Cortex XDR 7.9 blocking windows defender

[LaPedra_Evans]

Hello,

Since upgrading our endpoints to version 7.9, we keep getting popups that Windows Defender is blocking some applications and now our endpoint support personnel is no longer able to make the needed changes to the local firewalls for the user. I didn't see anything in the release notes that reference this being an issue, can someone please assist?

[mavraham]

Hi @LaPedra_Evans, thank you for writing to Live Community!

Per the Cortex XDR Compatibility Matrix if Cortex XDR is running alongside Microsoft Defender it recommended that Defender will be set to passive mode.

Please also note that if you are creating new agent settings and the Cortex XDR agent registers with the Windows Security Center as an official Antivirus (AV) software product. As a result, Windows shuts down Microsoft Defender on the endpoint automatically, except for endpoints that are running Windows Server versions. To avoid performance issues, Palo Alto Networks recommends that you disable or remove Windows Defender from endpoints that are running Windows Server versions and where the Cortex XDR agent is installed.

There are other potential performance issues with having both XDR and Defender running together on an endpoint. You can read about them here.

If disabling Defender does not help or is not an option, I suggest opening a ticket through our Customer Support Portal for a deeper inspection.

Hope this helps.