topic Firewall cortex and Windows 11 in Cortex XSOAR Discussions

Firewall cortex and Windows 11

J.LondooAcua — Thu, 20 Nov 2025 15:15:04 GMT

Hello, I have a question regarding the Cortex Firewall.

Does the Cortex Firewall component take control of the Windows Firewall? In other words, if the Windows Firewall is active on an endpoint, will Windows Defender show that it's being managed by Cortex?

Thanks.

Re: Firewall cortex and Windows 11

tlmarques — Fri, 21 Nov 2025 11:34:51 GMT

Hi,

The Cortex Firewall component takes control of the Windows Firewall if you configure the Extensions Policy in Cortex XDR.
If you don’t, what happens is that XDR will act as the "antivirus", and the Windows Firewall will continue to be managed manually by Windows or through GPO.
In my case, we create policies in XDR and separate them by type — for example, firewall policies for PCs, for laptops, and for servers.

Re: Firewall cortex and Windows 11

J.LondooAcua — Fri, 21 Nov 2025 15:06:45 GMT

My question might be a bit silly, but I only recently started working with Cortex. I'm wondering if, once installed, it shows an option in the Windows firewall indicating that it's being managed by Cortex. I'm not sure if I'm explaining myself clearly.

Regards

Re: Firewall cortex and Windows 11

tlmarques — Fri, 21 Nov 2025 16:43:59 GMT

When you install Cortex and you don’t create any extensible Firewall policies, the Windows Firewall appears as normal.

If you create an extensible firewall policy in Cortex, then on the endpoint where the policy is applied, a message will appear indicating that the firewall is being managed by Cortex.

on tenant you can configure FW here :