity logs for endpoint privilege management.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• BeyondTrust Password Safe: Unified password and session management for seamless accountability and control over privileged accounts. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

• BeyondTrust Privilege Management Cloud: BeyondTrust Privilege Management Cloud (PM Cloud) integration for retrieving audit events and activity logs. This sub-capability is available with any active Cortex XSIAM license.

Show markdown source

@@ -1,14 +1,14 @@
 # BeyondTrust
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 Integrate with BeyondTrust products. BeyondTrust Password Safe provides unified password and session management for accountability and control over privileged accounts. BeyondTrust Privilege Management Cloud (PM Cloud) retrieves audit events and activity logs for endpoint privilege management.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [BeyondTrust Password Safe](https://xsoar.pan.dev/docs/reference/integrations/beyond-trust-password-safe): Unified password and session management for seamless accountability and control over privileged accounts. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 * [BeyondTrust Privilege Management Cloud](https://xsoar.pan.dev/docs/reference/integrations/beyond-trust-privilege-management-cloud): BeyondTrust Privilege Management Cloud (PM Cloud) integration for retrieving audit events and activity logs. This sub-capability is available with any active Cortex XSIAM license.

▸ BitSight modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bitsight/bitsight

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# BitSight

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM license.

Bitsight for Security Performance Management (SPM) enables security leaders to use an external view of security performance to measure, monitor, manage, and report on their cybersecurity program performance over time. The Bitsight Security Rating provides a trusted metric that reflects the organization's cybersecurity program performance over time. Take action on Bitsight findings in your security program and leverage issue management workflows to pinpoint and control the sources of infections in your company infrastructure, going from awareness to rapid remediation.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # BitSight
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM license.
 
 Bitsight for Security Performance Management (SPM) enables security leaders to use an external view of security performance to measure, monitor, manage, and report on their cybersecurity program performance over time. The Bitsight Security Rating provides a trusted metric that reflects the organization's cybersecurity program performance over time. Take action on Bitsight findings in your security program and leverage issue management workflows to pinpoint and control the sources of infections in your company infrastructure, going from awareness to rapid remediation.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ bitwarden modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bitwarden/bitwarden

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# bitwarden

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM license.

Bitwarden Password Manager integrates with Cortex to fetch records of events that occur within your Teams or Enterprise organization. Password Manager helps organizations store their passwords and other sensitive data securely in an encrypted vault and can identify compromised passwords.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # bitwarden
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM license.
 
 Bitwarden Password Manager integrates with Cortex to fetch records of events that occur within your Teams or Enterprise organization. Password Manager helps organizations store their passwords and other sensitive data securely in an encrypted vault and can identify compromised passwords.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Blocklist.de modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/blocklist.de/blocklist.de

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Blocklist.de

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Use the Blocklist.de feed integration to fetch indicators from the daily Threat Feed and custom feeds from Blocklist.de. When you configure your servers, you can use this information to reject a connection because of the indicators received from the Blocklist.de feed.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Blocklist.de
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Use the Blocklist.de feed integration to fetch indicators from the daily Threat Feed and custom feeds from Blocklist.de. When you configure your servers, you can use this information to reject a connection because of the indicators received from the Blocklist.de feed.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ BloodHound Enterprise modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bloodhound-enterprise/bloodhound-enterprise

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# BloodHound Enterprise

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM license.

BloodHound Enterprise is a cyber security tool for identifying, analyzing, and mitigating attack paths within Active Directory environments. It maps potential attack paths, highlights excessive permissions or misconfigurations, and provides actionable recommendations to reduce vulnerabilities. Use this connector to fetch audit logs from BloodHound Enterprise as events in Cortex XSIAM.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # BloodHound Enterprise
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM license.
 
 BloodHound Enterprise is a cyber security tool for identifying, analyzing, and mitigating attack paths within Active Directory environments. It maps potential attack paths, highlights excessive permissions or misconfigurations, and provides actionable recommendations to reduce vulnerabilities. Use this connector to fetch audit logs from BloodHound Enterprise as events in Cortex XSIAM.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ BlueCat Address Manager modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bluecat-address-manager/bluecat-address-manager

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# BlueCat Address Manager

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Use the BlueCat Address Manager integration to enrich IP addresses and manage response policies. This integration supports BlueCat Address Manager version 9.5.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # BlueCat Address Manager
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Use the BlueCat Address Manager integration to enrich IP addresses and manage response policies. This integration supports BlueCat Address Manager version 9.5.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ BMC modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bmc/bmc

