Cortex XDR files modified

efasoformoso — Thu, 29 Apr 2021 19:05:45 GMT

We have some systems that are locked-down with software that prevents modifications to files/directories, and I'm wondering what are the paths that Cortex needs to be able to modify? For example, when it downloads the latest definitions, what does it need to modify? Is there any data stored in the registry as well?

Re: Cortex XDR files modified

gjenkins — Thu, 06 May 2021 18:37:55 GMT

@efasoformoso wrote:
We have some systems that are locked-down with software that prevents modifications to files/directories, and I'm wondering what are the paths that Cortex needs to be able to modify? For example, when it downloads the latest definitions, what does it need to modify? Is there any data stored in the registry as well?

Hi @efasoformoso,

For Windows, the Cortex XDR agent installs in the "C:\Program Files (x86)\Palo Alto Networks\Traps" folder. Source: Use Cortex XDR Agent for Windows
For Linux, The Cortex XDR agent installs in the "/opt/traps" directory. Source: Use Cortex XDR Agent for Windows
For MacOS, there are a number of locations to consider. Please see this document for more information.

Edit: As for the registry, here are the main locations to note:
"HKLM\SOFTWARE\Palo Alto Networks\Traps"
"HKLM\SOFTWARE\Cyvera"

topic Re: Cortex XDR files modified in Cortex XDR Discussions

Cortex XDR files modified

Re: Cortex XDR files modified