Cortex XDR along with Defender for endpoint Compatibility

bridgetlitt — Wed, 02 Apr 2025 17:49:43 GMT

Does anyone have a list of guidelines to follow when running cortex xdr (Report mode) in parallel with defender (active mode) for workstations as well as servers? Do i need to do any exclusions/whitelisting? Do I need to disable any features in XDR to prevent issues?

In xdr compatibility matrix https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Compatibility-Matrix/Cortex-XDR-agent-compatibility-with-third-party-security-products you can see it mentions defender and emet separately but if emet like features are present in defender (exploit protection features), running exploit protection in both xdr and defender for endpoint should not work as well correct?

Re: Cortex XDR along with Defender for endpoint Compatibility

jmazzeo — Thu, 03 Apr 2025 16:56:46 GMT

Hi @bridgetlitt, usually when running two security products in the same endpoint you need to disable the exploit prevention in one of them. In this case, as the XDR is the "passive" product, should be done with the Cortex console.

There is no official support for XDR in report mode and Defender in active mode, the only supported mode is stated in the URL that you shared in the post.

If this post answers your question, please mark it as the solution.

topic Cortex XDR along with Defender for endpoint Compatibility in Cortex XDR Discussions

Cortex XDR along with Defender for endpoint Compatibility

Re: Cortex XDR along with Defender for endpoint Compatibility