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# BMC

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

BMC connectors help streamline security-related service management and IT operations. Manage service requests, issues, change requests, tasks, problem investigations, known errors, and work order tickets in BMC Helix ITSM and BMC Helix Remedyforce, and get server details from BMC Remedy AR System.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # BMC
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 BMC connectors help streamline security-related service management and IT operations. Manage service requests, issues, change requests, tasks, problem investigations, known errors, and work order tickets in BMC Helix ITSM and BMC Helix Remedyforce, and get server details from BMC Remedy AR System.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Box Automation and Collection modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/box/box-automation-and-collection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Box Automation and Collection

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

Manage Box users and collect events from Box's logs. Authentication is handled via JSON Web Tokens (JWT) using a Box custom app with Server Authentication.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• Box v2: Manage Box users. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

• BoxEventsCollector: Collect events from Box's logs. This sub-capability is available with any active Cortex XSIAM license.

Show markdown source

@@ -1,14 +1,14 @@
 # Box Automation and Collection
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 Manage Box users and collect events from Box's logs. Authentication is handled via JSON Web Tokens (JWT) using a Box custom app with Server Authentication.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [Box v2](https://xsoar.pan.dev/docs/reference/integrations/box-v2): Manage Box users. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 * [BoxEventsCollector](https://xsoar.pan.dev/docs/reference/integrations/box-events-collector): Collect events from Box's logs. This sub-capability is available with any active Cortex XSIAM license.

▸ Broadcom modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/broadcom/broadcom

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Broadcom

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

Broadcom Symantec security products for endpoint, email, web, and data protection. This connector groups Symantec Endpoint Detection and Response (EDR), Endpoint Protection, Endpoint Security, Data Loss Prevention, Email Security Cloud, Messaging Gateway, Management Center, Cloud Secure Web Gateway, CloudSOC, and Blue Coat Content and Malware Analysis to manage protection, collect events, and perform remediation.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• Symantec Blue Coat Content and Malware Analysis: This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

• Symantec Cloud Secure Web Gateway Event Collector: Palo Alto Networks Symantec Cloud Secure Web Gateway Event Collector integration for Cortex XSIAM. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Show markdown source

@@ -1,14 +1,14 @@
 # Broadcom
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 Broadcom Symantec security products for endpoint, email, web, and data protection. This connector groups Symantec Endpoint Detection and Response (EDR), Endpoint Protection, Endpoint Security, Data Loss Prevention, Email Security Cloud, Messaging Gateway, Management Center, Cloud Secure Web Gateway, CloudSOC, and Blue Coat Content and Malware Analysis to manage protection, collect events, and perform remediation.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [Symantec Blue Coat Content and Malware Analysis](https://xsoar.pan.dev/docs/reference/integrations/symantec-blue-coat-content-and-malware-analysis): This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 * [Symantec Cloud Secure Web Gateway Event Collector](https://xsoar.pan.dev/docs/reference/integrations/symantec-cloud-secure-web-gateway-event-collector): Palo Alto Networks Symantec Cloud Secure Web Gateway Event Collector integration for Cortex XSIAM. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

▸ BruteForceBlocker modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bruteforceblocker/bruteforceblocker

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# BruteForceBlocker

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

BruteForceBlocker is a Perl script that works with pf – the firewall developed by the OpenBSD team, and is also available on FreeBSD from version 5.2. From BruteForceBlocker version 1.2 it is also possible to report blocked IP addresses to the project site and share your information with other users.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # BruteForceBlocker
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 BruteForceBlocker is a Perl script that works with pf – the firewall developed by the OpenBSD team, and is also available on FreeBSD from version 5.2. From BruteForceBlocker version 1.2 it is also possible to report blocked IP addresses to the project site and share your information with other users.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ C2SEC modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/c2sec/c2sec

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# C2SEC

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Use the C2sec irisk integration to scan domains and return scan results. Add domains to a portfolio, check scan status, re-scan domains, and retrieve issues and scan results for a domain.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # C2SEC
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Use the C2sec irisk integration to scan domains and return scan results. Add domains to a portfolio, check scan status, re-scan domains, and retrieve issues and scan results for a domain.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ CAPESandbox modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/capesandbox/capesandbox

