topic Re: cortex installation question in Cortex XDR Discussions

cortex installation question

jchurch — Mon, 17 Aug 2020 16:57:02 GMT

i am using the same installer on all my clients (mac) why do some of my devices have malware and exploit protection and others just malware protection?

Re: cortex installation question

dfalcon — Mon, 17 Aug 2020 17:14:56 GMT

Hi @jchurch -

The installer should have no bearing on the policy applied. Please check your policy rules to ensure that machines are in the correct filter -- or that they are included.

Re: cortex installation question

jchurch — Mon, 17 Aug 2020 17:55:58 GMT

they all have the same policy applied. see the screenshots below. some just don't have exploit protection

Re: cortex installation question

dfalcon — Mon, 17 Aug 2020 18:58:00 GMT

Hi @jchurch,

Okay, thank you. This may require a little more examination. Are the macOS versions all the same? Second, do you know if full disk access (version macOS 10.15 and later) was granted on all clients as per the document below?

https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-0/cortex-xdr-agent-admin/cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-for-mac

If these boxes have been checked, we are likely going to need to gather a tech support file (TSF) and reach out to support. The TSF can captured by going to your endpoint list > Endpoint Control > Retrieve Support File.