topic Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus) in Cortex XDR Discussions

Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

DS1465 — Mon, 17 Jul 2023 07:39:17 GMT

I have installed Cortex XDR on my corporate laptop which runs the subjected Linux operating system. I used the DEB package and used below command to install.

sudo dpkg -i <cortex_pacakage>.deb

But after the installation Cortex agent is not running properly. Please see to the attached screenshot.

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

neelrohit — Mon, 17 Jul 2023 07:47:12 GMT

Hi @DS1465 ,

Elementary OS is a flavour of Linux distro. However, it is not in the list of supported operating systems for Cortex XDR agent installation. Please refer to the below for list of supported OS:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Compatibility-Matrix/Linux

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

DS1465 — Mon, 17 Jul 2023 10:01:47 GMT

But the elementary runs on Ubuntu 22.04 LTS version which is a compatible OS according to the documentation.

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

neelrohit — Mon, 17 Jul 2023 11:46:15 GMT

Hi @DS1465 ,

there are many flavours of OSs of linux that are built on the base version. But we support only the base flavours of linux, eg, CentOS, Ubuntu, RHEL etc and not the customised OS versions. As a result, it is not suppported.

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

Shahwaz_Md — Tue, 18 Jul 2023 04:56:00 GMT

Hi Neel,

Would appliances running on custom Linux OSs be compatible with XDR? What should be the approach to understanding the compatibility as installing XDR on it might cause issues.

Regards,

Shahwaz

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

neelrohit — Tue, 18 Jul 2023 05:16:21 GMT

Hi @Shahwaz_Md ,

We do not support custom OS and any OS beyond the list mentioned in the list: Where Can I Install Cortex XDR Agent?

Regards

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

Shahwaz_Md — Tue, 18 Jul 2023 05:26:46 GMT

Those appliances are running on Compatible OSs such as RHEL, SUSE, etc, but these are OEM-provided hardened OSs. Can we install XDR on them?

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

neelrohit — Tue, 18 Jul 2023 05:36:45 GMT

OEM hardened versions are mostly changes in the kernels. If the kernel is a customisation, you would be able to install cortex xdr agent on them, but the oem kernels are not supported and as a result the agent will not operate properly and many functions will not work properly.

In short, we support only vanilla format of linux OS with kernel versions support required for agent operation :Cortex XDR Supported Kernel Versions

Hope this helps!

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

DS1465 — Tue, 18 Jul 2023 07:52:09 GMT

Same issue occurred from the same .DEB installer when I try on an Ubuntu 22.04 machine?!

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

Shahwaz_Md — Tue, 18 Jul 2023 08:07:13 GMT

Hi Neel,

I have one more query, can we install xdr on Citrix ADC, did not find anything in comp matrix.

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

neelrohit — Tue, 18 Jul 2023 11:16:19 GMT

Hi @DS1465 ,

Are you sure, all the requirements below are met?
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.7/Cortex-XDR-Agent-Administrator-Guide/Cortex-XDR-Agent-for-Linux-Requirements

@Shahwaz_Md , you can install cortex xdr agent on endpoints or VMs hosted on citrix ADC, but not on Citrix ADC itself.

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

neelrohit — Wed, 19 Jul 2023 05:15:29 GMT

Hi @DS1465 ,

Also, I saw your screenshot. And from the attachment, it seems the cytool services are running as needed. I see you have attempted starting of cortex xdr services on the machine using cytool command, but it is correct that the 2 other services will be stopped except at times when there is a prevention attempt on malicious activity.

So if you installed the agent on Ubuntu and saw the same, there is no error. It is expected and the agent would be running fine

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

DS1465 — Wed, 19 Jul 2023 18:22:00 GMT

Hi @neelrohit,

But I still can't see the endpoint on console.

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

neelrohit — Thu, 20 Jul 2023 07:16:39 GMT

Hi @DS1465 ,

did you try to test connectivity to the cloud from the agent?? What was the output of cytool connectivity_test?
In case you haven't, can you run this command? If you get error, it means the agent is not able to connect to the cloud and hence not able to register to the cloud console.

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

DS1465 — Thu, 20 Jul 2023 07:39:14 GMT

Hi @neelrohit ,

I have tried connectivity test and it is giving an error. Screenshot is already attached herewith.

Re: Cortex XDR Agent V 8.0.1.100321 is not running correctly on Elementary OS 7 (Horus)

neelrohit — Thu, 20 Jul 2023 08:24:05 GMT

Hi @DS1465 ,

So as the screenshot depicts, you can see that the Core(cc-<>....paloaltonetworks.com), the home( ch-<>....paloaltonetworks.com) and the datacenter(dc-<>....paloaltonetworks.com) URL is not able to connect, it is a clear indication that the agent is not able to connect to the cloud. Please check if you have network connections whitelisted as required in Resources Required to Enable Access to Cortex XDR on your firewalls.

If this is an endpoint in an air-gapped network please see if you have a broker vm deployed and add the proxy IP and port connection to the config file prior to the installation of the agent. Check if the agent is able to connect afterwards post instalaltion.

In case you need more help, collect logs from the agent, and then open a support case.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.