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# CAPESandbox

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

CAPE Sandbox is an open-source software for automating the analysis of suspicious files and URLs. It provides comprehensive malware analysis capabilities, including behavioral analysis, memory forensics, and network traffic capture. This integration allows you to interact with CAPE Sandbox for automated malware analysis.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # CAPESandbox
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 CAPE Sandbox is an open-source software for automating the analysis of suspicious files and URLs. It provides comprehensive malware analysis capabilities, including behavioral analysis, memory forensics, and network traffic capture. This integration allows you to interact with CAPE Sandbox for automated malware analysis.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Carbon Black modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/carbon-black/carbon-black

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Carbon Black

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

VMware Carbon Black is a cloud-delivered endpoint protection platform. Carbon Black Endpoint Standard (formerly CB Defense) is a next-generation antivirus (NGAV) and behavioral EDR solution, Enterprise EDR delivers advanced threat hunting and issue response, App Control (formerly Enterprise Protection) provides endpoint threat prevention, and Live Response lets security operators collect information and take action on remote endpoints in real time.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• Carbon Black Endpoint Standard: Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

• Carbon Black Endpoint Standard v3: Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Show markdown source

@@ -1,14 +1,14 @@
 # Carbon Black
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 VMware Carbon Black is a cloud-delivered endpoint protection platform. Carbon Black Endpoint Standard (formerly CB Defense) is a next-generation antivirus (NGAV) and behavioral EDR solution, Enterprise EDR delivers advanced threat hunting and issue response, App Control (formerly Enterprise Protection) provides endpoint threat prevention, and Live Response lets security operators collect information and take action on remote endpoints in real time.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [Carbon Black Endpoint Standard](https://xsoar.pan.dev/docs/reference/integrations/carbon-black-endpoint-standard): Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 * [Carbon Black Endpoint Standard v3](https://xsoar.pan.dev/docs/reference/integrations/carbon-black-endpoint-standard-v3): Endpoint Standard is an industry-leading next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution. Endpoint Standard is delivered through the Carbon Black Cloud, an endpoint protection platform that consolidates security in the cloud using a single agent, console and data set. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

▸ Celonis Collection modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/celonis/celonis-collection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Celonis Collection

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM license.

Celonis is a process mining and execution management platform that helps organizations analyze and optimize their business processes for improved efficiency and performance. This connector collects Celonis Audit, Studio Adoption, and Login History logs.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Celonis Collection
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM license.
 
 Celonis is a process mining and execution management platform that helps organizations analyze and optimize their business processes for improved efficiency and performance. This connector collects Celonis Audit, Studio Adoption, and Login History logs.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Centreon modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/centreon/centreon

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Centreon

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Use Centreon to check the status of hosts and services. This integration was integrated and tested with Centreon v2.8.20.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Centreon
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Use Centreon to check the status of hosts and services. This integration was integrated and tested with Centreon v2.8.20.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Checkpoint Firewall modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/check-point/checkpoint-firewall

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Checkpoint Firewall

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Integrate with Check Point Software Technologies products. Manage the Check Point Firewall server, protect endpoints with Check Point Harmony Endpoint, perform remote file analysis with Check Point Threat Emulation (SandBlast), and manage the security and compliance of the public cloud with Check Point Dome9 (CloudGuard).

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Checkpoint Firewall
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Integrate with Check Point Software Technologies products. Manage the Check Point Firewall server, protect endpoints with Check Point Harmony Endpoint, perform remote file analysis with Check Point Threat Emulation (SandBlast), and manage the security and compliance of the public cloud with Check Point Dome9 (CloudGuard).
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ CheckPhish modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/checkphish/checkphish

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# CheckPhish

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Check any URL to detect suspicious behavior. CheckPhish (by BolsterAI) classifies URLs by disposition, detecting zero-day phishing, tech support scams, gift card scams, survey scams, adult websites, drug/pharmacy spam, illegal streaming, gambling, hacked websites, and cryptojacking/cryptomining.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # CheckPhish
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Check any URL to detect suspicious behavior. CheckPhish (by BolsterAI) classifies URLs by disposition, detecting zero-day phishing, tech support scams, gift card scams, survey scams, adult websites, drug/pharmacy spam, illegal streaming, gambling, hacked websites, and cryptojacking/cryptomining.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ CipherTrust modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ciphertrust/ciphertrust

