The Cortex XDR agent for Linux has the following requirements:
| REQUIREMENT | MINIMUM SPECIFICATION |
|---|---|
| Processor | 2.3 GHz |
| RAM | 4GB; 8GB recommended |
| Hard disk space | 10GB |
| Architecture | x86 64-bit |
| Operating system versions | See Where can I install the Cortex XDR Agent? in the Palo Alto Networks® Compatibility Matrix. |
| Kernel version | 2.6.32To perform malware analysis of ELF files, and collect data for EDR and behavioral threat analysis, the Cortex XDR agent for Linux requires a supported kernel version of 3.4 or later, as listed in:Cortex XDR Agent 7.0.3 Supported Kernel Versions by DistributionCortex XDR Agent 7.0.2 Supported Kernel Versions by DistributionCortex XDR Agent 7.0.1 Supported Kernel Versions by DistributionCortex XDR Agent 7.0.0 Supported Kernel Versions by DistributionIf you deploy the Cortex XDR agent on a Linux server that is not running one of the kernel versions required for these additional protection capabilities, the agent will operate in asynchronous mode: the agent will obtain a verdict for the executed ELF file in parallel to its execution and terminate it if a malware verdict is obtained. In addition, data collection for EDR and behavioral threat protection will not be supported.In Cortex XDR agent 7.0.1 release deployed on endpoints running kernels RHEL, or CentOS, or Oracle 8, you must disable UEFI Secure Boot on the machine. Otherwise, the Cortex XDR agent will operate in asynchronous mode as explained above. |
| Software packages | ca-certificatesopenssl 1.0.0 or a later releaseDistributions with SELinux in enforcing or permissive mode:Red Hat Enterprise Linux 6, CentOS 6, and Oracle Linux 6—policycoreutils-pythonRed Hat Enterprise Linux 7, CentOS 7, and Oracle Linux 7—policycoreutils-python and selinux-policy-develSUSE—policycoreutils-python and selinux-policy-develDebian and Ubuntu—policycoreutils and selinux-policy-devglibc—Required for exploit protection of containerized processes using the ROP Mitigation and Brute Force Protection modules. If glibc is not installed, the modules are disabled but all other exploit and malware protection functionality work as expected. |
| Networking | Allow communication on the TCP port from the Cortex XDR agent to server (the default is port 443).Allow the Cortex XDR management console and agent to communicate with external and internal resources required for enforcing endpoint protection. See the Cortex XDR Administrator Guide for your license type (Enable Access with Cortex XDR Prevent or Enable Access with Cortex XDR Pro per Endpoint). |

