topic Re: Traps and Cortex co-existence in Cortex XDR Discussions

Traps and Cortex co-existence

Balaraju — Thu, 01 Sep 2022 15:16:41 GMT

Thanks in advance for help

We have few Linux Servers and they have Traps 4.x installed , Traps as you know is previous product of Palo and now its replaced with Cortex XDR .

We wanted to remove Traps and install Cortex XDR 7.x . We wanted to know if we can install Cortex without removing Traps ? as in case of some issues in installation of Cortex , Traps would left undisturbed ? so once Cortex is tested we can remove Traps after that ?

Re: Traps and Cortex co-existence

neelrohit — Thu, 01 Sep 2022 19:01:01 GMT

Hi @Balaraju ,

Cortex XDR is designed with the same fundamentals carried forward and modernised to next generation of detection and prevention solution. Hence both cannot coexist in any circumstance. Practice recommended steps to follow:

Uninstall traps
Reboot the endpoint
Install Cortex XDR
Perform reboot.

Hope this answers your question.

Regards,

@neelrohit

Re: Traps and Cortex co-existence

Balaraju — Fri, 02 Sep 2022 06:52:56 GMT

Thanks for your reply . Its very useful . Just one question , is reboot mandatory given its Linux ?

Thanks again

Re: Traps and Cortex co-existence

neelrohit — Fri, 02 Sep 2022 11:58:15 GMT

@Balaraju ,

Traps and cortex both perform kernel level injections on the endpoints for credential theft protection. In order to release/perform the kernel injections,endpoints need to drive into kernel loading which happens only during OS boot time. Hence the reboot requirement.

Hope that answers your question.

Re: Traps and Cortex co-existence

Balaraju — Fri, 02 Sep 2022 12:01:27 GMT

Thanks lot again .