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# CipherTrust

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Manage secrets and protect sensitive data through the Thales CipherTrust Manager security platform. Configure, manage, and monitor user groups, users, and digital certificates, and manage local and external Certificate Authorities to maintain secure communication channels and access control.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # CipherTrust
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Manage secrets and protect sensitive data through the Thales CipherTrust Manager security platform. Configure, manage, and monitor user groups, users, and digital certificates, and manage local and external Certificate Authorities to maintain secure communication channels and access control.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ CIRCL modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/circl/circl

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# CIRCL

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Use the CIRCL integration to research malware history for IPs, DNSs, and hostnames, and to query certificate history and details. It also searches for CVE information using circl.lu.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # CIRCL
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Use the CIRCL integration to research malware history for IPs, DNSs, and hostnames, and to query certificate history and details. It also searches for CVE information using circl.lu.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ CircleCI modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/circleci/circleci

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# CircleCI

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Gets the details of the CircleCI workflows, including the details of the last runs and the jobs, and retrieves the artifacts of the jobs. This integration was integrated and tested with version v2 of CircleCI.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # CircleCI
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Gets the details of the CircleCI workflows, including the details of the last runs and the jobs, and retrieves the artifacts of the jobs. This integration was integrated and tested with version v2 of CircleCI.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cisco ASA modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-asa

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cisco ASA

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Cisco Adaptive Security Appliances (ASA) is a unified security solution that integrates firewall capabilities, intrusion prevention (IPS), and VPN services. Use this connector to manage interfaces, rules, and network objects.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cisco ASA
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Cisco Adaptive Security Appliances (ASA) is a unified security solution that integrates firewall capabilities, intrusion prevention (IPS), and VPN services. Use this connector to manage interfaces, rules, and network objects.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cisco DUO Automation and Collection modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-duo-automation-and-collection

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cisco DUO Automation and Collection

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

The Duo Admin API provides programmatic access to the administrative functionality of Duo Security's two-factor authentication platform. This connector runs automation actions against Duo and collects Auth and Audit log events using the Duo Admin API.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• DUO Admin: This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

• Duo Event Collector: Collects Auth and Audit events for Duo using the API. This sub-capability is available with any active Cortex XSIAM license.

Show markdown source

@@ -1,14 +1,14 @@
 # Cisco DUO Automation and Collection
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 The Duo Admin API provides programmatic access to the administrative functionality of Duo Security's two-factor authentication platform. This connector runs automation actions against Duo and collects Auth and Audit log events using the Duo Admin API.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [DUO Admin](https://xsoar.pan.dev/docs/reference/integrations/duo-admin): This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 * [Duo Event Collector](https://xsoar.pan.dev/docs/reference/integrations/duo-event-collector): Collects Auth and Audit events for Duo using the API. This sub-capability is available with any active Cortex XSIAM license.

▸ Cisco Firepower modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-firepower

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cisco Firepower

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Use the Cisco Firepower integration for unified management of firewalls, application control, intrusion prevention, URL filtering, and advanced malware protection.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cisco Firepower
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Use the Cisco Firepower integration for unified management of firewalls, application control, intrusion prevention, URL filtering, and advanced malware protection.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cisco ISE modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-ise

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cisco ISE

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Cisco Identity Services Engine (ISE) offers a network-based approach for adaptable, trusted access everywhere, based on context. It gives you intelligent, integrated protection through intent-based policy and compliance solutions. Use this connector to get endpoint data, and to manage and update endpoints and ANC policies.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cisco ISE
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Cisco Identity Services Engine (ISE) offers a network-based approach for adaptable, trusted access everywhere, based on context. It gives you intelligent, integrated protection through intent-based policy and compliance solutions. Use this connector to get endpoint data, and to manage and update endpoints and ANC policies.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cisco Meraki Automation and Remediation modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-meraki-automation-and-remediation

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cisco Meraki Automation and Remediation

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Cisco Meraki is a cloud-managed IT platform that simplifies networking, security, communications, and endpoint management through a centralized web interface. This connector runs automated actions and remediation against organizations, networks, devices, and their licenses via the Meraki Dashboard API.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cisco Meraki Automation and Remediation
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Cisco Meraki is a cloud-managed IT platform that simplifies networking, security, communications, and endpoint management through a centralized web interface. This connector runs automated actions and remediation against organizations, networks, devices, and their licenses via the Meraki Dashboard API.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cisco Security modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-security

