topic Cortex XDR Certificate enforcement for Windows and macOS endpoints in Cortex XDR Discussions

Cortex XDR Certificate enforcement for Windows and macOS endpoints

Vinothkumar_SBA — Wed, 11 Sep 2024 04:54:39 GMT

Hi Team,

I have a query regarding the Cortex XDR Agent (8.3) Certificate Enforcement settings.

1. Enable the Certificate Enforcement option.
2. Decrypt either only Cortex XDR Agent traffic in the firewall or decrypt all traffic related to application servers in the firewall.

Please confirm if these steps are correct, as I have not found comprehensive documentation on this configuration.

Re: Cortex XDR Certificate enforcement for Windows and macOS endpoints

jmazzeo — Wed, 11 Sep 2024 13:31:01 GMT

Hi @Vinothkumar_SBA, thanks for reaching us using the Live Community.

The Agent Certificate Enforcement is a feature introduced in 8.3 to improve the agent security, by enforcing the use of root CA that is provided by Palo Alto Networks rather than on the local machine. You have more information in the Agents Settings Profile document.

If you have SSL Decryption in your firewall, the FQDNS are still needed to be added as an exception for the XDR Agents. Here you can find the resources to except.

If this post answers your question, please mark it as the solution.

Re: Cortex XDR Certificate enforcement for Windows and macOS endpoints

Vinothkumar_SBA — Thu, 12 Sep 2024 06:10:15 GMT

Hi Jmazzeo,

Thank you for your response. You mentioned that only the Cortex XDR agent URLs should be added to the FQDN exception list, and not all URLs or other application server URLs. Is my understanding correct or incorrect?

Re: Cortex XDR Certificate enforcement for Windows and macOS endpoints

jmazzeo — Thu, 12 Sep 2024 13:13:38 GMT

Hi, I linked this document that shows all the required URLs: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Resources-Required-to-Enable-Access

Not only the tenant URL, there are a few more that the agent needs to communicate. If you have PANW NGFW you can see the App-ID Coverage in that doc.