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cisco Security

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

Cisco security products for endpoint malware protection (AMP/Secure Endpoint), email and web security (ESA, SMA, WSA), network and cloud analytics (Secure Network Analytics/Stealthwatch, Secure Cloud Analytics), malware analysis and threat intelligence (Secure Malware Analytics/Threat Grid, Webex Feed), collaboration (Webex Teams), application performance (AppDynamics), cloud security (CloudLock), vulnerability management (Kenna), phishing lookup (PhishTank), and event collection across the Cisco portfolio. Use these connectors to fetch events and issues, enrich indicators, and run automation and remediation.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• AMP: Uses CISCO AMP Endpoint. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

• AMPv2: Cisco Advanced Malware Protection software is designed to prevent, detect, and help remove threats in an efficient manner from computer systems. Threats can take the form of software viruses and other malware such as ransomware, worms, Trojans, spyware, adware, and fileless malware. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Show markdown source

@@ -1,14 +1,14 @@
 # Cisco Security
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 Cisco security products for endpoint malware protection (AMP/Secure Endpoint), email and web security (ESA, SMA, WSA), network and cloud analytics (Secure Network Analytics/Stealthwatch, Secure Cloud Analytics), malware analysis and threat intelligence (Secure Malware Analytics/Threat Grid, Webex Feed), collaboration (Webex Teams), application performance (AppDynamics), cloud security (CloudLock), vulnerability management (Kenna), phishing lookup (PhishTank), and event collection across the Cisco portfolio. Use these connectors to fetch events and issues, enrich indicators, and run automation and remediation.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [AMP](https://xsoar.pan.dev/docs/reference/integrations/amp): Uses CISCO AMP Endpoint. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 * [AMPv2](https://xsoar.pan.dev/docs/reference/integrations/am-pv2): Cisco Advanced Malware Protection software is designed to prevent, detect, and help remove threats in an efficient manner from computer systems. Threats can take the form of software viruses and other malware such as ransomware, worms, Trojans, spyware, adware, and fileless malware. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

▸ Cisco Umbrella modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-umbrella

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cisco Umbrella

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Cisco Umbrella is a cloud security platform providing the first line of defense against internet threats. It uses DNS-layer security to block malicious requests before a connection is established, offering protection against malware, ransomware, phishing, and more. This connector supports enforcement, threat investigation of domains, IPs, and URLs, and reporting on request and blocked activity.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cisco Umbrella
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Cisco Umbrella is a cloud security platform providing the first line of defense against internet threats. It uses DNS-layer security to block malicious requests before a connection is established, offering protection against malware, ransomware, phishing, and more. This connector supports enforcement, threat investigation of domains, IPs, and URLs, and reporting on request and blocked activity.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Citrix modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/citrix/citrix

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Citrix

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM license.

Citrix Cloud is a cloud-based management platform that provides the centralized control plane for delivering and managing all Citrix digital workspace services, including virtual apps and desktops. Citrix DaaS delivers secure virtual apps and desktops from the cloud while maintaining centralized control and configuration management. This connector collects Citrix Cloud system log records and Citrix DaaS configuration log records.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Citrix
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM license.
 
 Citrix Cloud is a cloud-based management platform that provides the centralized control plane for delivering and managing all Citrix digital workspace services, including virtual apps and desktops. Citrix DaaS delivers secure virtual apps and desktops from the cloud while maintaining centralized control and configuration management. This connector collects Citrix Cloud system log records and Citrix DaaS configuration log records.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cloaken modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cloaken/cloaken

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cloaken

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Use the Cloaken integration to unshorten URLs in AWS behind TOR. Unshorten a URL to run the expanded URL through intelligence sources.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cloaken
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Use the Cloaken integration to unshorten URLs in AWS behind TOR. Unshorten a URL to run the expanded URL through intelligence sources.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ CloudConvert modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cloudconvert/cloudconvert

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# CloudConvert

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Use the CloudConvert integration to convert your files to the required format. This integration was integrated and tested with version v2 of CloudConvert.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # CloudConvert
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Use the CloudConvert integration to convert your files to the required format. This integration was integrated and tested with version v2 of CloudConvert.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cloudflare modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cloudflare/cloudflare

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cloudflare

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

Cloudflare provides network and security products for consumers and businesses, using reverse proxies for web traffic, edge computing, and a content delivery network. This connector fetches indicators from the Cloudflare feed, connects to a Cloudflare Model Context Protocol (MCP) server to access Cloudflare tools in real time, collects Cloudflare Zero Trust audit and access authentication logs as events, and manages Cloudflare WAF firewall rules, filters, and IP-lists.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• Cloudflare Feed: This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

• Cloudflare MCP: Use this integration to connect securely with a Cloudflare Model Context Protocol (MCP) server and access its tools in real time. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Show markdown source

@@ -1,14 +1,14 @@
 # Cloudflare
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 Cloudflare provides network and security products for consumers and businesses, using reverse proxies for web traffic, edge computing, and a content delivery network. This connector fetches indicators from the Cloudflare feed, connects to a Cloudflare Model Context Protocol (MCP) server to access Cloudflare tools in real time, collects Cloudflare Zero Trust audit and access authentication logs as events, and manages Cloudflare WAF firewall rules, filters, and IP-lists.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [Cloudflare Feed](https://xsoar.pan.dev/docs/reference/integrations/cloudflare-feed): This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 * [Cloudflare MCP](https://xsoar.pan.dev/docs/reference/integrations/cloudflare-mcp): Use this integration to connect securely with a Cloudflare Model Context Protocol (MCP) server and access its tools in real time. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

▸ Code42 modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/code42/code42

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Code42

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM license.

Code42 Insider Risk software solutions provide the right balance of transparency, technology and training to detect and appropriately respond to data risk. Use the Code42 Event Collector to fetch file events and audit logs.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Code42
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM license.
 
 Code42 Insider Risk software solutions provide the right balance of transparency, technology and training to detect and appropriately respond to data risk. Use the Code42 Event Collector to fetch file events and audit logs.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cohesity modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cohesity/cohesity

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cohesity

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM license.

Cohesity Helios is a next-gen data management platform that combines an immutable file system with DataLock, anomaly detection, policy-based data isolation, quorum, and MFA to protect backup data from ransomware attacks. This connector integrates ransomware detection and audit and alert log collection into Cortex XSOAR for automated ransomware attack recovery.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cohesity
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM license.
 
 [Cohesity Helios](https://www.cohesity.com/products/helios/) is a next-gen data management platform that combines an immutable file system with DataLock, anomaly detection, policy-based data isolation, quorum, and MFA to protect backup data from ransomware attacks. This connector integrates ransomware detection and audit and alert log collection into Cortex XSOAR for automated ransomware attack recovery.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ CounterTack modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/countertack/countertack

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# CounterTack

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

CounterTack is a predictive endpoint protection platform that empowers endpoint security teams to assure endpoint protection by identifying cyber threats.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # CounterTack
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 CounterTack is a predictive endpoint protection platform that empowers endpoint security teams to assure endpoint protection by identifying cyber threats.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cribl connector modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cribl/cribl-connector

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cribl connector

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security with the Application Security Posture Management (ASPM) module, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license with the Attack Surface Management (ASM), Exposure Management, or Threat Intel Management (TIM) add-on.

Cribl Search is a search solution that allows you to query, retrieve, and manage search jobs, datasets, and saved searches across your Cribl Cloud deployment.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cribl connector
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security with the Application Security Posture Management (ASPM) module, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license with the Attack Surface Management (ASM), Exposure Management, or Threat Intel Management (TIM) add-on.
 
 Cribl Search is a search solution that allows you to query, retrieve, and manage search jobs, datasets, and saved searches across your Cribl Cloud deployment.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ CrowdStrike modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/crowdstrike/crowdstrike

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# CrowdStrike

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

CrowdStrike Falcon is a leading Endpoint Protection Platform (EPP) that helps organizations quickly detect, analyze, block, and contain malicious attacks on enterprise endpoints and servers. It provides real-time response, vulnerability assessment, and host containment, along with a CrowdStrike Falcon Intel threat intelligence feed to help organizations defend against adversary activity.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• CrowdStrike Falcon Intel v2: CrowdStrike Threat intelligence service integration helps organizations defend themselves against adversary activity by investigating incidents, and accelerating alert triage and response. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

• CrowdstrikeFalcon: The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license with the Exposure Management add-on.

Show markdown source

@@ -1,14 +1,14 @@
 # CrowdStrike
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 CrowdStrike Falcon is a leading Endpoint Protection Platform (EPP) that helps organizations quickly detect, analyze, block, and contain malicious attacks on enterprise endpoints and servers. It provides real-time response, vulnerability assessment, and host containment, along with a CrowdStrike Falcon Intel threat intelligence feed to help organizations defend against adversary activity.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [CrowdStrike Falcon Intel v2](https://xsoar.pan.dev/docs/reference/integrations/crowd-strike-falcon-intel-v2): CrowdStrike Threat intelligence service integration helps organizations defend themselves against adversary activity by investigating incidents, and accelerating alert triage and response. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 * [CrowdstrikeFalcon](https://xsoar.pan.dev/docs/reference/integrations/crowdstrike-falcon): The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license with the Exposure Management add-on.

▸ CryptoCurrency modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cryptocurrency/cryptocurrency

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# CryptoCurrency

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Classify Cryptocurrency indicators as suspicious when they are ingested. Supported cryptocurrencies: bitcoin.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # CryptoCurrency
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Classify Cryptocurrency indicators as suspicious when they are ingested. Supported cryptocurrencies: bitcoin.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cuckoo Sandbox modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cuckoo-sandbox/cuckoo-sandbox

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cuckoo Sandbox

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Cuckoo Sandbox is an automated malware analysis system. Analyze files and URLs in a safe environment (sandbox) and view Cuckoo's tasks and machines.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cuckoo Sandbox
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Cuckoo Sandbox is an automated malware analysis system. Analyze files and URLs in a safe environment (sandbox) and view Cuckoo's tasks and machines.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ CybelAngel modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cybelangel/cybelangel

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# CybelAngel

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

CybelAngel is a cybersecurity firm specializing in external attack surface protection and management. This connector receives reports from the CybelAngel platform, providing advanced EASM protection for enhanced security.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # CybelAngel
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 CybelAngel is a cybersecurity firm specializing in external attack surface protection and management. This connector receives reports from the CybelAngel platform, providing advanced EASM protection for enhanced security.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ Cyber Triage modified +1 −1

xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cyber-triage/cyber-triage

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# Cyber Triage

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

Collect and analyze endpoint data using Cyber Triage. It sends an agentless collection tool to a remote endpoint, retrieves volatile and file system data, and analyzes it for evidence of an intrusion. Requires the Team version of Cyber Triage (not the Standalone desktop version).

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

Show markdown source

@@ -1,14 +1,14 @@
 # Cyber Triage
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.
 
 Collect and analyze endpoint data using Cyber Triage. It sends an agentless collection tool to a remote endpoint, retrieves volatile and file system data, and analyzes it for evidence of an intrusion. Requires the Team version of Cyber Triage (not the Standalone desktop version).
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

▸ CyberArk modified +1 −1 xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cyberark/cyberark

Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗

Before After

@@ -1,14 +1,14 @@

# CyberArk

hint warning

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

endhint

CyberArk secures human and machine identities across hybrid and multi-cloud environments. This connector collects audit and authentication events from the CyberArk Identity Security Platform, CyberArk Identity, and CyberArk Endpoint Privilege Manager (EPM), activates and deactivates EPM risk plans for endpoints as a SOC response, and retrieves certificate information from CyberArk Certificate Manager.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• CyberArk Identity Event Collector: This integration collects events from the Idaptive Next-Gen Access (INGA) using REST APIs. This sub-capability is available with any active Cortex XSIAM license.

• CyberArkEPMEventCollector: CyberArk EPM Event Collector fetches events. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud, Cortex Cloud Runtime Security, or Cortex XDR license.

Show markdown source

@@ -1,14 +1,14 @@
 # CyberArk
 
 {% hint style="warning" %}
 **Important**
 
-This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.
+This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see [Marketplace](../../../marketplace).
 {% endhint %}
 
 CyberArk secures human and machine identities across hybrid and multi-cloud environments. This connector collects audit and authentication events from the CyberArk Identity Security Platform, CyberArk Identity, and CyberArk Endpoint Privilege Manager (EPM), activates and deactivates EPM risk plans for endpoints as a SOC response, and retrieves certificate information from CyberArk Certificate Manager.
 
 This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):
 
 * [CyberArk Identity Event Collector](https://xsoar.pan.dev/docs/reference/integrations/cyber-ark-identity-event-collector): This integration collects events from the Idaptive Next-Gen Access (INGA) using REST APIs. This sub-capability is available with any active Cortex XSIAM license.
 * [CyberArkEPMEventCollector](https://xsoar.pan.dev/docs/reference/integrations/cyber-ark-epm-event-collector): CyberArk EPM Event Collector fetches events. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud, Cortex Cloud Runtime Security, or Cortex XDR license.

Documentation — August 11, 2026

Marketplace links restored on 296 data-source pages; Cloud Application Security rewritten with licensing

Highlights

Changes